Method and device for altering a unified extensible firmware interface (UEFI) secure boot process in a computing device

1. A method for altering a secure boot process in a computing device equipped with Unified Extensible Firmware Interface (UEFI)-compliant firmware, comprising:

identifying an interrupt command during a UEFI secure boot process for the computing device, the secure boot process interrupted in response to the command;

displaying to a user, following the interruption of the secure boot process, a listing of at least one task related to altering the secure boot process;

receiving a selection of a listed task;

invoking System Management Mode (SMM) in response to the selection of the listed task;

performing the selected task in SMM using a firmware module executable only within SMM;

exiting SMM after the performing of the task, and

booting the computing device after the exiting.

2. The method of claim 1 wherein the performing of the selected task further comprises:

enrolling a hash of unsigned executable code in a system security database.

3. The method of claim 1 wherein the performing of the selected task further comprises:

turning off a requirement to enforce the secure boot so as to allow all code to run during a boot sequence.

4. The method of claim 1 wherein the performing of the selected task further comprises:

clearing a system security database of all certificates and disabling the secure boot.

5. The method of claim 1 wherein the performing of the selected task further comprises:

restoring a system security database from a backup location or resetting the system security database to a factory setting.

6. The method of claim 1 wherein the interrupt command may only be received from a physically present user who is physically accessing the computing device.

7. The method of claim 1 wherein the interrupt command may be received from a user who is accessing the computing device from a remote location.

8. The method of claim 1 wherein the secure boot process is interrupted when a previously recorded request to alter the secure boot process is identified during the boot sequence.

9. The method of claim 8 wherein the request is recorded in a UEFI-defined variable by an operating system process.

10. A non-transitory computer-readable medium holding computer-executable instructions for altering a secure boot process in a computing device equipped with Unified Extensible Firmware Interface (UEFI)-compliant firmware, the instructions when executed causing the computing device to:

identify an interrupt command during a UEFI secure boot process for the computing device, the secure boot process interrupted in response to the command;

display to a user, following the interruption of the boot process, a listing of at least one task related to altering the secure boot process;

receive a selection of a listed task;

invoke System Management Mode (SMM) in response to the selection of the listed task;

perform the selected task in SMM using a firmware module executable only within SMM;

exit SMM after the performing of the task, and

boot the computing device after the exiting.

11. The medium of claim 10 wherein the performing of the selected task enrolls a hash of unsigned executable code in a system security database.

12. The medium of claim 10 wherein the performing of the selected task turns off a requirement to enforce the secure boot so as to allow all code to run during a boot sequence.

13. The medium of claim 10 wherein the performing of the selected task clears a system security database of all certificates and disabling the secure boot.

14. The medium of claim 10 wherein the performing of the selected task restores a system security database from a backup location or resetting the system security database to a factory setting.

15. The medium of claim 10 wherein the interrupt command may only be received from a physically present user who is physically accessing the computing device.

16. The medium of claim 10 wherein the interrupt command may be received from a user who is accessing the computing device from a remote location.

17. The medium of claim 10 wherein the secure boot process is interrupted when a previously recorded request to alter the secure boot process is identified during the boot sequence.

18. The medium of claim 17 wherein the request is recorded in a UEFI-defined variable by an operating system process.

19. A computing device equipped with Unified Extensible Firmware Interface (UEFI)-compliant firmware for altering a UEFI secure boot process, comprising:

a processor, the processor supporting System Management Mode (SMM);

a display surface in communication with the computing device;

an input mechanism; and

at least one firmware module, the firmware module when executed:

identifying an interrupt command during a UEFI secure boot process for the computing device, the secure boot process interrupted in response to the command;

displaying to a user, following the interruption of the boot process, a listing of at least one task related to altering the secure boot process;

receiving a selection of a listed task;

invoking System Management Mode (SMM) in response to the selection of the listed task;

performing the selected task in SMM using a firmware module executable only within SMM; and

booting the computing device after exiting SMM.

20. The computing device of claim 19 in which the task performed is to enroll a hash of executable code to be launched in the boot process into a system security database.