Method for generating and executing encrypted BIOS firmware and system therefor
View Patent ↗A firmware image is received at an information handling system. A symmetric key is generated and stored at a trusted platform module (TPM). The firmware image is encrypted using the symmetric key. The encrypted firmware image is stored in a non-volatile memory.
1. A method comprising:
receiving an unencrypted firmware image at system memory at an information handling system;
generating a symmetric key;
storing the symmetric key at a trusted platform module (TPM);
encrypting a first portion of the unencrypted firmware image using the symmetric key to provide an encrypted firmware image, the first portion including instructions executed during a driver execution phase of a boot sequence; and
storing the encrypted firmware image in a non-volatile memory.
2. The method of claim 1 , further comprising storing the symmetric key sealed to a first TPM platform configuration register state.
3. The method of claim 1 , further comprising storing the symmetric key prior to the driver execution phase of the boot sequence.
4. The method of claim 1 , wherein a second portion of the encrypted firmware image that is to be executed prior to the driver execution phase of the boot sequence is not encrypted.
5. The method of claim 1 , further comprising initiating a system boot at the information handling system after receiving the unencrypted firmware image and before generating the symmetric key.
6. The method of claim 1 , wherein receiving the firmware image further comprises:
storing the unencrypted firmware image at a system memory;
setting a firmware update flag;
initiating a boot process at the information handling system; and
determining the firmware update flag is set.
7. The method of claim 1 , further comprising encrypting the unencrypted firmware image during the driver execution phase of the boot sequence.
8. The method of claim 1 , wherein generating the symmetric key further comprises:
storing the symmetric key at a system memory; and
deleting the symmetric key from the system memory after encrypting the firmware image.
9. The method of claim 1 , further comprising:
retrieving the symmetric key from the TPM prior to the driver execution phase of the boot sequence;
retrieving the encrypted firmware image from the non-volatile memory; and
decrypting the first portion of the encrypted firmware image using the symmetric key.
10. The method of claim 9 , wherein retrieving the symmetric key further comprises un-sealing the symmetric key at the TPM based on a current TPM platform configuration register state.
11. A method comprising:
initializing a trusted platform module (TPM) and system memory at an information handling system;
retrieving a symmetric key from the TPM prior to a driver execution phase of a boot sequence;
retrieving an encrypted firmware image from a non-volatile memory, wherein a first portion of the encrypted firmware image that includes instructions executed during the driver execution phase of the boot sequence is encrypted, and wherein a second portion of the encrypted firmware image that is to be executed prior to the driver execution phase of the boot sequence is not encrypted;
decrypting the first portion of the encrypted firmware image using the symmetric key to provide a decrypted firmware image;
measuring the firmware image to a TPM platform configuration register (PCR) prior to the driver execution phase of the boot sequence; and
executing the firmware image to complete booting of the information handling system.
12. The method of claim 11 , wherein retrieving the symmetric key further comprises un-sealing the symmetric key based on a current PCR state.
13. The method of claim 11 , wherein retrieving the symmetric key further comprises:
storing the symmetric key in a system memory; and
clearing the symmetric key from the system memory after the decrypting.
14. An information handling system comprising:
a trusted platform module (TPM);
a non-volatile memory; and
a processor coupled to the TPM and the non-volatile memory, the processor configured to execute instructions to:
receive an unencrypted firmware image at the information handling system;
generate a symmetric key;
store the symmetric key at the TPM;
encrypt a first portion of the unencrypted firmware image using the symmetric key to provide an encrypted firmware image, wherein the first portion includes instructions executed during a driver execution phase of a boot sequence, and a second portion of the encrypted firmware image that is to be executed prior to the driver execution phase of the boot sequence is not encrypted; and
store the encrypted firmware image in the non-volatile memory.
15. The information handling system of claim 14 , wherein the processor is further to store the symmetric key sealed to a first TPM platform configuration register (PCR) state that is prior to the driver execution phase of the boot sequence.
16. The information handling system of claim 14 , wherein the processor is further to store the symmetric key prior to the driver execution phase of the boot sequence.
17. The information handling system of claim 14 , wherein the processor is further to initiate a boot at the information handling system after receiving the unencrypted firmware image and before generating the symmetric key.
18. The information handling system of claim 14 , wherein the processor is further to encrypt the unencrypted firmware image during the driver execution phase of the boot sequence.
19. The information handling system of claim 14 , wherein the processor is further to:
retrieve the symmetric key from the TPM prior to the driver execution phase of the boot sequence;
retrieve the encrypted firmware image from the non-volatile memory; and
decrypt the first portion of the encrypted firmware image using the symmetric key.
20. The information handling system of claim 19 , wherein retrieving the symmetric key further comprises un-sealing the symmetric key at the TPM based on a current TPM platform configuration register state.