Systems and methods for securing and loading bios drivers and dependencies in a predefined and measured load order
An information handling system may include a processor and a basic input/output system (BIOS) comprising a program of instructions comprising boot firmware configured to be the first code executed by the processor when the information handling system is booted or powered on, the BIOS configured to, during boot of the information handling system: (i) read a predefined measurement of an order of loading of BIOS drivers configured to execute during execution of the BIOS, such predefined measurement made during build of the BIOS; (ii) perform a runtime measurement of an order of loading of the BIOS drivers during actual runtime of the information handling system; (iii) compare the predefined measurement to the runtime measurement; and (iv) responsive to a mismatch between the predefined measurement and the runtime measurement, respond with a remedial action.
1. An information handling system comprising:
a processor; and
a basic input/output system (BIOS) comprising a program of instructions comprising boot firmware configured to be the first code executed by the processor when the information handling system is booted or powered on, the BIOS configured to, during boot of the information handling system:
read a predefined measurement of an order of loading of BIOS drivers configured to execute during execution of the BIOS, such predefined measurement made during build of the BIOS wherein the predefined measurement is determined in accordance with content of each BIOS driver and a sequence in which the BIOS drivers were loaded;
perform a runtime measurement of an order of loading of the BIOS drivers during actual runtime of the information handling system;
compare the predefined measurement to the runtime measurement; and
responsive to a mismatch between the predefined measurement and the runtime measurement, respond with a remedial action.
2. The information handling system of claim 1 , wherein:
the predefined measurement is a cryptographic hash of the order of loading of the BIOS drivers during the predefined measurement made during build of the BIOS; and
the runtime measurement is a cryptographic hash of the order of loading of the BIOS drivers during actual runtime of the information handling system.
3. The information handling system of claim 2 , wherein the predefined measurement is a level-based driver load order list, wherein each level represents a particular phase, step, and/or priority of BIOS execution.
4. The information handling system of claim 1 , wherein:
the predefined measurement is signed with a private key; and
the BIOS is further configured to apply a public key associated with the private key to the predefined measurement.
5. The information handling system of claim 1 , wherein the remedial action comprises one of shutting down the information handling system, rebooting the information handling system, booting to a diagnostic operating system of the information handling system, and performing a recovery operation.
6. The information handling system of claim 1 , wherein the remedial action comprises one of restoring a safe configuration of the information handling system and restoring a safe firmware revision of the BIOS.
7. A method comprising, in an information handling system comprising a processor and a basic input/output system (BIOS) comprising a program of instructions comprising boot firmware configured to be the first code executed by the processor when the information handling system is booted or powered on, during boot of the information handling system by the BIOS:
reading a predefined measurement of an order of loading of BIOS drivers configured to execute during execution of the BIOS, such predefined measurement made during build of the BIOS wherein the predefined measurement is determined in accordance with content of each BIOS driver and a sequence in which the BIOS drivers were loaded;
performing a runtime measurement of an order of loading of the BIOS drivers during actual runtime of the information handling system;
comparing the predefined measurement to the runtime measurement; and
responsive to a mismatch between the predefined measurement and the runtime measurement, responding with a remedial action.
8. The method of claim 7 , wherein:
the predefined measurement is a cryptographic hash of the order of loading of the BIOS drivers during the predefined measurement made during build of the BIOS; and
the runtime measurement is a cryptographic hash of the order of loading of the BIOS drivers during actual runtime of the information handling system.
9. The method of claim 8 , wherein the predefined measurement is a level-based driver load order list, wherein each level represents a particular phase, step, and/or priority of BIOS execution.
10. The method of claim 7 , wherein:
the predefined measurement is signed with a private key; and
the method further comprises applying a public key associated with the private key to the predefined measurement.
11. The method of claim 7 , wherein the remedial action comprises one of shutting down the information handling system, rebooting the information handling system, booting to a diagnostic operating system of the information handling system, and performing a recovery operation.
12. The method of claim 7 , wherein the remedial action comprises one of restoring a safe configuration of the information handling system and restoring a safe firmware revision of the BIOS.
13. An article of manufacture comprising:
a non-transitory computer readable medium; and
computer-executable instructions carried on the non-transitory computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to, in a basic input/output system (BIOS) of an information handling system:
read a predefined measurement of an order of loading of BIOS drivers configured to execute during execution of the BIOS, such predefined measurement made during build of the BIOS wherein the predefined measurement is determined in accordance with content of each BIOS driver and a sequence in which the BIOS drivers were loaded;
perform a runtime measurement of an order of loading of the BIOS drivers during actual runtime of the information handling system;
compare the predefined measurement to the runtime measurement; and
responsive to a mismatch between the predefined measurement and the runtime measurement, respond with a remedial action.
14. The article of claim 13 , wherein:
the predefined measurement is a cryptographic hash of the order of loading of the BIOS drivers during the predefined measurement made during build of the BIOS; and
the runtime measurement is a cryptographic hash of the order of loading of the BIOS drivers during actual runtime of the information handling system.
15. The article of claim 14 , wherein the predefined measurement is a level-based driver load order list, wherein each level represents a particular phase, step, and/or priority of BIOS execution.
16. The article of claim 13 , wherein:
the predefined measurement is signed with a private key; and
the instructions are for further causing the processor to apply a public key associated with the private key to the predefined measurement.
17. The article of claim 13 , wherein the remedial action comprises one of shutting down the information handling system, rebooting the information handling system, booting to a diagnostic operating system of the information handling system, and performing a recovery operation.
18. The article of claim 13 , wherein the remedial action comprises one of restoring a safe configuration of the information handling system and restoring a safe firmware revision of the BIOS.