Granted Patent B2

US 11,663,344 · App. 17/332,184 · Granted May 30, 2023

Inventors: Balasingh P. Samuel (Round Rock, TX); Richard Martin Tonry (Austin, TX); Adolfo S. Montero (Pflugerville, TX); Jacob Vincent Mink (Austin, TX)

Assignee: Dell Products L.P.

G06F21/604G06F21/44G06F21/572

Abstract

Claims (65)

1. A method for binding an application to a platform of an information handling system with a basic input/output system (BIOS), the method comprising:

storing, in an information handling system memory medium, a plurality of application binding components received from an application binding server, the application binding components including an application binding public key, an application identifier, an application version, an application reference measurement, a reference certificate and an access control list (ACL) comprising a list of BIOS resources and access rights for each BIOS resource associated with the application identifier, and one or more application lease renewal triggers;

receiving, from an application installed on the information handling system, a request for access to the BIOS, the request including the ACL;

verifying one or more application parameters and the ACL;

sending platform metadata to the application, the platform metadata including a platform binding nonce;

sending, by the application to the application binding server, a request for verification including the application metadata, the platform metadata, the platform binding nonce, and an application nonce;

receiving, by the application binding server, the request for verification from the application;

verifying, by the application binding server, the application metadata, the platform metadata, the platform binding nonce, and the application nonce;

creating an application binding object (ABO) and a server nonce; and

sending the ABO to the application;

verifying, by the application, the platform binding nonce, the application nonce and the server nonce;

sending a binding certificate based on the ABO to the BIOS;

verifying, by the BIOS, the platform binding nonce;

creating, by the BIOS, a binding certificate from the plurality of application binding components;

verifying the binding certificate created by the BIOS against the binding certificate received from the application binding server; and

communicating a binding session credential (BSC) to the application.

2. The method of claim 1 , wherein communicating between the application and the BIOS further comprises:

the application sending a requested operation with the application reference measurement and the BSC to the BIOS;

the BIOS verifying the application reference measurement and the BSC;

the BIOS verifying the requested operation against the ACL; and

the BIOS communicating a result of the requested operation.

3. The method of claim 1 , wherein verifying one or more application parameters comprises verifying a unique application identifier matches an application identifier in the set of application binding components and a version of the application matches a version of the application in the set of application binding components.

4. The method of claim 1 , wherein verifying the application measurement comprises verifying a hash calculated for the application matches a hash for the application in the set of application binding components.

5. The method of claim 1 , wherein verifying the list of BIOS resources comprises verifying a BIOS resource in the list of BIOS resources and an access right corresponding to the BIOS resource.

6. The method of claim 1 , further comprising unbinding the application based on one or more application lease/renewal triggers.

7. The method of claim 1 , further comprising the application binding server signing the ABO with a private key, wherein the BIOS performs verifying the ABO with the stored application binding public key.

8. A system for controlling access to basic input/output system (BIOS) resources of an information handling system, the system comprising:

an application binding server configured to generate an application identifier, an application reference measurement and an access control list (ACL) comprising a list of BIOS resources and access rights for each BIOS resource associated with the application identifier for an application stored on the information handling system;

the information handling system comprising further comprising an operating system (OS) and a memory medium storing a plurality of application binding components for the application, the plurality of application binding components including the application identifier, the application reference measurement, the access control list (ACL), an application binding public key, an application version, and at least one application lease/renewal trigger;

wherein the information handling system is configured to:

initiate the application;

determine the application specifies one or more BIOS resources in the list of BIOS resources requiring BIOS access; and

send the ACL to the BIOS;

wherein the BIOS is configured to:

verify the application identifier and the application version; and

send platform metadata and a platform binding nonce to the application;

wherein the application is configured to:

send the platform binding nonce, the platform metadata, the application metadata and an application nonce to the application binding server; and

wherein the application binding server is configured to:

verify the platform binding nonce, the application nonce, the platform metadata and the application version;

generate a server nonce;

create an application binding object (ABO); and

send the ABO to the application;

wherein the application is configured to:

verify the platform binding nonce, the application nonce and the server nonce;

create a binding certificate based on the ABO; and

communicate the binding certificate based on the ABO to the BIOS;

wherein the BIOS is configured to:

verify the platform binding nonce;

generate a binding certificate from the set of application binding components;

verify the binding certificate generated from the set of application binding components against the binding certificate from the application binding server; and

communicate a binding session credential (BSC) to the application.

9. The system of claim 8 , wherein:

the application is configured to send a requested operation with the application reference measurement and the BSC to the BIOS; and

the BIOS is configured to:

verify the application reference measurement and the BSC;

verify the requested operation against the ACL; and

communicate a result of the requested operation.

10. The system of claim 8 , wherein verifying one or more application parameters comprises verifying a unique application identifier matches an application identifier and a version of the application matches a version of the application in the set of application binding credentials.

11. The system of claim 8 , wherein verifying the application measurement comprises verifying a hash calculated for the application matches a hash for the application in the set of application binding components.

12. The system of claim 8 , wherein verifying the list of BIOS resources comprises verifying a BIOS resource in the list of BIOS resources and an access right corresponding to the BIOS resource.

13. The system of claim 8 , wherein the BIOS is configured to unbind the application based on the one or more application lease/renewal triggers.

14. The system of claim 8 , wherein

the application binding server is configured to sign the ABO with a private key; and

the BIOS is configured to verify the ABO with the application binding public key.

Assignments (8)

Continuity (1)