Systems and methods for key-based isolation of system management interrupt (SMI) functions and data

1. An information handling system, comprising:

a system memory; and

a programmable integrated circuit coupled to the system memory, the programmable integrated circuit being programmed to operate in a system management mode (SMM) to respond to a request received from a calling process executing on the programmable integrated circuit for access to at least one encrypted system management interrupt (SMI) function/library stored in the system memory by:

decrypting the requested SMI function/library from the system memory,

executing the decrypted requested SMI function/library from the system memory, and

then re-encrypting the requested SMI function/library in the system memory; and

where the programmable integrated circuit is programmed to operate in a non-SMM mode during normal operating system runtime, and to respond to receipt of a first system management interrupt (SMI) by:

entering a first SMM mode, decrypting, loading and executing a first SMI function or library from system memory that corresponds to the first SMM,

re-encrypting the first SMI function/library in the system memory after executing the first SMI function or library, and

then exiting the first SMM mode and returning to the normal operating system runtime.

2. The information handling system of claim 1 , where the requested SMI function/library in the system storage is a first SMI function/library that is encrypted by a first cryptographic key that is unique to the first SMI function/library and that is different from a second and different cryptographic key that is unique to at least one other second SMI function/library that is stored in the same system memory; and where the programmable integrated circuit is programmed to respond to a request received from a first calling process executing on the programmable integrated circuit by:

using the first cryptographic key to decrypt the requested first SMI function/library in the system memory prior to executing the decrypted first SMI function/library from the system memory, and

then using the first cryptographic key to re-encrypt the decrypted first SMI function/library in the system memory after executing the decrypted first SMI function/library.

3. The information handling system of claim 1 , where the encrypted SMI function/library is provisioned and stored as part of the system basic input/output system (BIOS) during manufacture or assembly of the information handling system; and where the programmable integrated circuit is programmed to load the encrypted SMI function/library into system memory, and to access the encrypted SMI function/library in system memory to decrypt and execute the encrypted SMI function/library.

4. The information handling system of claim 1 , where the programmable integrated circuit is programmed to dynamically add the encrypted SMI function/library at runtime to system basic input/output system (BIOS).

5. The information handling system of claim 1 , where the programmable integrated circuit is programmed to respond to receipt of a second system management interrupt (SMI) by:

entering a second SMM different from the first SMM mode, decrypting, loading and executing a second SMI function or library from system memory that corresponds to the second SMM and that is different from the first SMI function or library;

re-encrypting the second SMI function/library in the system memory after executing the second SMI function or library; and

then exiting the first SMM mode and returning to the normal operating system runtime.

6. An information handling system, comprising:

a system memory; and

a programmable integrated circuit coupled to the system memory, the programmable integrated circuit being programmed to operate in a system management mode (SMM) to respond to a request received from a calling process executing on the programmable integrated circuit for access to at least one encrypted system management interrupt (SMI) function/library stored in the system memory by:

decrypting the requested SMI function/library from the system memory,

executing the decrypted requested SMI function/library from the system memory, and

then re-encrypting the requested SMI function/library in the system memory;

where the requested SMI function/library in the system storage is a first SMI function/library that is encrypted by a first cryptographic key that is unique to the first SMI function/library and that is different from a second and different cryptographic key that is unique to at least one other second SMI function/library that is stored in the same system memory; and where the programmable integrated circuit is programmed to respond to a request received from a first calling process executing on the programmable integrated circuit by:

using the first cryptographic key to decrypt the requested first SMI function/library in the system memory prior to executing the decrypted first SMI function/library from the system memory, and

then using the first cryptographic key to re-encrypt the decrypted first SMI function/library in the system memory after executing the decrypted first SMI function/library; and

where the programmable integrated circuit is further programmed to respond to a request received from a second calling process different from the first calling process that is executing on the programmable integrated circuit for access to the second encrypted SMI function/library stored in the system memory by:

using the first cryptographic key to decrypt the requested second SMI function/library in the system memory prior to executing the decrypted second SMI function/library from the system memory, and

then using the first cryptographic key to re-encrypt the decrypted second SMI function/library in the system memory after executing the decrypted second SMI function/library.

