METHODS AND APPARATUS TO SUPPORT AUTHENTICATED VARIABLES

• US 20140189336A1
• Filed: 12/28/2012
• Published: 07/03/2014
• Est. Priority Date: 12/28/2012
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Zimmer, Vincent, Ballesteros, Miguel
• Application Number:
  US13/729,307
• Publication Number:
  US 20140189336A1
• Time in Patent Office: Days
• US Class Current: 713/2
• CPC Class Codes: G06F 21/575 Secure boot

Abstract

Methods and apparatus to support authenticated variables are disclosed. An example method includes, in response to an update request directed to an authenticated variable of a computing platform and received during a second stage of a first instance of a booting process, the booting process including a first stage and the second stage, restricting the update request from accessing the authenticated variable during the second stage of the first instance of the booting process and storing the update request in a queue.

Claims

1. A method, comprising:

in response to an update request directed to an authenticated variable of a computing platform and received during a second stage of a first instance of a booting process, the booting process including a first stage and the second stage;

restricting the update request from accessing the authenticated variable during the second stage of the first instance of the booting process; and

storing the update request in a queue.

2. A method as defined in claim 1, further comprising, in response to the computing platform entering a second instance of the booting process:

verifying an authenticity of the update request of the queue during the first stage of the second instance of the booting process; and

when the update request is authentic, executing the update request during the first stage of the second instance of the booting cycle.

3. A method as defined in claim 2, further comprising rejecting the update request during the first stage of the second instance of the booting process when the update request is not authentic.

4. A method as defined in claim 2, wherein the first instance of the booting process is prior to the second instance of the booting process.

5. A method as defined in claim 2, wherein the first stage of the booting process cycle is isolated from an operating system of the computing platform.

6. A method as defined in claim 1, further comprising:

in response to a second update request directed to the authenticated variable and received during runtime of the computing platform;

restricting the second update request from accessing the authenticated variable during the runtime; and

storing the second update request in the queue.

7. A method as defined in claim 6, further comprising, in response to the computing platform entering a second instance of the booting process:

verifying an authenticity of the second update request of the queue during the first stage of the second instance of the booting process; and

when the second update request is authentic, executing the second update request during the first stage of the second instance of the booting cycle.

8. A method as defined in claim 1, wherein the first stage of the booting process and the second stage of the booting process are divided by issuance of a command associated with an exit from a privileged mode of a pre-boot environment.

9. A method as defined in claim 1, wherein the authenticated variable is a Unified Extensible Firmware Interface (UEFI) authenticated variable.

10. A tangible machine readable storage medium comprising instructions that, when executed, cause a machine to at least:

in response to an update request directed to an authenticated variable of a computing platform and received during a second stage of a first instance of a booting process, the booting process including a first stage and the second stage;

restrict the update request from accessing the authenticated variable during the second stage of the first instance of the booting process; and

store the update request in a queue.

11. A tangible machine readable storage medium as defined in claim 10, wherein the instructions cause the machine to, in response to the computing platform entering a second instance of the booting process:

verify an authenticity of the update request of the queue during the first stage of the second instance of the booting process; and

when the update request is authentic, execute the update request during the first stage of the second instance of the booting cycle.

12. A tangible machine readable storage medium as defined in claim 11, wherein the instructions cause the machine to reject the update request during the first stage of the second instance of the booting process when the update request is not authentic.

13. A tangible machine readable storage medium as defined in claim 11, wherein the first instance of the booting process is prior to the second instance of the booting process.

14. A tangible machine readable storage medium as defined in claim 11, wherein the first stage of the booting process cycle is isolated from an operating system of the computing platform.

15. A tangible machine readable storage medium as defined in claim 10, wherein the instructions cause the machine to:

in response to a second update request directed to the authenticated variable and received during runtime of the computing platform;

restrict the second update request from accessing the authenticated variable during the runtime; and

store the second update request in the queue.

16. A tangible machine readable storage medium as defined in claim 15, wherein the instructions cause the machine to, in response to the computing platform entering a second instance of the booting process:

verify an authenticity of the second update request of the queue during the first stage of the second instance of the booting process; and

when the second update request is authentic, execute the second update request during the first stage of the second instance of the booting cycle.

17. An apparatus, comprising:

a controller to restrict processing of an update request directed to an authenticated variable of a computing platform received during a second stage of a first booting process, the first booting process including a first stage and the second stage;

a queue to store the update request received during the second stage of the first booting process; and

an updater to process the update request during the first stage of a second booting process.

18. An apparatus as defined in claim 17, wherein the controller is implemented via firmware, and the queue is implemented via flash memory.

19. An apparatus as defined in claim 17, wherein the first booting process is prior to the second booting process.

20. An apparatus as defined in claim 17, wherein the first stage and the second stage are divided by issuance of a command associated with an exit from a privileged mode of a pre-boot environment.

21. (canceled)