System and Method to Support Boot Guard for Original Development Manufacturer BIOS Development
An information handling system authenticates a key manifest of a memory with a hash of a key associated with the key manifest. When the key manifest is authentic, the system authenticates a boot policy manifest with the hash of first public key associated with the boot policy manifest. When the boot policy manifest is authentic, the system validates a pre-boot block of the memory based upon the hash of the pre-boot block stored in the boot policy manifest and directs a processor to execute the pre-boot code when the pre-boot block is valid. A processor executes the pre-boot code to execute a reset vector and to determine if the boot block is valid with hash of the boot block, and executes the boot code when the boot block is valid.
1 . An information handling system, comprising:
a processor;
a memory device configured to store code including:
a boot block including boot code;
a pre-boot block including a hash of the boot block and pre-boot code;
a boot policy manifest including a first public key and a hash of the pre-boot block; and
a key manifest including a second public key and a hash of a first public key; and
a controller including a hash of a second public key, the controller configured to:
authenticate that the key manifest is valid based upon the hash of the second public key;
authenticate that the boot policy manifest is valid based upon the hash of the first public key;
validate the pre-boot block based upon the hash of the pre-boot block included in the authenticated boot policy manifest; and
direct the processor to execute the pre-boot code in response to validating the pre-boot block;
wherein the processor is configured to:
execute the pre-boot code to execute a reset vector and to determine whether the boot block is valid based upon the hash of the boot block; and
execute the boot code in response to determining that the boot block is valid.
2 . The information handling system of claim 1 , further comprising:
a bypass setting configurable in one of a secure mode and a bypass mode, wherein the processor is further configured to determine whether the bypass setting is in the secure mode or in the bypass mode in response to determining that the boot block is not valid.
3 . The information handling system of claim 2 , wherein the processor if further configured to halt the boot process in response to determining that the bypass setting is in the secure mode.
4 . The information handling system of claim 2 , wherein the processor if further configured to execute the boot code in response to determining that the bypass setting is in the bypass mode.
5 . The information handling system of claim 4 , further comprising:
a management interface, wherein the processor is further configured to provide an indication that the boot code is being executed to the management interface in further response to determining that the bypass setting is in the bypass mode.
6 . The information handling system of claim 4 , further comprising:
a log, wherein the processor is further configured to provide a log entry indication that the boot code is being executed to the log in further response to determining that the bypass setting is in the bypass mode.
7 . The information handling system of claim 1 , wherein the processor is further configured, prior to validating the boot block, to initialize a keyboard controller style (KCS) interface and to initialize a general purpose input/output (GPIO).
8 . The information handling system of claim 1 , wherein the boot code includes Universal Extensible Firmware Interface (UEFI) security phase code, UEFI Pre-EFI Initialization phase code, memory reference code, UEFI Driver Execution Environment phase code, and UEFI Boot Device Select phase code.
9 . A method, comprising:
authenticating, by a controller of an information handling system, that a key manifest stored on a memory device of the information handling system is valid based upon a hash of a first public key associated with the key manifest, the hash of the first public key stored in the controller;
authenticating, by the controller, that a boot policy manifest stored on the memory device is valid based upon a hash of a second public key associated with the boot policy manifest, the hash of the second public key included in the key manifest;
validating, by the controller, a pre-boot block stored on the memory device based upon a hash of the pre-boot block, the hash of the pre-boot block included in the boot policy manifest;
directing, by the controller, a processor of the information handling system to execute the pre-boot code in response to validating the pre-boot block;
executing, by the processor, the pre-boot code to execute a reset vector and to determine whether the boot block is valid based upon a hash of the boot block, the hash of the boot block included in the pre-boot block; and
executing, by the processor, the boot code in response to determining that the boot block is valid.
10 . The method of claim 9 , further comprising:
determining, by the processor, whether a bypass setting of the information handling system is in a secure mode or in a bypass mode in response to determining that the boot block is not valid.
11 . The method of claim 10 , further comprising:
halting, by the processor, the boot process in response to determining that the bypass setting is in the secure mode.
12 . The method of claim 10 , further comprising:
executing, by the processor, the boot code in response to determining that the bypass setting is in the bypass mode.
13 . The method of claim 12 , further comprising:
providing, by the processor, an indication that the boot code is being executed to a management interface of the information handling system in further response to determining that the bypass setting is in the bypass mode.
14 . The method of claim 12 , further comprising:
providing, by the processor, a log entry indication that the boot code is being executed to a log of the information handling system in further response to determining that the bypass setting is in the bypass mode.
15 . The method of claim 9 , wherein prior to validating the boot block, the method further comprises:
initializing, by the processor; a keyboard controller style (KCS) interface; and
initializing, by the processor, a general purpose input/output (GPIO).
16 . The method of claim 9 , wherein the boot code includes Universal Extensible Firmware Interface (UEFI) security phase code, UEFI Pre-EFI Initialization phase code, memory reference code, UEFI Driver Execution Environment phase code, and UEFI Boot Device Select phase code.
17 . An information handling system, comprising:
a memory device configured to store code including:
a boot block including boot code; and
a pre-boot block including a hash of the boot block and pre-boot code; and
a controller configured to:
validate the pre-boot; and
direct a processor to execute the pre-boot code in response to validating the pre-boot block;
wherein the processor is configured to:
execute the pre-boot code to execute a reset vector and to determine whether the boot block is valid based upon the hash of the boot block; and
execute the boot code in response to determining that the boot block is valid.
18 . The information handling system of claim 17 , further comprising:
a bypass setting configurable in one of a secure mode and a bypass mode, wherein the processor is further configured to determine whether the bypass setting is in the secure mode or in the bypass mode in response to determining that the boot block is not valid.
19 . The information handling system of claim 18 , wherein the processor if further configured to halt the boot process in response to determining that the bypass setting is in the secure mode.
20 . The information handling system of claim 18 , wherein the processor if further configured to execute the boot code in response to determining that the bypass setting is in the bypass mode.