Firmware policy enforcement via a security processor
Embodiments described herein are directed to firmware policy enforcement of a computing device. For example, a security processor of the computing device is utilized to boot the computing device. During a boot session, the security processor loads and executes specialized firmware. The specialized firmware, when executed, causes the security processor to determine whether other types of firmware to be executed on the computing device is in compliance with a policy specified by the specialized firmware. Based at least on a determination that the other firmware is in compliance with the policy, the security processor executes the other firmware. Based at least on a determination that the other firmware is not in compliance with the policy, the security processor performs a mitigation with respect to the other firmware.
1. A system, comprising:
at least one processor circuit;
at least one memory that stores first firmware that, when executed, causes the at least one processor circuit to:
during a boot session of the system:
determine whether second firmware loaded during the boot session is in compliance with at least one policy rule specified by the first firmware, the first firmware comprising an application programming interface configured to receive policy parameters for the at least one policy rule;
based at least on a determination that the second firmware is in compliance with the at least one policy rule, execute the second firmware; and
based at least on a determination that the second firmware is not in compliance with the at least one policy rule, perform a mitigation with respect to the second firmware.
2. The system of claim 1 , wherein the at least one policy rule comprises at least one of:
a first policy rule that specifies a valid version number of the second firmware;
a second policy rule specifies a valid hash of the second firmware; or
a third policy rule that specifies a valid digital signature of the second firmware.
3. The system of claim 1 , wherein the at least one processor is configured to perform the mitigation by:
preventing the execution of the second firmware.
4. The system of claim 1 , wherein the at least one processor is configured to perform the mitigation by:
logging an event that indicates that the second firmware is not in compliance; and
executing the second firmware.
5. The system of claim 1 , wherein the operating system executes on a central processing circuit of a plurality of central processing cores.
6. The system of claim 5 , wherein the processing circuit is implemented on a same die as the plurality of central processing circuit cores.
7. A method implemented by a processor circuit of a computing device, comprising:
during a boot session of the computing device:
determining whether first firmware loaded during the boot session is in compliance with at least one policy rule specified by second firmware loaded during the boot session, the second firmware comprising an application programming interface configured to receive policy parameters for the at least one policy rule;
based at least on a determination that the first firmware is in compliance with the at least one policy rule, executing the first firmware; and
based at least on a determination that the first firmware is not in compliance with the at least one policy rule, performing a mitigation with respect to the first firmware.
8. The method of claim 7 , wherein the at least one policy rule comprises at least one of:
a first policy rule that specifies a valid version number of the first firmware;
a second policy rule specifies a valid hash of the first firmware; or
a third policy rule that specifies a valid digital signature of the first firmware.
9. The method of claim 7 , wherein said performing the mitigation comprises:
preventing the execution of the first firmware.
10. The method of claim 7 , wherein said performing the mitigation comprises:
logging an event that indicates that the first firmware is not in compliance; and
executing the first firmware.
11. The method of claim 7 , wherein the operating system executes on a central processing circuit of a plurality of central processing cores.
12. The method of claim 11 , wherein the processing circuit is implemented on a same die as the plurality of central processing circuit cores.
13. A computer-readable storage medium having program instructions recorded thereon that, when executed by a processor of a computing device, perform a method, the method comprising:
during a boot session of the computing device:
determining whether first firmware loaded during the boot session is in compliance with at least one policy rule specified by second firmware loaded during the boot session, the second firmware comprising an application programming interface configured to receive policy parameters for the at least one policy rule;
based at least on a determination that the first firmware is in compliance with the at least one policy rule, executing the first firmware; and
based at least on a determination that the first firmware is not in compliance with the at least one policy rule, performing a mitigation with respect to the first firmware.
14. The computer-readable storage medium of claim 13 , wherein the at least one policy rule comprises at least one of:
a first policy rule that specifies a valid version number of the first firmware;
a second policy rule specifies a valid hash of the first firmware; or
a third policy rule that specifies a valid digital signature of the first firmware.
15. The computer-readable storage medium of claim 13 , wherein said performing the mitigation comprises:
preventing the execution of the first firmware.
16. The computer-readable storage medium of claim 13 , wherein said performing the mitigation comprises:
logging an event that indicates that the first firmware is not in compliance; and
executing the first firmware.
17. The computer-readable storage medium of claim 13 , wherein the operating system executes on a central processing circuit of a plurality of central processing cores.
18. The computer-readable storage medium of claim 13 , wherein the second firmware is loaded prior to the first firmware during the boot session.
19. The computer-readable storage medium of claim 18 , wherein a security processing core of the computing device verifies a public key associated with the second firmware during the boot session.
20. The computer-readable storage medium of claim 19 , wherein verifying the public key associated with the second firmware comprises sending a read request to a fuse controller.