Selective enforcement of secure boot database entries in an information handling system

1. A method comprising:

receiving, by a baseboard management controller (BMC) of an information handling system, a request to authenticate an image from among a plurality of images;

determining a type of the image from among a plurality of types comprising a device firmware type and a boot image type, the determining comprising:

determining a storage location of the image; and

determining the type of the image based on the storage location;

retrieving, from an entry within a Unified Extensible Firmware Interface (UEFI) signature database, a certificate utilized to sign the image, the certificate being used to validate a single device and cannot be used to validate other similar devices, wherein each entry in the UEFI signature database contains a certificate used to sign at least one image from among the plurality of images;

determining, from within a verification database, a verification entry that corresponds to the entry of the UEFI signature database, wherein an associated UEFI comprises a plurality of different database components comprising a platform key (PK) database, a key exchange key (KEK) database, an authorization signature database (Db), a forbidden signature database (Dbx), and at least one verification database;

identifying, from the verification entry, a particular type of image which the certificate may be used to authenticate, wherein each verification entry in the verification database (1) is associated with a particular certificate in the UEFI signature database and (2) identifies, from among a plurality of image types, a type of image for which the particular certificate may be used to authenticate;

determining whether the type of the image is the particular type; and

in response to determining the type of the image is the particular type, authenticating the image using the certificate.

2. The method of claim 1 , wherein the UEFI signature database is the authorization signature database, the method further comprising:

in response to authenticating the image using the certificate, permitting execution of the authorized image.

3. The method of claim 1 , wherein the UEFI signature database is the forbidden signature database, the method further comprising:

in response to authenticating the image using the certificate, forbidding execution of the authorized image.

4. The method of claim 1 , wherein retrieving the certificate further comprises:

sequentially checking each entry of a plurality of entries in the UEFI signature database until the entry having the certificate used to sign the image is identified.

5. The method of claim 4 , further comprising:

in response to determining the type of the image is not the particular type, continuing the sequential checking the plurality of entries for a subsequent certificate that was used to sign the image; and

in response to identifying the subsequent certificate within the remaining entries, retrieving the subsequent certificate as the certificate.

6. The method of claim 5 , further comprising:

in response to being unable to locate the subsequent certificate within the remaining entries:

generating a notification that indicates that the image was not able to be authenticated; and

issuing the notification to at least one of an output device and an error log.

7. The method of claim 1 , further comprising:

in response to determining the storage location is accessed using a device base address register, identifying the type of the image as a device firmware type.

8. The method of claim 1 , further comprising:

in response to determining the storage location is a filesystem, identifying the type of the image as a boot image type.

9. The method of claim 1 , further comprising executing a verification firmware during a driver execution phase (DXE) to facilitate verification of UEFI images, bootloaders, and/or drivers prior to loading/booting an corresponding component.

10. The method of claim 1 , wherein:

the verification entry specifies both a device firmware type and a particular device that a corresponding certificate in the UEFI signature database may be used to authenticate; and

the authenticating the image using the certificate further comprises:

determining: (i) the particular device identified in the verification entry and (ii) whether the particular device matches a particular device that is associated with the UEFI image; and

in response to determining (i) the image type identified in the verification entry matches the identified image type of the UEFI image and (ii) the particular device identified in the verification entry matches the device associated with the UEFI image, authenticating the UEFI image using the certificate.

11. The method of claim 10 , wherein:

the particular device is one of a network interface device, a storage controller, and a graphics device;

and

the particular device is identified in the verification entry by a unique identifier from among unique identifies comprising a serial number, a PCIe vendor ID and PCIe device ID, and a media access control (MAC) address.

12. An information handling system comprising:

a Unified Extensible Firmware Interface (UEFI) signature database having a plurality of entries, each entry having a certificate used to sign at least one corresponding image from among a plurality of images;

a verification database having a plurality of verification entries corresponding to the plurality of entries in the UEFI signature database, wherein each verification entry in the verification database (1) is associated with a particular certificate in the UEFI signature database and (2) identifies, from among a plurality of image types, a type of image for which the particular certificate may be used to authenticate;

a boot loader that identifies an image from among the plurality of images for authentication; and

at least one processor that:

determines a type of the image from among a plurality of types comprising a device firmware type and a boot image type, wherein the at least one processor:

determines a storage location of the image; and

determines the type of the image based on the storage location;

retrieves, from an entry within the UEFI signature database, a certificate utilized to sign the image, the certificate being used to validate a single device and cannot be used to validate other similar devices;

determines, from within a verification database, a verification entry that corresponds to the entry of the UEFI signature database and identifies, from the verification entry, a particular type of image which the certificate may be used to authenticate, wherein an associated UEFI comprises a plurality of different database components comprising a platform key (PK) database, a key exchange key (KEK) database, an authorization signature database (Db), a forbidden signature database (Dbx), and at least one verification database;

determines whether the type of the image is the particular type; and

in response to determining the type of the image is the particular type, authenticates the image using the certificate.

13. The information handling system of claim 12 , wherein the UEFI signature database is the authorization signature database, and wherein the processor:

in response to authenticating the image using the certificate, permits execution of the authorized image.

14. The information handling system of claim 12 , wherein the UEFI signature database is the forbidden signature database, and wherein the processor:

in response to authenticating the image using the certificate, forbids execution of the authorized image.

15. The information handling system of claim 12 , wherein in retrieving the certificate, the processor:

sequentially checks each entry of the plurality of entries in the UEFI signature database until the entry having the certificate used to sign the image is identified.

16. The information handling system of claim 15 , wherein the processor:

in response to determining the type of the image is not the particular type, continues the sequential checking the plurality of entries for a subsequent certificate that was used to sign the image; and

in response to identifying the subsequent certificate within the remaining entries, retrieves the subsequent certificate as the certificate.

17. The information handling system of claim 16 , wherein the processor in response to being unable to locate the subsequent certificate within the remaining entries:

generates a notification that indicates that the image was not able to be authenticated; and

issues the notification to at least one of an error log and an output device of the information handling system.

18. The information handling system of claim 12 , wherein the processor:

in response to determining the storage location is accessed using a device base address register of the information handling system, identifies the type of the image as a device firmware type.

19. The information handling system of claim 12 , wherein the processor:

in response to determining the storage location is a filesystem in a non-volatile storage that is accessible to the information handling system, identifies the type of the image as a boot image type.

20. The information handling system of claim 12 , wherein:

the verification entry specifies both a device firmware type and a particular device that a corresponding certificate in the UEFI signature database may be used to authenticate; and

to authenticate the image using the certificate, the processor:

determines: (i) the particular device identified in the verification entry and (ii) whether the particular device matches a particular device that is associated with the UEFI image; and

in response to determining (i) the image type identified in the verification entry matches the identified image type of the UEFI image and (ii) the particular device identified in the verification entry matches the device associated with the UEFI image, authenticates the UEFI image using the certificate.