Multi-user hidden feature enablement in firmware

• US 10,430,206 B1
• Filed: 03/14/2017
• Issued: 10/01/2019
• Est. Priority Date: 03/14/2017
• Status: Active Grant

• Current Assignee: American Megatrends International, LLC
• Original Assignee: American Megatrends International, LLC
• Inventors: Hoffmann, Matthew
• Primary Examiner(s): Choudhury, Zahid
• Application Number:
  US15/458,356
• Time in Patent Office: 931 Days
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 9/4406 Loading of operating system
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files
• CPC Class Codes: G06F 9/4451 User profiles; Roaming
• CPC Class Codes: G06F 9/44526 Plug-ins; Add-ons

Abstract

A firmware can include multiple features for multiple users enabled based on the presence of authenticated variables. When attempting to access functionality of a feature, the firmware will check for the presence of an authenticated variable corresponding to the feature. The authenticated variable for the feature may be installed by a user. The firmware may data to enable a feature that includes an authenticated variable for enabling the feature and an authenticated variable corresponding to an end-user of the firmware. If the firmware has access to the end-user authenticated variable, the feature authenticated variable is installed.

Claims

1. A computer-implemented method comprising:

receiving data to enable a firmware feature that defines a functionality of a firmware, the received data including a feature authenticated variable and an end-user authenticated variable;

storing the feature authenticated variable when the end-user authenticated variable corresponds to a second end-user authenticated variable extant in an authenticated variable data storage;

receiving a request to provide the functionality defined by the firmware feature; and

providing access to the functionality defined by the firmware feature when the feature authenticated variable is present in the authenticated variable data storage.

2. The computer-implemented method of claim 1 further comprising preventing storage of the feature authenticated variable when the end-user authenticated variable is not present in the authenticated variable data storage.

3. The computer-implemented method of claim 1 further comprising preventing access to the functionality when the feature authenticated variable is not present in the authenticated variable data storage.

4. The computer-implemented method of claim 1 wherein the received data further includes a serial number authenticated variable.

5. The computer-implemented method of claim 4 further comprising storing the serial number authenticated variable when the end-user authenticated variable and the serial number authenticated variable are present in the authenticated variable data storage.

6. The computer-implemented method of claim 5 further comprising preventing storage of the feature authenticated variable when the end-user authenticated variable or the serial number authenticated variable is not present in the authenticated variable data storage.

7. The computer-implemented method of claim 1 wherein the authenticated variable data storage is a non-volatile random access memory (“

NVRAM”

).

8. The computer-implemented method of claim 1 wherein the feature authenticated variable and the end-user authenticated variable have been signed jointly, in a single data structure, using a same private key.

9. A non-transitory computer-readable storage medium storing computer-executable instructions that when executed by a computer, cause the computer to perform operations comprising:

receiving data to enable a feature that defines a functionality of a firmware, the received data including a feature authenticated variable and an end-user authenticated variable;

storing the feature authenticated variable when the end-user authenticated variable corresponds to a second end-user authenticated variable extant in a non-volatile random access memory (“

NVRAM”

) of the computer;

receiving a request to provide the functionality defined by the feature; and

providing access to the functionality defined by the feature when the feature authenticated variable is present in the NVRAM of the computer.

10. The non-transitory computer-readable storage medium of claim 9 wherein the operations further comprise preventing storage of the feature authenticated variable when the end-user authenticated variable is not present in the NVRAM.

11. The non-transitory computer-readable storage medium of claim 9 wherein the operations further comprise preventing access to the functionality when the feature authenticated variable is not present in the NVRAM.

12. The non-transitory computer-readable storage medium of claim 9 wherein the received data further includes a serial number authenticated variable.

13. The non-transitory computer-readable storage medium of claim 12 wherein the operations further comprise storing the serial number authenticated variable when the end-user authenticated variable and the serial number authenticated variable are present in the NVRAM.

14. The non-transitory computer-readable storage medium of claim 13 wherein the operations further comprise preventing storage of the feature authenticated variable when the end-user authenticated variable or the serial number authenticated variable is not present in the NVRAM.

15. The non-transitory computer-readable storage medium of claim 9 wherein the feature authenticated variable and the end-user authenticated variable have been signed jointly, in a single data structure, using the private key.

16. A computer-implemented method comprising:

parsing firmware feature enablement data to determine a feature authenticated variable and an end-user authenticated variable;

attempting to retrieve, from a non-volatile random access memory (“

NVRAM”

) of a computer, an end-user value for the end-user authenticated variable;

storing the feature authenticated variable at least in response to retrieving the end-user authenticated variable from the NVRAM;

receiving a request to provide functionality defined by a firmware feature of a firmware, wherein enablement of the firmware feature is dependent upon the feature authenticated variable;

attempting to retrieve, from the NVRAM of the computer, a feature value for the feature authenticated variable; and

providing access to the functionality defined by the firmware feature based at least in part on a successful attempt to retrieve the feature authenticated variable from the NVRAM.

17. The computer-implemented method of claim 16 wherein the firmware feature enablement data further includes a serial number authenticated variable.

18. The computer-implemented method of claim 17 further comprising storing the serial number authenticated variable based at least in part on a successful attempt to retrieve the end-user authenticated variable and the serial number authenticated variable from the NVRAM.

19. The computer-implemented method of claim 18 wherein the feature authenticated variable, the end-user authenticated variable, and the serial number authenticated variable have been signed using a same private key.

20. The computer-implemented method of claim 16 wherein the feature authenticated variable and the end-user authenticated variable have been signed jointly, in a single data structure, using the private key.