Patent Application
20220350717
The present disclosure relates to secure storage information handling system
As the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option available to users is information handling systems. An information handling system generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes thereby allowing users to take advantage of the value of the information. Because technology and information handling needs and requirements vary between different users or applications, information handling systems may also vary regarding what information is handled, how the information is handled, how much information is processed, stored, or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in information handling systems allow for information handling systems to be general or configured for a specific user or specific use such as financial transaction processing, airline reservations, enterprise data storage, or global communications. In addition, information handling systems may include a variety of hardware and software components that may be configured to process, store, and communicate information and may include one or more computer systems, data storage systems, and networking systems.
When an information handling system is reset, the system typically executes firmware that performs a boot process to initialize various system components and interfaces, load an operating system, and perform various other actions to configure the system into a known and initial state. Historically, basic input/output system (BIOS) was the de facto standard for boot process firmware. More recently, firmware compliant with the unified extensible firmware interface (UEFI) specification has evolved to address various limitations inherent in BIOS.
A UEFI-compliant boot process may define a boot manager that checks the boot configuration and, based on its settings, executes the specified OS boot loader. However, if a system is unable to boot to the operating system after repeated attempts and a pre-boot system performance check detects no hardware issues, it may be desirable to provide an alternative method for recovering the operating system.
In accordance with teachings disclosed herein, common problems associated with non-secure loading of diagnostic operating systems, are addressed methods and systems disclosed herein including method and systems employing chained loading of the diagnostic OS.
In accordance with disclosed subject matter, a method of establishing a diagnostic OS for an information handling system platform includes performing a UEFI BIOS boot, including one or more standard UEFI BIOS modules, to place the platform in a pre-OS state and, responsive to detecting either a particular platform configuration policy or a particular power on self test (POST) error, launching an embedded OS kernel into a DRTM-authenticated measured launch environment (MLE). Based on the particular platform configuration policy, additional objects for the diagnostic OS may be downloaded. The additional objects may include an initial ramdisk (initrd) module and one or more applications specific to the particular diagnostic OS.
The method further includes launching the diagnostic OS, wherein said launching includes, for each diagnostic OS-specific application, launching the application and extending a measurement of the application into the at least one dynamic root of trust measurement (DRTM) PCR of the TPM. The additional objects may further include an initial ramdisk (initrd) module, wherein launching the diagnostic OS includes launching the initrd module and extending a measurement of the initrd module into at least one DRTM PCR.
The UEFI BIOS boot may be a measured boot in which a measurement of each UEFI BIOS module is extended into the TPM and, in at least some embodiments, one or more static root of trust measurement (SRTM) platform control registers (PCRs) of the TPM. In measured boot embodiments, the first module to execute may be a CRTM module wherein the measurement of the CRTM module establishes a CRTM value against which the other modules can be validated. In at least one embodiment, a measurement of embedded OS kernel is extended into the TPM and the embedded OS kernel validates the measured boot sequence.
Technical advantages of the present disclosure may be readily apparent to one skilled in the art from the figures, description and claims included herein. The objects and advantages of the embodiments will be realized and achieved at least by the elements, features, and combinations particularly pointed out in the claims.
It is to be understood that both the foregoing general description and the following detailed description are examples and explanatory and are not restrictive of the claims set forth in this disclosure.
A more complete understanding of the present embodiments and advantages thereof may be acquired by referring to the following description taken in conjunction with the accompanying drawings, in which like reference numbers indicate like features, and wherein:
Exemplary embodiments and their advantages are best understood by reference to
In the following description, details are set forth by way of example to facilitate discussion of the disclosed subject matter. It should be apparent to a person of ordinary skill in the field, however, that the disclosed embodiments are exemplary and not exhaustive of all possible embodiments.
Throughout this disclosure, a hyphenated form of a reference numeral refers to a specific instance of an element and the un-hyphenated form of the reference numeral refers to the element generically. Thus, for example, “device 12-1” refers to an instance of a device class, which may be referred to collectively as “devices 12” and any one of which may be referred to generically as “a device 12”.
