Method for authenticating firmware volume and system therefor
A first firmware volume of a Unified Extensible Firmware Interface (UEFI) compliant information handling system is accessed. Authentication information is retrieved from the first firmware volume using a UEFI Secure Architecture Protocol. Based on the authentication information, it is determined if the first firmware volume is a first type of firmware volume. If the first firmware volume is the first type of firmware volume, the first firmware volume is authenticated using the first authentication information and an authentication procedure other than Secure Boot authentication. If the first firmware volume is a second type of firmware volume, the second type different than the first type, the first firmware volume is authenticated using the first authentication information and the Secure Boot authentication.
1. A method comprising:
accessing a first firmware volume of a Unified Extensible Firmware Interface (UEFI) compliant information handling system;
retrieving authentication information from the first firmware volume using a UEFI Secure Architecture Protocol (SAP); and
determining whether to authenticate the first firmware volume using Secure Boot authentication based on the authentication information.
2. The method of claim 1 , further comprising:
determining that the first firmware volume is provided by an original equipment manufacturer of the information handling system based on the authentication information; and
authenticating the first firmware volume using the first authentication information and an authentication procedure other than Secure Boot authentication.
3. The method of claim 1 , further comprising:
determining that the first firmware volume is provided by an original design manufacture (ODM), the ODM associated with a component of the information handling system based on the authentication information; and
authenticating the first firmware volume using the first authentication information and the Secure Boot authentication.
4. The method of claim 1 , further comprising:
executing a plurality of images at the first firmware volume, without conducting further authentication of the images, in response to successful authentication of the first firmware volume.
5. The method of claim 1 , wherein a section at the first firmware volume includes a proprietary secure architecture policy, the policy accessed using the SAP.
6. The method of claim 5 , wherein the proprietary secure architecture policy identifies a subset of images included at the first firmware volume, the subset including a plurality of images, the subset of images authenticated using only one Secure Boot certificate.
7. The method of claim 1 , wherein prior to retrieving the authentication information, a UEFI platform initialization process is not aware of whether the first firmware volume is provided by an original equipment manufacturer of the information handling system or whether the first firmware volume is provided by an original design manufacture (ODM), the ODM associated with a component of the information handling system.
8. A method comprising:
determining that a first firmware volume is provided by an original equipment manufacturer (OEM) of an information handling system;
authenticating the first firmware volume using a first authentication procedure, the first authentication procedure other than Secure Boot authentication;
determining that a second firmware volume is provided by an original design manufacturer (ODM), the ODM associated with a component of the information handling system; and
authenticating the second firmware volume using Secure Boot authentication.
9. The method of claim 8 , wherein authenticating the first firmware volume comprises:
retrieving first authentication information from the first firmware volume using a Unified Extensible Firmware Interface Secure Architecture Protocol;
authenticating the first firmware volume using the first authentication information; and
executing a plurality of images included at the first firmware volume, without performing further authentication of the images, in response to determining that the authenticating was successful.
10. The method of claim 8 , wherein authenticating the second firmware volume comprises:
retrieving a Secure Boot certificate from the second firmware volume using a Unified Extensible Firmware Interface Secure Architecture Protocol;
authenticating the second firmware volume using the Secure Boot certificate; and
executing a plurality of images included at the second firmware volume without performing further authentication of the images.
11. The method of claim 8 , wherein authenticating the second firmware volume comprises:
retrieving authentication information from the second firmware volume using a Unified Extensible Firmware Interface Secure Architecture Protocol;
failing to authenticate the second firmware volume using the first authentication procedure; and
determining that the second firmware volume is not an OEM firmware volume based on the failing to authenticate.
12. The method of claim 8 , wherein a section at the first firmware volume includes a proprietary secure architecture policy and the first authentication information, the policy accessed using a Unified Extensible Firmware Interface Secure Architecture Protocol.
13. An information handling system comprising:
a data storage device for storing a first firmware volume and a second firmware volume; and
a processor to:
access the first firmware volume;
retrieve authentication information from the first firmware volume; and
classify the first firmware volume as one of two distinct types of firmware volumes based on the authentication information, the two distinct types including a first type and a second type.
14. The information handling system of claim 13 , wherein:
if the first firmware volume is the first type of firmware volume, the processor is further to authenticate the first firmware volume using the authentication information and an authentication procedure other than Secure Boot authentication; and
if the first firmware volume is the second type of firmware volume, the processor is further to authenticate the first firmware volume using the authentication information and Secure Boot authentication.
15. The information handling system of claim 13 , wherein a first type of firmware volume is a firmware volume provided by an original equipment manufacturer of the information handling system.
16. The information handling system of claim 13 , wherein the second type of firmware volume is a firmware volume provided by an original design manufacture (ODM), the ODM associated with a component of the information handling system.
17. The information handling system of claim 13 , wherein the processor is further to:
execute a plurality of images at the first firmware volume, without conducting further authentication of the images, in response to successful authentication of the first firmware volume.
18. The information handling system of claim 13 , wherein a section at the first firmware volume includes a proprietary secure architecture policy and the authentication information, the policy retrieved using a Unified Extensible Firmware Interface Secure Architecture Protocol.
19. The information handling system of claim 18 , wherein the proprietary secure architecture policy identifies a subset of images included at the first firmware volume, the subset including a plurality of images, the subset of images authenticated using only one Secure Boot certificate.
20. The information handling system of claim 13 , wherein prior to retrieving the authentication information, a Unified Extensible Firmware Interface platform initialization process is not aware of whether the first firmware volume is the first type of firmware volume or the second type of firmware volume.