System and method for intercept of UEFI block I/O protocol services for BIOS based hard drive encryption support

1. A method for performing Unified Extensible Firmware Interface (UEFI) block input/output (I/O) access to storage devices that can be encrypted, the method comprising:

intercepting, by a UEFI interceptor block I/O driver, a caller-initiated block I/O command for I/O access to one or more target block addresses on a storage device that includes at least one encrypted storage block, the block I/O command being one of a read operation and a write operation including the one or more target block addresses;

identifying whether any of the one or more target block addresses is for an encrypted storage block by: identifying a dividing point between an encrypted portion of block storage and an unencrypted portion of block storage; and comparing the block addresses targeted by the block I/O command to the addresses above and below the dividing point;

in response to identifying that one or more of the target block addresses is for an encrypted storage block, forwarding data associated with the encrypted target storage block to an encryption-decryption module which performs an encryption of corresponding data to be stored within the encrypted storage block and a decryption of corresponding data being retrieved from the encrypted storage block; and

performing final handling of the block I/O command and associated data using the block I/O driver;

wherein I/O data stored within the encrypted storage block targeted by the block I/O command is first identified by the UEFI interceptor block I/O driver and processed by the encryption-decryption module to encrypt or decrypt the I/O data before final handling of the block I/O command is performed by the block I/O driver;

wherein in response to the block I/O command targeting both encrypted and unencrypted storage blocks, data associated with the encrypted storage block is pre-processed by encryption-decryption module before resulting encrypted data is forwarded along with the unencrypted data to respective encrypted storage blocks and unencrypted storage blocks.

2. The method of claim 1 , further comprising:

identifying the block I/O command as a write command including unencrypted write data; and

in response to at least a portion of the unencrypted write data being forwarded for storage to an identified encrypted storage block, triggering the encryption-decryption module to encrypt the portion of the unencrypted data that is to be stored within the identified encrypted storage block to generate encrypted data.

3. The method of claim 2 , wherein the performing final handling of the block I/O command comprises:

writing the encrypted data to the identified encrypted storage block; and

writing any remaining unencrypted data to a corresponding block address that is not for an encrypted storage block.

4. The method of claim 2 , further comprising:

placing the encrypted data within a first section of a write buffer; and

placing any remaining unencrypted data within a second section of the write buffer; and

wherein performing final handling of the block I/O commands comprises writing all data content of the write buffer to their associated block addresses targeted by the block I/O command.

5. The method of claim 1 , further comprising:

identifying the block I/O command as a read command for return of read data that includes at least some encrypted data stored within corresponding encrypted storage blocks;

in response to at least a portion of the read data being encrypted data:

triggering the encryption-decryption module to decrypt the encrypted data to generate unencrypted data; and

performing final handling of the block I/O command by: providing the unencrypted data processed by the encryption-decryption module to a caller that issued the block I/O command; and providing any remaining read data that was not stored within an encrypted block address to the caller.

6. The method of claim 5 , wherein providing the unencrypted data and providing the remaining read data comprises:

placing the any remaining read data within a first section of a read buffer; and

placing the unencrypted data within a second section of the read buffer; and

wherein performing final handling of the block I/O comments comprises forwarding the read buffer to a caller that issued the I/O block command.

7. The method of claim 1 , wherein the encryption-decryption module is an encryption-decryption card and forwarding data to the encryption-decryption module comprises forwarding the data with specific processing instructions to the encryption-decryption card.

8. The method of claim 1 , further comprising installing the block I/O driver during UEFI-initiated storage device discovery.

9. The method of claim 1 , further comprising installing the interceptor block I/O driver in response to determining that a discovered storage device is at least partially encrypted, wherein a block I/O driver is chained through the interceptor block I/O driver, which also is communicatively connected to the encryption-decryption module.

10. The method of claim 1 , wherein performing final handling of the block I/O commands comprises:

receiving a completion signal from the encryption-decryption module that indicates that processing by the module of data associated with a targeted encrypted block address has completed; and

in response to receiving the completion signal, forwarding the block I/O command along with the processed data to the block I/O driver.

