Method to protect BIOS NVRAM from malicious code injection by encrypting NVRAM variables and system therefor

1. A method to protect non-volatile random access memory (NVRAM) from malicious code, the method comprising:

allocating, by a hardware processor of an information handling system, a first region at the NVRAM to store firmware instructions;

allocating, by the hardware processor of the information handling system, a second region to store data that is not the firmware instructions; and

receiving, by the hardware processor of the information handling system, the data to be stored at the second region, the receiving of the data in response to servicing a system management interrupt, the data received at a software function configured to store the data at the second region, the software function including operations for:

generating a random symmetric encryption key;

encrypting the data using the random symmetric encryption key to provide encrypted data, the random symmetric encryption key to only be associated with the data; and

storing the encrypted data and the random symmetric encryption key at the second region at the NVRAM;

wherein the encrypted data protects the second region at the NVRAM from executing the malicious code.

2. The method of claim 1 , wherein the random symmetric encryption key is stored at the second region as plain text.

3. The method of claim 1 , wherein the encrypted data and the random symmetric encryption key are linked by reference by a single globally unique identifier.

4. The method of claim 1 , further comprising decrypting the encrypted data using the random symmetric encryption key in response to receiving a request to retrieve the data from the second region at the NVRAM.

5. The method of claim 1 , further comprising receiving the data from a Windows library function after initialization of an operating system.

6. The method of claim 1 , further comprising receiving the data from a unified extensible firmware interface protocol.

7. The method of claim 1 , further comprising receiving the data during a driver initialization phase of a boot process at the information handling system.

8. The method of claim 1 , wherein the encrypted data and the random symmetric encryption key are referenced at the NVRAM by a single memory address.

9. The method of claim 1 , further comprising:

receiving a request to retrieve the data from the second region at the NVRAM;

retrieving the encrypted data from the second region at the NVRAM;

retrieving the random symmetric encryption key from the second region at the NVRAM;

decrypting the encrypted data using the random symmetric encryption key to unencrypt the data; and

providing the data to fulfill the request.

10. The method of claim 1 , wherein the data is an environment variable.

11. The method of claim 1 , wherein the function for the write operations is configured to prevent execution of malicious code stored at the second region.

12. An information handling system comprising:

a processor;

a system memory device; and

a non-volatile firmware memory device including a first region for storing basic input/output system (BIOSE code and a second region for storing data that is not the BIOS code, the BIOS code executing store operations to the second region, the store operations to further:

receive the data to be stored at the second region of the non-volatile firmware memory device, the data received in response to servicing a system management interrupt;

generate a random symmetric encryption key for each different store operation of the store operations executed by the BIOS code;

encrypt the data using the random symmetric encryption key to provide encrypted data that corresponds to the each different store operation; and

store the encrypted data and the generated random symmetric encryption key at the second region of the non-volatile firmware memory device.

13. The information handling system of claim 12 , further comprising instructions to decrypt the encrypted data using the random symmetric encryption key in response to receiving a request to retrieve the data from the second region.

14. The information handling system of claim 12 , wherein the encrypted data and the random symmetric encryption key are linked by reference by a single identifier.

15. The information handling system of claim 12 , wherein the random symmetric encryption key is stored as plain text.

16. The information handling system of claim 12 , wherein the store operations are configured to prevent execution of malicious code stored at the second region.

17. A non-transitory data storage medium storing instructions executable by a processor to cause the processor to:

allocate a first region of a non-volatile firmware memory to store BIOS code;

allocate a second region of the non-volatile firmware memory to store data that is not the BIOS code; and

implement a function for write operations to the second region of the non-volatile firmware memory, the function for the write operations configured to:

receive the data in response to servicing a system management interrupt at the processor;

generate a different random symmetric encryption key for each corresponding one of the write operations to the second region of the non-volatile firmware memory;

encrypt the data using the different random symmetric encryption key to provide encrypted data for the corresponding one of the write operations to the second region of the non-volatile firmware memory; and

store the encrypted data and the different random symmetric encryption key at the second region of the non-volatile firmware memory for the corresponding one of the write operations.

18. The non-transitory data storage medium of claim 17 , further comprising instructions to:

receive a request to retrieve the data from the second region;

retrieve the encrypted data;

retrieve the different random symmetric encryption key;

decrypt the encrypted data using the different random symmetric encryption key to unencrypt the data; and

provide the unencrypted data to fulfill the request.

19. The non-transitory data storage medium of claim 17 , wherein the different random symmetric encryption key is stored as plain text.