OUT OF BAND MANAGEMENT OF BASIC INPUT/OUTPUT SYSTEM SECURE BOOT VARIABLES

• US 20140351571A1
• Filed: 05/23/2013
• Published: 11/27/2014
• Est. Priority Date: 05/23/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Jacobs, William E.
• Granted Patent: US 9,235,710 B2
• Time in Patent Office: Days
• US Class Current: 713/2
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 9/445 Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57

Abstract

A method is provided in one example embodiment and includes storing secure boot variables in a baseboard management controller; and sending the secure boot variables to a basic input/output system (BIOS) during a power on self-test, where the BIOS utilizes the secure boot variables during runtime to authenticate drivers and an operating system loader execution. In particular embodiments, the secure boot variables may be included in a white list, a black list, or a key list and, further, stored in erasable programmable read only memory.

Claims

1. A method, comprising:

storing secure boot variables in a baseboard management controller; and

sending the secure boot variables to a basic input/output system (BIOS) during a power on self-test, wherein the BIOS utilizes the secure boot variables during runtime to authenticate drivers and an operating system loader execution.

2. The method of claim 1, wherein the secure boot variables are included in a white list, a black list, and a key list, and wherein the secure boot variables are stored in non-volatile random access memory.

3. The method of claim 1, wherein the secure boot variables are Unified Extensible Firmware Interface boot variables.

4. The method of claim 1, further comprising:

enabling a management server to modify the secure boot variables.

5. The method of claim 1, wherein the secure boot variables are stored in as a signed blob, which is populated into the baseboard management controller at a provisioning time of a managed server that includes the baseboard management controller.

6. The method of claim 5, wherein the blob is created statically in an off-line secure environment, signed using secure signing services, and passed to the baseboard management controller through an update at the provisioning time.

7. The method of claim 1, further comprising:

receiving, at the baseboard management controller, changes to the secure boot variables made during runtime by the BIOS.

8. The method of claim 1, wherein communication between the baseboard management controller and the BIOS uses system management mode code and private interfaces.

9. One or more non-transitory media that includes instructions for execution and when executed by a processor is operable to perform operations, comprising:

storing secure boot variables in a baseboard management controller; and

sending the secure boot variables to a basic input/output system (BIOS) during a power on self-test, wherein the BIOS utilizes the secure boot variables during runtime to authenticate drivers and an operating system loader execution.

10. The media of claim 9, wherein the secure boot variables are included in a white list, a black list, and a key list, and wherein the secure boot variables are stored in non-volatile random access memory.

11. The media of claim 9, wherein the secure boot variables are Unified Extensible Firmware Interface boot variables.

12. The media of claim 9, further comprising instructions for:

enabling a management server to modify the secure boot variables.

13. The media of claim 9, wherein the secure boot variables are stored as a signed blob, which is populated into the baseboard management controller at a provisioning time of a managed server that includes the baseboard management controller.

14. The media of claim 13, wherein the blob is created statically in an off-line secure environment, signed using secure signing services, and passed to the baseboard management controller through an update at the provisioning time.

15. The media of claim 9, further comprising instructions for:

receiving, at the baseboard management controller, changes to the secure boot variables made during runtime by the BIOS.

16. The media of claim 9, wherein communication between the baseboard management controller and the BIOS uses system management mode code and private interfaces.

17. A network element, comprising:

a memory element for storing instructions; and

a processor coupled to the memory element and operable to execute instructions such that the network element is configured to;

store secure boot variables in a baseboard management controller; and

send the secure boot variables to a basic input/output system (BIOS) during a power on self-test, wherein the BIOS utilizes the secure boot variables during runtime to authenticate drivers and an operating system loader execution.

18. The network element of claim 17, wherein the secure boot variables are Unified Extensible Firmware Interface boot variables stored in the memory element, and wherein the secure boot variables are included in a white list, a black list, and a key list.

19. The network element of claim 17, where the network element is further configured to:

enable a management server to modify the secure boot variables per deployment requirements, wherein a signed blob is created statically in an off-line secure environment using secure signing services and passed, through an update at provisioning time, to a managed server that includes the baseboard management controller.

20. The network element of claim 17, wherein the baseboard management controller is configured to receive changes to the secure boot variables made during runtime by the BIOS.