DETECTING A CHANGE TO SYSTEM MANAGEMENT MODE BIOS CODE

• US 20190332510A1
• Filed: 07/05/2019
• Published: 10/31/2019
• Est. Priority Date: 01/27/2017
• Status: Active Grant

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Jeansonne, Jeffrey Kevin, Balacheff, Boris, Ali, Valiuddin, Dalton, Chris I., Plaquin, David
• Granted Patent: US 11,256,589 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 11/302 where the computing system component is a software system
• CPC Class Codes: G06F 11/3419 by assessing time
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 2201/88 Monitoring involving counting

Abstract

Examples herein disclose monitoring an expected functionality upon execution of a system management mode (SMM) code. The examples detect whether a change has occurred to the SMM code based on the monitoring of the expected functionality. The change indicates that the SMM code is compromised.

Claims

1. A system comprising:

a processor to execute a system management mode (SMM) code;

instructions to;

monitor an expected functionality of the SMM code upon the execution of the SMM BIOS code; and

detect whether a change has occurred to the SMM code based on the monitoring of the expected functionality of the SMM code, the change indicating that the SMM code is compromised.

2. The system of claim 1 comprising:

a memory associated with the processor to maintain the SMM code for execution by the processor.

3. The system of claim 1 wherein the processor is to execute the SMM code during runtime of an operating system.

4. The system of claim 1 wherein:

the processor is to complete execution of boot strap information of the code prior to execution of the SMM code.

5. The system of claim 1 wherein the expected functionality is a particular behavior which is expected upon the execution of the SMM code and wherein the detection of the change to the SMM code, the instructions are to:

detect a deviation in the expected functionality of the SMM code, the deviation in the expected functionality indicates the change in the SMM code.

6. A method comprising:

monitoring, via instructions, an expected functionality upon execution of system management mode (SMM) firmware code; and

detecting, via instructions, whether a change has occurred to the SMM firmware code based on the monitoring of the expected functionality, the detection of the change occurs prior to completion of execution of the SMM firmware code, the change indicating that the SMM BIOS code is compromised.

7. The method of claim 6 comprising:

completing execution of boot strap information o the firmware code prior to monitoring the SMM code during execution.

8. The method of claim 6 wherein the expected functionality is a particular behavior which is expected upon the execution of the SMM firmware code and wherein detecting whether a change has occurred to the SMM firmware code based on the monitoring of the expected functionality comprises:

detecting, a deviation in the expected functionality of the SMM firmware code, the deviation in the expected functionality indicates the change in the SMM firmware code.

9. The method of claim 6 wherein the monitoring the expected functionality upon execution of the SMM firmware code includes monitoring at least one of monitoring a setting of a register;

tracking a number of times in which the processor executes the SMM firmware code;

tracking an amount of time the processor executes the SMM firmware code; and

tracking a number of I/O cycles generated by the SMM firmware code.

10. The method of claim 6 comprising:

transmitting an alert of the change in the SMM firmware code, the change indicates the SMM firmware code has been compromised.

11. A non-transitory computer-readable storage medium comprising instructions that when executed cause a computing device to:

monitor an expected functionality upon execution of a system management mode (SMM) code;

detect whether a change has occurred to the SMM code based on the monitoring of the expected functionality, the change indicating that the SMM code is compromised.

12. The non-transitory computer-readable storage medium including the instructions of claim 11 wherein the detection of whether the change has occurred to the SMM code based on, the monitoring of the expected functionality is including instructions that when executed by the controller cause the computing device to:

detect a deviation in the expected functionality of the SMM code, the deviation in the expected functionality indicates the change in the SMM code.

13. The non-transitory computer-readable storage medium including the instructions of claim 11 wherein the expected functionality is a particular behavior resulting from execution of the SMM code which becomes observable by instructions.

14. The non-transitory computer-readable storage medium including the instructions of claim 11 wherein to detect whether the change has occurred to the SMM code based on the monitoring of the expected functionality is including instructions that when executed by the controller cause the computing device to:

detect the change prior to completion of execution of the SMM code.

15. The non-transitory computer-readable storage medium including the instructions of claim 11 and including instructions that when executed cause the computing device to:

transmit an alert of the change indicating the SMM code has been compromised based upon the detection of the change to the SMM code.