System and method for securely storing firmware

1. A computer-implemented method of creating secure storage for firmware for a computing device, comprising:

creating, during a build of a ROM image, a designated secure firmware volume holding firmware for the computing device, the creating marking one or more files as requiring encrypted storage, the build combining the one or marked files into the designated secure firmware volume, the designated secure firmware volume located outside the ROM image; and

including, during the build of the ROM image, a reference to the designated secure firmware volume in a build of firmware placed in the ROM image, the reference including:

a message digest generated for the designated secure firmware volume;

at least one unique identifier used to write the designated secure firmware volume to secondary storage, and

a flag indicating a current encrypted status of the designated secure firmware volume.

2. The method of claim 1 wherein the at least one unique identifier also includes a globally unique ID (GUID) or a unique machine identifier for the computing device.

3. The method of claim 2 wherein a unique machine identifier is stored in a part of the ROM image that is loaded into a write-disabled memory location at a point in time prior to the loading of the operating system for the computing device.

4. The method of claim 1 wherein a secure storage encryption key is stored in a part of the ROM image loaded into a read-disabled memory location at a point in time prior to the loading of the operating system for the computing device.

5. The method of claim 1 , further comprising:

retrieving the designated secure firmware volume using the reference in the ROM image, the retrieving performed prior to the loading of the operating system for the computing device;

modifying the retrieved designated secure firmware volume; and

encrypting the modified designated secure firmware volume based on a result of an examination of the flag.

6. The method of claim 5 further comprising

generating a new message digest for the encrypted designated secure firmware volume;

writing the encrypted designated secure firmware volume to secondary storage outside the ROM image; and

updating the reference in the ROM image with a changed status for the flag.

7. The method of claim 6 wherein the reference is also updated with the new message digest.

8. A non-transitory medium holding computer-executable instructions for creating secure storage for firmware for a computing device, the instructions when executed causing a computing device to:

create, during a build of a ROM image, a designated secure firmware volume holding firmware for the computing device, the creating marking one or more files as requiring encrypted storage, the build combining the one or marked files into the designated secure firmware volume, the designated secure firmware volume located outside the ROM image; and

include, during the build of the ROM image, a reference to the designated secure firmware volume in a build of firmware placed in the ROM image, the reference including:

a message digest generated for the designated secure firmware volume;

at least one unique identifier used to write the designated secure firmware volume to secondary storage, and

a flag indicating a current encrypted status of the designated secure firmware volume.

9. The method of claim 8 wherein the at least one unique identifier also includes a globally unique ID (GUID) or a unique machine identifier for the computing device.

10. The medium of claim 9 wherein a unique machine identifier is stored in a part of the ROM image that is loaded into a write-disabled memory location at a point in time prior to the loading of the operating system for the computing device.

11. The medium of claim 8 wherein a secure storage encryption key is stored in a part of the ROM image loaded into a read-disabled memory location at a point in time prior to the loading of the operating system for the computing device.

12. The medium of claim 8 wherein the instructions when executed further cause the computing device to:

retrieve the designated secure firmware volume using the reference in the ROM image, the retrieving performed prior to the loading of the operating system for the computing device;

modify the retrieved designated secure firmware volume; and encrypt the modified designated secure firmware volume based on a result of an examination of the flag.

13. The medium of claim 12 wherein the instructions when executed further cause the computing device to:

generate a new message digest for the encrypted designated secure firmware volume;

write the encrypted designated secures firmware volume to secondary storage outside the ROM image; and

update the reference in the ROM image with a changed status for the flag.

14. The medium of claim 13 wherein the reference is also updated with the new message digest.

15. A system for creating secure storage of firmware for a computing device that executes from a ROM pre-boot, comprising:

a firmware ROM image, the firmware ROM image including a reference for at least one designated secure firmware volume holding firmware for the computing device, the creating of the designated secure firmware volume marking one or more files as requiring encrypted storage, a build combining the one or marked files into the designated secure firmware volume, the designated secure firmware volume located outside the ROM image and created during the build of the ROM image, the reference to the at least one designated secure firmware volume including:

a message digest generated for the designated secure firmware volume;

at least one unique identifier used to write the designated secure firmware volume to secondary storage, and

a flag indicating a current encrypted status of the designated secure firmware volume; and

a secure storage encryption key used to encrypt the designated secure firmware volume following a modification of the designated secure firmware volume, the encryption occurring based on a result of an examination of the flag, a new message digest being generated for the encrypted modified designated secure firmware volume, the encrypted modified designated secure firmware volume written to secondary storage outside the ROM image and the reference updated with the new message digest and a changed status for the flag.

16. The system of claim 15 wherein the firmware ROM image is initially stored in at least one of the group of ROM (Read-Only Memory), PROM (Programmable ROM), EPROM (Erasable PROM), EEPROM (Electrically Erasable PROM) and Flash memory.