Firmware secure boot customization extensions
An information handling system may include memory circuitry comprising a BIOS and a database including a first set of one or more cryptographic keys usable to authenticate code executable by the BIOS; and a physical storage medium other than the memory circuitry, wherein the physical storage medium includes a custom database including a second set of one or more cryptographic keys usable to authenticate code executable by the BIOS. The information handling system is configured to load a BIOS extension into the BIOS by: determining that the first set of one or more cryptographic keys does not include any key usable to authenticate the BIOS extension; determining that the second set of one or more cryptographic keys includes a particular key usable to authenticate the BIOS extension; authenticating the BIOS extension via the particular key; and in response to the authenticating, loading and executing the BIOS extension.
1. An information handling system comprising:
at least one processor;
memory circuitry comprising a Basic Input/Output System (BIOS), wherein the memory circuitry further comprises a database including a first set of one or more cryptographic keys usable to authenticate first code that is executable by the BIOS by verifying one or more first cryptographic signatures associated with the first code; and
a physical storage medium other than the memory circuitry, wherein the physical storage medium includes a custom database including a second set of one or more cryptographic keys usable to authenticate second code that is executable by the BIOS by verifying one or more second cryptographic signatures associated with the second code;
wherein the information handling system is configured to load a BIOS extension into the BIOS by:
determining that the first set of one or more cryptographic keys stored in the memory circuitry does not include any key usable to authenticate the BIOS extension;
determining that the second set of one or more cryptographic keys stored in the physical storage medium includes a particular key usable to authenticate the BIOS extension;
authenticating the BIOS extension via the particular key; and
in response to the authenticating, loading and executing the BIOS extension.
2. The information handling system of claim 1 , wherein the physical storage medium comprises a hard drive and/or a solid-state drive.
3. The information handling system of claim 1 , wherein the BIOS is a Unified Extensible Firmware Interface (UEFI) BIOS.
4. The information handling system of claim 1 , wherein the information handling system is further configured to:
determine that the BIOS extension is associated with a key in a forbidden signature database; and
prevent loading of the BIOS extension.
5. The information handling system of claim 4 , wherein the forbidden signature database is located on the memory circuitry.
6. The information handling system of claim 1 , wherein a Core Root of Trust for Measurement (CRTM) associated with the BIOS is usable to authenticate the custom database.
7. A method comprising:
an information handling system loading a Basic Input/Output System (BIOS) extension, wherein the information handling system includes:
at least one processor;
memory circuitry comprising a BIOS, wherein the memory circuitry further comprises a database including a first set of one or more cryptographic keys usable to authenticate first code that is executable by the BIOS by verifying one or more first cryptographic signatures associated with the first code; and
a physical storage medium other than the memory circuitry, wherein the physical storage medium includes a custom database including a second set of one or more cryptographic keys usable to authenticate second code that is executable by the BIOS by verifying one or more second cryptographic signatures associated with the second code;
wherein loading the BIOS extension includes:
determining that the first set of one or more cryptographic keys stored in the memory circuitry does not include any key usable to authenticate the BIOS extension;
determining that the second set of one or more cryptographic keys stored in the physical storage medium includes a particular key usable to authenticate the BIOS extension;
authenticating the BIOS extension via the particular key; and
in response to the authenticating, loading and executing the BIOS extension.
8. The method of claim 7 , wherein the physical storage medium comprises a hard drive and/or a solid-state drive.
9. The method of claim 7 , wherein the BIOS is a Unified Extensible Firmware Interface (UEFI) BIOS.
10. The method of claim 7 , further comprising:
prior to loading and executing the BIOS extension, determining that the BIOS extension is not associated with a key in a forbidden signature database.
11. The method of claim 10 , wherein the forbidden signature database is located on the memory circuitry.
12. The method of claim 7 , wherein a Core Root of Trust for Measurement (CRTM) associated with the BIOS is usable to authenticate the custom database.
13. An article of manufacture comprising a non-transitory, computer-readable medium having computer-executable code thereon that is executable by a processor of an information handling system, wherein the information handling system includes:
memory circuitry comprising a Basic Input/Output System (BIOS), wherein the memory circuitry further comprises a database including a first set of one or more cryptographic keys usable to authenticate first code that is executable by the BIOS by verifying one or more first cryptographic signatures associated with the first code; and
a physical storage medium other than the memory circuitry, wherein the physical storage medium includes a custom database including a second set of one or more cryptographic keys usable to authenticate second code that is executable by the BIOS by verifying one or more second cryptographic signatures associated with the second code;
wherein the code is executable for loading a BIOS extension by:
determining that the first set of one or more cryptographic keys stored in the memory circuitry does not include any key usable to authenticate the BIOS extension;
determining that the second set of one or more cryptographic keys stored in the physical storage medium includes a particular key usable to authenticate the BIOS extension;
authenticating the BIOS extension via the particular key; and
in response to the authenticating, loading and executing the BIOS extension.
14. The article of claim 13 , wherein the physical storage medium comprises a hard drive and/or a solid-state drive.
15. The article of claim 13 , wherein the BIOS is a Unified Extensible Firmware Interface (UEFI) BIOS.
16. The article of claim 13 , wherein the information handling system is further configured to:
determine that the BIOS extension is associated with a key in a forbidden signature database; and
prevent loading of the BIOS extension.
17. The article of claim 16 , wherein the forbidden signature database is located on the memory circuitry.
18. The article of claim 13 , wherein a Core Root of Trust for Measurement (CRTM) associated with the BIOS is usable to authenticate the custom database.