7. The information handling system of claim 6 , where the programmable integrated circuit is further programmed to decrypt the first SMI function/library only upon receiving the first cryptographic key from the first calling process that is requesting access to the first SMI function/library, and to decrypt the second SMI function/library only upon receiving the second cryptographic key from the second calling process that is requesting access to the second SMI function/library.

8. An information handling system, comprising:

a system memory; and

a programmable integrated circuit coupled to the system memory, the programmable integrated circuit being programmed to operate in a system management mode (SMM) to respond to a request received from a calling process executing on the programmable integrated circuit for access to at least one encrypted system management interrupt (SMI) function/library stored in the system memory by:

decrypting the requested SMI function/library from the system memory,

executing the decrypted requested SMI function/library from the system memory, and

then re-encrypting the requested SMI function/library in the system memory;

where the requested SMI function/library in the system storage is encrypted by a first cryptographic key; and where the programmable integrated circuit is programmed to:

receive the first cryptographic key as provided from the calling process with the request for access to the requested SMI function/library,

use the provided first cryptographic key to decrypt the requested SMI function/library in the system memory prior to executing the decrypted requested SMI function/library from the system memory, and

then use the provided first cryptographic key to re-encrypt the requested SMI function/library in the system memory after executing the decrypted requested SMI function/library.

9. The information handling system of claim 8 , where the programmable integrated circuit is programmed to:

execute the decrypted requested SMI function/library to produce data before re-encrypting the requested SMI function/library in the system memory; and

provide the produced data in unencrypted form to the calling process.

10. The information handling system of claim 8 , where the programmable integrated circuit comprises one or more memory registers; where the requested SMI function/library in the system storage is encrypted by the first cryptographic key; and where the programmable integrated circuit is programmed to:

execute an operating system (OS) to retrieve the first cryptographic key from the calling process that is requesting access to the SMI function/library, and to store the retrieved first cryptographic key in memory registers of the programmable integrated circuit;

then access the memory registers to retrieve the stored first cryptographic key from the memory registers;

then use the retrieved first cryptographic key to decrypt the requested SMI function/library in the system memory;

then execute the decrypted requested SMI function/library; and

then use the retrieved first cryptographic key to re-encrypt the requested SMI function/library in the system memory after executing the decrypted requested SMI function/library.

11. A method, comprising operating a programmable integrated circuit of an information handling system in a system management mode (SMM) to respond to a request received from a calling process executing on the programmable integrated circuit for access to at least one encrypted system management interrupt (SMI) function/library stored in the system memory by:

decrypting the requested SMI function/library from the system memory;

executing the decrypted requested SMI function/library from the system memory; and

then re-encrypting the requested SMI function/library in the system memory;

where the method further comprises operating the programmable integrated circuit in a non-SMM mode during normal operating system runtime, and then to respond to receipt of a first system management interrupt (SMI) by:

entering a first SMM mode, decrypting, loading and executing a first SMI function or library from system memory that corresponds to the first SMM,

re-encrypting the first SMI function/library in the system memory after executing the first SMI function or library, and

then exiting the first SMM mode and returning to the normal operating system runtime.

12. The method of claim 11 , where the requested SMI function/library in the system storage is a first SMI function/library that is encrypted by a first cryptographic key that is unique to the first SMI function/library and that is different from a second and different cryptographic key that is unique to at least one other second SMI function/library that is stored in the same system memory; and where the method further comprises operating the programmable integrated circuit to respond to a request received from a first calling process executing on the programmable integrated circuit by:

using the first cryptographic key to decrypt the requested first SMI function/library in the system memory prior to executing the decrypted first SMI function/library from the system memory, and

then using the first cryptographic key to re-encrypt the decrypted first SMI function/library in the system memory after executing the decrypted first SMI function/library.

13. The method of claim 11 , where the programmable integrated circuit comprises one or more memory registers; where the requested SMI function/library in the system storage is encrypted by a cryptographic key; and where the method further comprises operating the programmable integrated circuit to:

execute an operating system (OS) to retrieve the cryptographic key from the calling process that is requesting access to the SMI function/library, and to store the retrieved cryptographic key in memory registers of the programmable integrated circuit;

then access the memory registers to retrieve the store cryptographic key from the memory registers;

then use the retrieved cryptographic key to decrypt the requested SMI function/library in the system memory;

then execute the decrypted requested SMI function/library; and

then use the retrieved cryptographic key to re-encrypt the requested SMI function/library in the system memory after executing the decrypted requested SMI function/library.

