Method and apparatus for deploying managed code in a pre-boot environment

• US 20040128494A1
• Filed: 12/27/2002
• Published: 07/01/2004
• Est. Priority Date: 12/27/2002
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Zimmer, Vincent J., Rothman, Michael A.
• Application Number:
  US10/330,596
• Publication Number:
  US 20040128494A1
• Time in Patent Office: Days
• US Class Current: 713/2
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

A method and apparatus for deploying managed code in a pre-boot environment is presented. In this regard, a managed BIOS is introduced to be executed in response to receipt of an indication associated with an initialization event, to establish a memory mapping, and to establish one or more containers within mapped memory within which one or more option ROM'"'"'s (Read Only Memory) are executed, wherein option ROM operation is monitored to ensure the option ROM does not access a memory location not assigned to the option ROM by the managed BIOS.

Claims

1. A method of booting an electronic appliance, the method comprising:

executing a BIOS (Basic Input/Output System) in response to receipt of an indication associated with an initialization event;

establishing a memory mapping; and

establishing one or more containers within mapped memory by the BIOS within which one or more option ROM'"'"'s (Read Only Memory) are executed, wherein option ROM operation is monitored to ensure the option ROM does not access a memory location not assigned to the option ROM by the BIOS.

2. The method of claim 1, further comprising logging unauthorized memory accesses for use in a subsequent boot.

3. The method of claim 2, further comprising disabling, during the subsequent boot, the option ROM that performed the unauthorized memory access.

4. The method of claim 2, further comprising terminating booting as a result of the unauthorized memory access.

5. The method of claim 2, further comprising handing control over to an operating system loader.

6. An electronic appliance, comprising:

a system memory to store one or more of a BIOS (Basic Input/Output System) and option ROM'"'"'s (Read Only Memory); and

control logic, coupled with the system memory, to selectively execute the BIOS and option ROM'"'"'s, the BIOS to map the system memory and establish one or more containers within which the option ROM'"'"'s are executed.

7. The electronic appliance of claim 6, wherein the containers to monitor option ROM operation to detect an access to a memory location not assigned to the option ROM.

8. The electronic appliance of claim 7, wherein the BIOS to establish a log of the option ROM(s) that performed unauthorized access (es) of memory.

9. The electronic appliance of claim 8, wherein the BIOS to disable, on a subsequent boot, the logged option ROM(s).

10. The electronic appliance of claim 6, wherein the BIOS is compliant with the Extensible Firmware Interface (EFI) standard.

11. A storage medium comprising content which, when executed by an accessing machine, invokes an instance of management services in the accessing machine, the management services, independent of a functional operating system executing on the accessing machine, to establish a memory map of the accessing machine, to establish containers of memory within which content to boot the accessing machine is authorized to access, and to detect access to memory outside the container(s).

12. The storage medium of claim 11, further comprising content which, when executed by the accessing machine, causes the accessing machine to create a log of the content that performs accesses to memory outside the container(s).

13. The storage medium of claim 12, further comprising content which, when executed by the accessing machine, causes the accessing machine to disable the logged content.

14. The storage medium of claim 13, wherein the content is automatically accessed by the accessing machine after a power-on event.

15. The storage medium of claim 11, further comprising content which, when executed by the accessing machine, causes the accessing machine to load an operating system.