Customer-owned trust of device firmware
Systems and methods for providing and verifying customer-owned trust of device firmware are described. In some embodiments, an Information Handling System (IHS), may include a processor and a Basic Input/Output System (BIOS) coupled to the processor, the BIOS having program instructions stored thereon that, upon execution, cause the IHS to: receive, from a user, selection of a pre-boot code module; export a digest of the pre-boot code module to the user; and import the digest signed by the user.
1. An Information Handling System (IHS), comprising:
a processor; and
a Basic Input/Output System (BIOS) coupled to the processor, the BIOS having program instructions stored thereon that, upon execution, cause the IHS to:
receive, from a user during a boot process, selection of a pre-boot code module;
export, during the boot process, a digest of the pre-boot code module to the user;
import, during the boot process, a signed digest signed by the user;
store a public key or certificate usable to authenticate the signed digest in a primary database (db) of a Secure Boot policy, wherein the primary database (db) does not allow storage of the signed digest;
store the signed digest in a secondary database (db2) of the Secure Boot policy, wherein the secondary database is distinct from a revoked signature database (dbx) of the Secure Boot policy; and
in response to the pre-boot code module failing Secure Boot verification during a subsequent booting of the IHS:
calculate a digest for the pre-boot code module;
search the secondary database (db2) of the Secure Boot policy for a digest matching the calculated digest;
in response to finding the matching digest in the secondary database (db2), verify the signature of the matching digest against one or more public keys or certificates stored in the primary database (db) of the Secure Boot policy; and
in response to verification of the signature of the matching digest, load the pre-boot code module.
2. The IHS of claim 1 , wherein the pre-boot code module includes an input/output (I/O) device firmware.
3. The IHS of claim 1 , wherein the pre-boot code module includes an Operating System (OS) boot loader.
4. The IHS of claim 1 , wherein the program instructions, upon execution, further cause the IHS to provide a list of pre-boot code modules to the user prior to receiving the selection from the user.
5. The IHS of claim 1 , wherein the receiving, exporting, and importing operations are performed via a baseboard management controller (BMC).
6. The IHS of claim 1 , wherein the selection includes other pre-boot code modules, wherein exporting the digest includes exporting a distinct digest for each of the selected pre-boot code modules, and wherein importing the digest includes importing each of the distinct digests signed with a same or a different key.
7. The IHS of claim 1 , wherein the program instructions, upon execution, further cause the IHS to allow the user to remove the Certificate Authority (CA)-issued public key or certificate corresponding to the selected pre-boot code module from the primary database (db).
8. The IHS of claim 1 , wherein the pre-boot code module is selected indirectly as part of an operation initiated by the user to trust a current IHS configuration.
9. The IHS of claim 8 , wherein the current IHS configuration includes additional pre-boot code modules.
10. The IHS of claim 8 , wherein the program instructions, upon execution, further cause the IHS to:
remove digests from the primary database (db) of the Secure Boot policy for pre-boot code modules previously trusted as part of a previous IHS configuration;
calculate digests for pre-boot code modules part of the current IHS configuration; and
store the calculated digests in the primary database (db) of the Secure Boot policy.
11. The IHS of claim 1 , wherein the program instructions, upon execution, further cause the IHS to:
receive, from the user, selection of another pre-boot code module; and
add a digest of the another pre-boot code module to the revoked signature database (dbx) of the Secure Boot policy.
12. A Basic I/O System (BIOS) having program instructions stored thereon that, upon execution by a processor of an Information Handling System (IHS), cause the IHS to:
provide, during a boot process, a list of pre-boot code modules to a user;
receive, from the user during the boot process, selection of a pre-boot code module;
export, during the boot process, a digest of the pre-boot code module to the user;
import, during the boot process, a digest signed by the user;
store, during the boot process, a public key or certificate usable to authenticate the signed digest in a primary database (db) of the Secure Boot policy, wherein the primary database (db) does not allow storage of the signed digest;
store, during the boot process, the signed digest in a secondary database (db2) of the Secure Boot policy wherein the secondary database (db2) is distinct from a revoked signature database (dbx) of the Secure Boot policy; and
in response to the pre-boot code module failing Secure Boot verification during a subsequent booting of the IHS:
calculate a digest for the pre-boot code module;
search the secondary database (db2) of the Secure Boot policy for a digest matching the calculated digest;
in response to finding the matching digest in the secondary database (db2), verify the signature of the matching digest against one or more public keys or certificates stored in the primary database (db) of the Secure Boot policy; and
in response to verification of the signature of the matching digest, load the pre-boot code module.
13. The BIOS of claim 12 , wherein the pre-boot code module includes an input/output (I/O) device firmware or an Operating System (OS) boot loader.
14. In an Information Handling System (IHS) having a Basic I/O System (BIOS), a method comprising:
providing, during a boot process by the IHS through execution of program instructions stored in the BIOS, a list of pre-boot code modules;
receiving, during the boot process at the IHS through execution of program instructions stored in the BIOS, selection of a pre-boot code module;
exporting, during the boot process by the IHS through execution of program instructions stored in the BIOS, a digest of the pre-boot code module;
importing, during the boot process by the IHS through execution of program instructions stored in the BIOS, the digest signed by the user;
storing, during the boot process by the IHS through execution of program instructions stored in the BIOS, a public key or certificate usable to authenticate the signed digest in a primary database (db) of the Secure Boot policy, wherein the primary database (db) does not allow storage of the signed digest;
storing, during the boot process by the IHS through execution of program instructions stored in the BIOS, the signed digest in a secondary database (db2) of the Secure Boot policy, wherein the secondary database (db2) is distinct from a revoked signature database (dbx) of the Secure Boot policy; and
in response to the pre-boot code module failing Secure Boot verification during a subsequent booting of the IHS:
calculating, by the IHS through execution of program instructions stored in the BIOS, a digest for the pre-boot code module;
searching, by the IHS through execution of program instructions stored in the BIOS, the secondary database (db2) of the Secure Boot policy for a digest matching the calculated digest;
in response to finding the matching digest in the secondary database (db2), verifying, by the IHS through execution of program instructions stored in the BIOS, the signature of the matching digest against one or more public keys or certificates stored in the primary database (db) of the Secure Boot policy; and
in response to verification of the signature of the matching digest, loading, by the IHS through execution of program instructions stored in the BIOS, the pre-boot code module.
15. The method of claim 14 , wherein the pre-boot code module includes an input/output (I/O) device firmware or an Operating System (OS) boot loader.