11. An information handling system comprising:

a storage device;

a memory device

a processor communicatively coupled to the storage device and the memory device;

an encryption-decryption module accessible to the processor; and

a block input/output (I/O) driver maintained on the memory device and which can execute on the processor; and

a Unified Extensible Firmware Interface (UEFI) that executes on the processor and which includes a UEFI interceptor block I/O driver that:

intercepts, by a UEFI interceptor block I/O driver, a caller-initiated block I/O command for I/O access to one or more target block addresses on a storage device that includes at least one encrypted storage block, the block I/O command being one of a read operation and a write operation including the one or more target block addresses;

identifies whether any of the one or more target block addresses is for an encrypted storage block by: identifying a dividing point between an encrypted portion of block storage and an unencrypted portion of block storage; and comparing the block addresses targeted by the block I/O command to the addresses above and below the dividing point;

in response to identifying that one or more of the target block addresses is for an encrypted storage block, forwards data associated with the encrypted target storage block to an encryption-decryption module which performs an encryption of corresponding data to be stored within the encrypted storage block and a decryption of corresponding data being retrieved from the encrypted storage block; and

performs final handling of the block I/O command and associated data using the block I/O driver;

wherein I/O data stored within the encrypted storage block targeted by the block I/O command is first identified by the UEFI interceptor block I/O driver and processed by the encryption-decryption module to encrypt or decrypt the I/O data before final handling of the block I/O command is performed by the block I/O driver; and

wherein in response to the block I/O command targeting both encrypted and unencrypted storage blocks, data associated with the encrypted storage block is pre-processed by encryption-decryption module before resulting encrypted data is forwarded along with the unencrypted data to respective encrypted storage blocks and unencrypted storage blocks.

12. The information handling system of claim 11 , wherein the interceptor block I/O driver further:

identifies the block I/O command as a write command including unencrypted write data; and

in response to at least a portion of the unencrypted write data being forwarded for storage to an identified encrypted storage block, triggers the encryption-decryption module to encrypt the portion of the unencrypted data that is to be stored within the identified encrypted storage block to generate encrypted data.

13. The information handling system of claim 12 , wherein performing the final handling of the block I/O command comprises the block I/O driver configuring the processor to:

write the encrypted data to the identified encrypted storage block; and

write any remaining unencrypted data to a corresponding block address that is not an address of an encrypted storage block.

14. The information handling system of claim 12 , wherein the block I/O driver:

places the encrypted data within a first section of a write buffer;

places any remaining unencrypted data within a second section of the write buffer; and

performs final handling of the block I/O commands by writing all data content of the write buffer to their associated block addresses targeted by the block I/O command.

15. The information handling system of claim 11 , wherein the UEFI interceptor block I/O driver further:

identifies the block I/O command as a read command for return of read data that includes at least some encrypted data stored within corresponding encrypted block addresses; and

in response to at least a portion of the read data being encrypted data:

triggers the encryption-decryption module to decrypt the encrypted data to generate unencrypted data; and

performs final handling of the block I/O command by: providing the unencrypted data processed by the encryption-decryption module to a caller that issued the block I/O command; and providing any remaining read data that was not stored within an encrypted storage block to the caller.

16. The information handling system of claim 15 , wherein to provide the unencrypted data and provide the remaining read data comprises configuring the processor to:

place the any remaining read data within a first section of a read buffer; and

place the unencrypted data within a second section of the read buffer; and

wherein to perform final handling of the block I/O comments the processor forwards the read buffer to a caller that issued the I/O block command.

17. The information handling system of claim 15 , wherein the encryption-decryption module is an encryption-decryption card and forwarding data to the encryption-decryption module comprises forwarding the data with specific processing instructions to the encryption-decryption card.

18. The information handling system of claim 11 , wherein:

the UEFI interceptor block I/O driver further installs the interceptor block I/O driver in response to determining that a discovered storage device is at least partially encrypted, wherein the block I/O driver is chained through an interceptor block I/O driver, which also is communicatively connected to the encryption-decryption module.

19. The information handling system of claim 11 , wherein to perform final handling of the block I/O commands the UEFI interceptor block I/O driver:

receives a completion signal from the encryption-decryption module that indicates that processing by the module of data associated with a targeted encrypted block address has completed; and

in response to receiving the completion signal, forwards the block I/O command along with the processed data to the block I/O driver.