Secure authentication of firmware configuration updates

• US 9,734,311 B1
• Filed: 03/17/2015
• Issued: 08/15/2017
• Est. Priority Date: 03/17/2015
• Status: Active Grant

• Current Assignee: American Megatrends International, LLC
• Original Assignee: American Megatrends Incorporated
• Inventors: Santharam, Madhan B., Righi, Stefano
• Primary Examiner(s): Zaidi, Syed
• Application Number:
  US14/660,602
• Time in Patent Office: 882 Days
• Field of Search: 726 17
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]

Abstract

A computing system firmware is provided that includes functionality for securely authenticating a user of the computing system prior to allowing the user, through an application running on an operating system, to invoke firmware functions and to access and modify firmware variables. The authentication may use the same authentication credentials used to access firmware utilities during the computing system'"'"'s power-on self-test (POST) phase. Upon receiving requests to access firmware assets, an authentication service determines whether the access has been authenticated for the user. If so, access to the firmware assets is granted. If access has not been authenticated for the user, the authentication service attempts to authenticate the user by verifying the authentication credentials passed along with the request.

Claims

1. A computer-implemented method for invoking a platform-specific firmware function in a unified extensible firmware interface (UEFI) environment, the method comprising:

receiving a request, by way of a UEFI firmware, to perform a UEFI runtime function to get or set a value for a firmware variable, the firmware variable comprising a variable name and a variable value;

determining that access to firmware assets is authenticated or unauthenticated; and

in response to determining that the access to the firmware assets is unauthenticated, authenticating the access by

verifying that the variable name corresponds to an authentication function,

verifying, by the authentication function, that the variable value matches an authentication value, and

setting, based at least in part on verifying that the variable value matches the authentication value by the authentication function, an access status to the firmware assets as authenticated to enable a subsequent request to execute a subsequent UEFI runtime function.

2. The computer-implemented method of claim 1, further comprising:

in response to determining that the access to the firmware assets is authenticated,

determining that a platform-specific firmware function has been defined that corresponds to the firmware variable, and

performing the platform-specific firmware function in response to determining that the platform-specific firmware function has been defined that corresponds to the firmware variable.

3. The computer-implemented method of claim 1, wherein determining that the access to the firmware assets is authenticated comprises determining that the access status is set to authenticated.

4. The computer-implemented method of claim 1, wherein determining that the access to the firmware assets is authenticated comprises determining that a difference between a current time and a timestamp associated with a time of authentication is smaller than an authentication time limit.

5. The computer-implemented method of claim 1, further comprising:

in response to determining that the access to the firmware assets is authenticated, performing the UEFI runtime function to get or set the value for the firmware variable.

6. The computer-implemented method of claim 1, wherein determining that the access to the firmware assets is authenticated comprises determining that a value of a first session handle received in the request matches a value of a second session handle maintained by an authentication service.

7. The computer-implemented method of claim 1, wherein the variable value contains an authentication value derived from a biometric identifier.

8. A non-transitory computer-readable storage medium having stored thereon computer-executable instructions which, when executed by one or more processors, cause a computer to:

receive a request, to perform a UEFI runtime function to get or set a value for a firmware variable;

determine that access to firmware assets is authenticated or unauthenticated; and

in response to determining that the access to the firmware assets is unauthenticated, authenticating the access by

verifying that the firmware variable corresponds to an authentication function,

verifying, by the authentication function, that the variable value matches an authentication value, and

setting, based at least in part on verifying that the variable value matches the authentication value by the authentication function, an access status to the firmware assets as authenticated to enable a subsequent request to execute a subsequent UEFI runtime function.

9. The non-transitory computer-readable storage medium of claim 8, further comprising:

in response to determining that the access to the firmware assets is authenticated,

determining that a platform-specific firmware function has been defined that corresponds to the firmware variable, and

performing the platform-specific firmware function in response to determining that the platform-specific firmware function has been defined that corresponds to the firmware variable.

10. The non-transitory computer-readable storage medium of claim 8, wherein determining that the access to the firmware assets is authenticated comprises determining that the access status is set to authenticated.

11. The non-transitory computer-readable storage medium of claim 8, wherein determining that the access to the firmware assets is authenticated comprises determining that an authentication time limit has not been reached.

12. The non-transitory computer-readable storage medium of claim 8, further comprising:

in response to determining that the access to the firmware assets is authenticated, performing the UEFI runtime function to get or set the value for the firmware variable.

13. The non-transitory computer-readable storage medium of claim 8, wherein the value for the firmware variable contains an authentication value comprising password.

14. The non-transitory computer-readable storage medium of claim 8, wherein the value for the firmware variable comprises an authentication value derived from a biometric identifier.

15. An apparatus comprising:

a central processing unit (CPU); and

a non-volatile memory connected to the CPU and storing a unified extensible firmware interface (UEFI) firmware executable by the CPU, the UEFI firmware configured to, when executed,

receive a request to get or set a value for a firmware variable,

determine that access to firmware assets is authenticated or unauthenticated, and

in response to determining that the access to the firmware assets is unauthenticated, authenticate the access by

verifying that the firmware variable corresponds to an authentication function,

verifying, by the authentication function, that the variable value matches an authentication value, and

setting, based at least in part on verifying that the variable value matches the authentication value by the authentication function, an access status to the firmware assets as authenticated to enable a subsequent request to execute a subsequent UEFI runtime function.

16. The apparatus of claim 15, further comprising:

in response to determining that the access to the firmware assets is authenticated,

determining that a platform-specific firmware function has been defined that corresponds to the firmware variable, and

performing the platform-specific firmware function in response to determining that the platform-specific firmware function has been defined that corresponds to the firmware variable.

17. The apparatus of claim 15, wherein determining that the access to the firmware assets is authenticated comprises determining that the access status is set to authenticated.

18. The apparatus of claim 15, wherein determining that the access to the firmware assets is authenticated comprises determining a difference between a current time and a timestamp set upon authentication and determining that the difference is smaller than an authentication time limit.

19. The apparatus of claim 15, further comprising:

in response to determining that the access to the firmware assets is authenticated, performing a UEFI runtime function to get or set the value for the firmware variable.

20. The apparatus of claim 15, wherein the value for the firmware variable contains an authentication value comprising password.