Methods, systems, and program products for securely blocking access to system operations and data
Methods, systems, and program products are disclosed for blocking input/output (I/O) access to a computing system. A method includes establishing a portion of the machine-readable instructions as sole controller of the system responsive to the machine-readable instructions and preventing unauthorized replacement of the machine-readable instructions. The method also includes blocking user access to internal resources of the computing system and preventing predefined input/output (I/O) of the computing system.
1. A method performed on a computing system, the method comprising:
receiving a special capsule read-only memory (“ROM”) having a payload configured to block input/output (I/O) access, the payload comprising machine-readable instructions;
loading the special capsule ROM to a scratchpad memory using a flash ROM utility of the computing system;
performing a hard restart of the computing system;
flashing the special capsule ROM;
preventing unauthorized replacement of the machine-readable instructions;
blocking user access to internal resources of the computing system; and
preventing predefined input/output (I/O) of the computing system.
2. The method of claim 1 , further comprising establishing a portion of the machine-readable instructions as a sole controller of the computing system responsive to the machine-readable instructions and replacing previously stored instructions by a different, predefined set of machine-readable instructions through an authorized process internal to the computing system responsive to the machine-readable instructions.
3. The method of claim 2 , further comprising:
creating encryption keys at time of blocking predefined input/output (I/O) access; and
validating the payload of a recovery capsule ROM based on the encryption keys.
4. The method of claim 1 , further comprising installing the machine-readable instructions using a unified extensible firmware interface (UEFI) capsule update process.
5. The method of claim 1 , further comprising:
determining that the received special capsule ROM is an authorized recovery capsule ROM; and
restoring normal operation of the computing system upon the authorized recovery capsule ROM being flashed into the computing system.
6. The method of claim 5 , wherein the determining comprises determining if the authorized recovery capsule ROM is available at a previously designated port of the computing system.
7. The method of claim 1 , further comprising validating the payload based on previously created encryption keys, wherein the previously created encryption keys were generated by a manufacturer of the computing system.
8. A system comprising:
a processor; and
a storage device configured to store machine-readable instructions that, when executed by the processor, cause the processor to:
receive a special capsule read-only memory (“ROM”) having a payload configured to block input/output (I/O) access;
load the special capsule ROM to a scratchpad memory using a flash ROM utility of the system;
perform a hard restart of the system;
flash the special capsule ROM;
prevent unauthorized replacement of the machine-readable instructions;
block user access to internal resources of the system; and
prevent predefined input/output (I/O) of the system.
9. The system of claim 8 , wherein the machine-readable instructions further cause the processor to establish a portion of the machine-readable instructions as a sole controller of the system responsive to the machine readable instructions and replace previously stored instructions by a different, predefined set of machine-readable instructions through an authorized process internal to the system responsive to the machine-readable instructions.
10. The system of claim 8 , wherein the machine-readable instructions further cause the processor to install the machine-readable instructions using a unified extensible firmware interface (UEFI) capsule update process.
11. The system of claim 8 , wherein the machine-readable instructions further cause the processor to:
determine that the received special capsule ROM is an authorized recovery capsule ROM; and
restore normal operation of the system upon the authorized recovery capsule ROM being flashed into the system.
12. The system of claim 11 , wherein the machine-readable instructions further cause the processor to determine if the authorized recovery capsule ROM is available at a previously designated port of the system.
13. The system of claim 8 , wherein the machine-readable instructions further cause the processor to validate the payload based on previously created encryption keys.
14. The system of claim 13 , wherein the previously created encryption keys were previously generated by a manufacturer of the system.
15. A non-transitory computer-readable medium storing machine-readable instructions that, when executed by a processor of a computing system, cause the processor to:
receive a special capsule read-only memory (“ROM”) having a payload configured to block input/output (I/O) access, the payload comprising machine-readable instructions;
load the special capsule ROM to a scratchpad memory using a flash ROM utility of the computing system;
perform a hard restart of the computing system;
flash the special capsule ROM;
prevent unauthorized replacement of the machine-readable instructions;
block user access to internal resources of the computing system; and
prevent predefined input/output (I/O) of the computing system.
16. The non-transitory computer-readable medium of claim 15 ,
wherein the machine-readable instructions further cause the processor to establish a portion of the machine-readable instructions as a sole controller of the computing system responsive to the machine-readable instructions and replace previously stored instructions by a different, predefined set of machine-readable instructions through an authorized process internal to the computing system responsive to the machine-readable instructions.
17. The non-transitory computer-readable medium of claim 15 , wherein the machine-readable instructions further cause the processor to install the machine-readable instructions using a unified extensible firmware interface (UEFI) capsule update process.
18. The non-transitory computer-readable medium of claim 15 ,
wherein the machine-readable instructions further cause the processor to:
determine that the loaded special capsule ROM is an authorized recovery capsule ROM; and
restore normal operation of the computing system upon the authorized recovery capsule ROM being flashed into the computing system.
19. The non-transitory computer-readable medium of claim 18 ,
wherein the machine-readable instructions further cause the processor to determine if the authorized recovery capsule ROM is available at a previously designated port of the computing system.
20. The non-transitory computer-readable medium of claim 18 ,
wherein the machine-readable instructions further cause the processor to:
manipulate a version of basic input/output system (BIOS) firmware to be lower than a version associated with the recovery capsule ROM; and
validate the payload based on previously created encryption keys, wherein the previously created encryption keys were previously generated by a manufacturer of the computing system.