Systems and methods for access control of BIOS protocol notification
A BIOS may include a plurality of protocol drivers and a protocol notification manager configured to receive a protocol notification registration from a consumer driver of the plurality of protocol drivers, receive a unique key associated with the consumer driver, receive a pre-authorized list from a producer driver of the plurality of protocol drivers, the pre-authorized list comprising one or more signed consumer identifiers, each of the one or more signed consumer identifiers identifying a respective one of the plurality of protocol drivers authorized to receive a protocol notification from the producer driver, determine if the unique key successfully decrypts a signed consumer identifier associated with the consumer driver, and perform access control of protocol notification from the producer driver to the consumer driver based on whether the unique key successfully decrypts the signed consumer identifier associated with the consumer driver.
1. An information handling system comprising:
a processor; and
a basic input/output system (BIOS) embodied in non-transitory computer-readable media and configured to be the first code executed by the processor when the information handling system is booted and configured to initialize components of the information handling system into a known state, the BIOS comprising:
a plurality of protocol drivers; and
a protocol notification manager configured to:
receive a protocol notification registration from a first consumer driver of the plurality of protocol drivers;
receive from the first consumer driver, a unique key for decrypting a first signed consumer identifier, comprising a signed identifier of the first consumer driver, received from a producer driver of the plurality of protocol drivers;
receive a pre-authorized list from the producer driver, the pre-authorized list comprising one or more signed consumer identifiers, each of the one or more signed consumer identifiers identifying a respective one of the plurality of protocol drivers authorized to receive a protocol notification from the producer driver;
determine if the unique key successfully decrypts the first signed consumer identifier; and
perform access control of protocol notification from the producer driver to the first consumer driver based on whether the unique key successfully decrypts the first signed consumer identifier.
2. The information handling system of claim 1 , wherein performing access control comprises allowing protocol notification from the producer driver to the first consumer driver if the unique key successfully decrypts the first signed consumer identifier.
3. The information handling system of claim 1 , wherein performing access control comprises denying protocol notification from the producer driver to the first consumer driver if the unique key is unsuccessful in decrypting the first signed consumer identifier.
4. The information handling system of claim 3 , wherein performing access control further comprises logging information regarding denial of protocol notification.
5. The information handling system of claim 1 , wherein each of the plurality of protocol drivers includes protocol driver code and at least one of:
a unique key for each producer driver from which the protocol driver is authorized to receive protocol notification; and
a list of signed consumer identifiers for each consumer driver authorized to receive protocol installation notifications from the protocol driver.
6. The information handling system of claim 1 , wherein the BIOS comprises a Unified Extensible Firmware Interface.
7. The information handling system of claim 1 , wherein performing access control comprises determining whether the unique key in combination with a system public key successfully decrypts the first signed consumer identifier.
8. A method comprising, in an information handling system comprising a basic input/output system (BIOS) embodied in non-transitory computer-readable media and configured to be the first code executed by a processor when the information handling system is booted and configured to initialize components of the information handling system into a known state:
receiving a protocol notification registration from a first consumer driver of a plurality of protocol drivers embodied within the BIOS;
receiving, from the consumer driver, a unique key for decrypting a first signed consumer identifier, comprising a signed identifier of the first consumer driver, received from a producer driver of the plurality of protocol drivers;
receiving a pre-authorized list from the producer driver, the pre-authorized list comprising one or more signed consumer identifiers, each of the one or more signed consumer identifiers identifying a respective one of the plurality of protocol drivers authorized to receive a protocol notification from the producer driver;
determining if the unique key successfully decrypts the first signed consumer identifier; and
performing access control of protocol notification from the producer driver to the first consumer driver based on whether the unique key successfully decrypts the first signed consumer identifier.
9. The method of claim 8 , wherein performing access control comprises allowing protocol notification from the producer driver to the first consumer driver if the unique key successfully decrypts the first signed consumer identifier.
10. The method of claim 8 , wherein performing access control comprises denying protocol notification from the producer driver to the first consumer driver if the unique key is unsuccessful in decrypting the first signed consumer identifier.
11. The method of claim 10 , wherein performing access control further comprises logging information regarding denial of protocol notification.
12. The method of claim 8 , wherein each of the plurality of protocol drivers includes protocol driver code and at least one of:
a unique key for each producer driver from which the protocol driver is authorized to receive protocol notifications; and
a list of signed consumer identifiers for each consumer driver authorized to receive protocol installation notifications from the protocol driver.
13. The method of claim 8 , wherein the BIOS comprises a Unified Extensible Firmware Interface.
14. The method of claim 8 , wherein performing access control comprises determining whether the unique key in combination with a system public key successfully decrypts the first signed consumer identifier.
15. An article of manufacture comprising:
a non-transitory computer readable medium; and
computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to, in an information handling system comprising a basic input/output system (BIOS) embodied in non-transitory computer-readable media and configured to be the first code executed by the processor when the information handling system is booted and configured to initialize components of the information handling system into a known state:
receive a protocol notification registration from a first consumer driver of a plurality of protocol drivers embodied within the BIOS;
receive, from the first consumer driver, a unique key for decrypting a signed consumer identifier, comprising a signed identifier of the first consumer driver, received from a producer driver of the plurality of protocol drivers;
receive a pre-authorized list from the producer driver, the pre-authorized list comprising one or more signed consumer identifiers, each of the one or more signed consumer identifiers identifying a respective one of the plurality of protocol drivers authorized to receive a protocol notification from the producer driver;
determine if the unique key successfully decrypts the first signed consumer identifier; and
perform access control of protocol notification from the producer driver to the first consumer driver based on whether the unique key successfully decrypts the first signed consumer identifier.
16. The article of claim 15 , wherein performing access control comprises allowing protocol notification from the producer driver to the first consumer driver if the unique key successfully decrypts the first signed consumer identifier.
17. The article of claim 15 , wherein performing access control comprises denying protocol notification from the producer driver to the first consumer driver if the unique key is unsuccessful in decrypting the first signed consumer identifier.
18. The article of claim 17 , wherein performing access control further comprises logging information regarding denial of protocol notification.
19. The article of claim 15 , wherein each of the plurality of protocol drivers includes protocol driver code and at least one of:
a unique key for each producer driver from which the protocol driver is authorized to receive protocol notification; and
a list of signed consumer identifiers for each consumer driver authorized to receive protocol installation notifications from the protocol driver.
20. The information handling system of claim 15 , wherein the BIOS comprises a Unified Extensible Firmware Interface.
21. The article of claim 15 , wherein performing access control comprises determining whether the unique key in combination with a system public key successfully decrypts the first signed consumer identifier.