14. The method of claim 11 , further comprising operating the programmable integrated circuit to dynamically add the encrypted SMI function/library at runtime to system basic input/output system (BIOS), then load the encrypted SMI function/library into system memory, and then access the encrypted SMI function/library in system memory to decrypt and execute the encrypted SMI function/library.

15. The method of claim 11 , further comprising operating the programmable integrated circuit to respond to receipt of a second system management interrupt (SMI) by:

entering a second SMM different from the first SMM mode, decrypting, loading and executing a second SMI function or library from system memory that corresponds to the second SMM and that is different from the first SMI function or library;

re-encrypting the second SMI function/library in the system memory after executing the second SMI function or library; and

then exiting the first SMM mode and returning to the normal operating system runtime.

16. A method, comprising operating a programmable integrated circuit of an information handling system in a system management mode (SMM) to respond to a request received from a calling process executing on the programmable integrated circuit for access to at least one encrypted system management interrupt (SMI) function/library stored in the system memory by:

decrypting the requested SMI function/library from the system memory;

executing the decrypted requested SMI function/library from the system memory; and

then re-encrypting the requested SMI function/library in the system memory;

where the requested SMI function/library in the system storage is a first SMI function/library that is encrypted by a first cryptographic key that is unique to the first SMI function/library and that is different from a second and different cryptographic key that is unique to at least one other second SMI function/library that is stored in the same system memory; and where the method further comprises operating the programmable integrated circuit to respond to a request received from a first calling process executing on the programmable integrated circuit by:

using the first cryptographic key to decrypt the requested first SMI function/library in the system memory prior to executing the decrypted first SMI function/library from the system memory, and

then using the first cryptographic key to re-encrypt the decrypted first SMI function/library in the system memory after executing the decrypted first SMI function/library; and

where the method further comprises operating the programmable integrated circuit to receive and respond to a request received from a second calling process different from the first calling process that is executing on the programmable integrated circuit for access to the second encrypted SMI function/library stored in the system memory by:

using the first cryptographic key to decrypt the requested second SMI function/library in the system memory prior to executing the decrypted second SMI function/library from the system memory, and

then using the first cryptographic key to re-encrypt the decrypted second SMI function/library in the system memory after executing the decrypted second SMI function/library.

17. The method of claim 16 , where the method further comprises operating the programmable integrated circuit to decrypt the first SMI function/library only upon receiving the first cryptographic key from the first calling process that is requesting access to the first SMI function/library, and to decrypt the second SMI function/library only upon receiving the second cryptographic key from the second calling process that is requesting access to the second SMI function/library.

18. A method, comprising operating a programmable integrated circuit of an information handling system in a system management mode (SMM) to respond to a request received from a calling process executing on the programmable integrated circuit for access to at least one encrypted system management interrupt (SMI) function/library stored in the system memory by:

decrypting the requested SMI function/library from the system memory;

executing the decrypted requested SMI function/library from the system memory; and

then re-encrypting the requested SMI function/library in the system memory;

where the requested SMI function/library in the system storage is encrypted by a first cryptographic key; and where the method further comprises operating the programmable integrated circuit to:

receive the first cryptographic key as provided from the calling process with the request for access to the requested SMI function/library,

use the provided first cryptographic key to decrypt the requested SMI function/library in the system memory,

execute the decrypted requested SMI function/library to produce data and provide the produced data in unencrypted form to the calling process, and

then use the provided first cryptographic key to re-encrypt the requested SMI function/library in the system memory after executing the decrypted requested SMI function/library.

19. A method, comprising operating a programmable integrated circuit of an information handling system in a system management mode (SMM) to respond to a request received from a calling process executing on the programmable integrated circuit for access to at least one encrypted system management interrupt (SMI) function/library stored in the system memory by:

decrypting the requested SMI function/library from the system memory;

executing the decrypted requested SMI function/library from the system memory; and

then re-encrypting the requested SMI function/library in the system memory;

where the method further comprises provisioning and storing the encrypted SMI function/library as part of the system basic input/output system (BIOS) during manufacture or assembly of the information handling system; and then operating the programmable integrated circuit to load the encrypted SMI function/library into system memory, and to access the encrypted SMI function/library in system memory to decrypt and execute the encrypted SMI function/library.