Multi-user hidden feature enablement in firmware
A firmware can include multiple features for multiple users enabled based on the presence of authenticated variables. When attempting to access functionality of a feature, the firmware will check for the presence of an authenticated variable corresponding to the feature. The authenticated variable for the feature may be installed by a user. The firmware may data to enable a feature that includes an authenticated variable for enabling the feature and an authenticated variable corresponding to an end-user of the firmware. If the firmware has access to the end-user authenticated variable, the feature authenticated variable is installed.
1. A computing system, comprising:
a non-volatile memory device storing instructions that, in response to execution by a processor, cause the processor to:
receive data to enable a firmware feature that defines a functionality of a firmware, the received data including a feature authenticated variable and an end-user authenticated variable;
store the feature authenticated variable when the end-user authenticated variable corresponds to a second end-user authenticated variable extant in the non-volatile memory device;
receive a request to provide the functionality defined by the firmware feature; and
provide access to the functionality defined by the firmware feature when the feature authenticated variable is present in the authenticated variable data storage.
2. The computing system of claim 1 , wherein the instructions are configured to further cause the processor to prevent storage of the feature authenticated variable when the end-user authenticated variable is not present in the non-volatile memory device.
3. The computing system of claim 1 , wherein the instructions are configured to further cause the processor to prevent access to the functionality when the feature authenticated variable is not present in the non-volatile memory device.
4. The computing system of claim 1 , wherein the received data further includes a serial number authenticated variable.
5. The computing system of claim 4 , wherein the instructions are configured to further cause the processor to store the serial number authenticated variable when the end-user authenticated variable and the serial number authenticated variable are present in the non-volatile memory device.
6. The computing system of claim 5 , wherein the instructions are configured to further cause the processor to prevent storage of the feature authenticated variable when the end-user authenticated variable or the serial number authenticated variable is not present in the non-volatile memory device.
7. The computing system of claim 1 , wherein the feature authenticated variable and the end-user authenticated variable have been signed jointly, in a single data structure, using a same private key.
8. A computing system, comprising:
a non-transitory computer-readable storage medium having instructions that, in response to execution, cause the computing system to:
parse firmware feature enablement data to determine a feature authenticated variable and an end-user authenticated variable;
attempt to retrieve, from a non-volatile memory device, an end-user value for the end-user authenticated variable;
store the feature authenticated variable at least in response to retrieving the end-user value for the end-user authenticated variable from the non-volatile memory device;
receive a request to provide functionality defined by a firmware feature of a firmware, wherein enablement of the firmware feature is based at least on the feature authenticated variable;
attempt to retrieve, from the non-volatile memory device, a feature value for the feature authenticated variable; and
provide access to the functionality defined by the firmware feature in response to retrieving the feature value for the feature authenticated variable from the non-volatile memory device.
9. The computing system of claim 8 , wherein the firmware feature enablement data further includes a serial number authenticated variable.
10. The computing system of claim 9 , wherein the instructions are configured to further cause the computing system to store the serial number authenticated variable in response to retrieving the end-user value for the end-user authenticated variable and the serial number authenticated variable from the non-volatile memory device.
11. The computing system of claim 10 wherein the feature authenticated variable, the end-user authenticated variable, and the serial number authenticated variable have been signed using a same private key.
12. The computing system of claim 8 wherein the feature authenticated variable and the end-user authenticated variable have been signed jointly, in a single data structure, using the private key.