Referring now to the drawings,
System memory 120 is coupled to CPU 110 and generally configured to store program instructions (or computer program code), which are executable by CPU 110. System memory 120 may be implemented using any suitable memory technology, including but not limited to, dynamic random access memory or any other suitable type of memory. Graphics processor unit (GPU) 130 is coupled to CPU 110 and configured to coordinate communication between the host processor and one or more display components of the IHS. In the embodiment shown in
Platform controller hub (PCH) 150 is coupled to CPU 110 and configured to handle I/O operations for the IHS. As such, PCH 150 may include a variety of communication interfaces and ports for communicating with various system components, input/output (I/O) devices, expansion bus(es), and so forth. The PCH 150 illustrated in
PCH 150 is further coupled to an NVMe storage resource 160. NVMe storage resource 160 may include a NAND flash solid state drive (SSD) configured with a PCIe interface for coupling to a PCIe bus. The NVMe 160 illustrated in
Storage device 170 may be any type of persistent, non-transitory computer readable storage device, including non-PCIe storage devices, such as one or more hard disk drives (HDDs) or solid-state drives (SSDs), and may be generally configured to store software and/or data. For example, computer readable storage device 170 may be configured to store an operating system (OS) 171 for the IHS, in addition to other software and/or firmware modules and user data. As known in the art, OS 171 may contain program instructions (or computer program code), which may be executed by CPU 110 to perform various tasks and functions for the information handling system and/or for the user.
NIC 180 enables IHS 100 to communicate with one or more remotely located systems and/or services 184 via an external network 182 using one or more communication protocols. Network 182 may be a local area network (LAN), wide area network (WAN), personal area network (PAN), or the like, and the connection to and/or between IHS 100 and network 182 may be wired, wireless or a combination thereof. For purposes of this discussion, network 182 is indicated as a single collective component for simplicity. However, it is appreciated that network 182 may comprise one or more direct connections to other remote systems and/or services, as well as a more complex set of interconnections as can exist within a wide area network, such as the Internet. NIC 180 may communicate data and signals to/from IHS 100 using any known communication protocol.
Embedded controller (EC) 190 is generally configured to boot the information handling system and perform other functions. EC 190 may generally include read only memory (ROM), random access memory (RAM) and a processing device (e.g., a controller, microcontroller, microprocessor, ASIC, etc.) for executing program instructions stored within its internal ROM and RAM. For example, EC 190 may be configured to execute program instructions (e.g., a boot block) stored within its internal ROM to initiate a boot process for the information handling system.
Turning now to
It will be appreciated by those of ordinary skill in the field of information handling system security that neither the embedded OS kernel 225, nor any of the diagnostic modules 230 were measured into TPM 210 or otherwise authenticated, thereby resulting in confidentiality and integrity concerns. As an example,
Referring now to
As illustrated in
As illustrated in
Based on the Post errors or Platform configuration policy done, embedded OS kernel 325 is launched, from a protected NVMe disk, to load embedded OS kernel 325. Based on one or more platform configuration policies, a network stack (not depicted) of embedded OS kernel 325 downloads Initird diagnostic OS modules and one or more advanced OS Specific apps.
Each of these Modules are authenticated (355) and launched into the measured launch environment (MLE) 350.
The protection provided by the MLE 350 extends beyond pre-launch integrity verification. MLE 350 also prevents code from outside the MLE from viewing, erasing, changing the runtime memory or flow of execution of the diagnostics code inside the MLE. Without MLE 350, other malware running in other applications or software, e.g., enterprise OS 340, could interrupt the diagnostic OS module and make modifications to memory that could affect diagnostic results, steal diagnostic OS module secrets, or alter the diagnostic OS to alter the diagnostic OS module behavior in a way that potentially compromises the security of the diagnostic OS module or the network connection.
In this manner, the illustrated chained loading of Advanced OS Application modules are validated based on platform configuration policy using Static CRTM (SCRTM) and Chained applications are measured using DRTM. The chained loading methods 300 also implements chained loading of dynamic applications (e.g., initrd) over a network and validated using the embedded OS authenticated with SCRTM.
This disclosure encompasses all changes, substitutions, variations, alterations, and modifications to the example embodiments herein that a person having ordinary skill in the art would comprehend. Similarly, where appropriate, the appended claims encompass all changes, substitutions, variations, alterations, and modifications to the example embodiments herein that a person having ordinary skill in the art would comprehend. Moreover, reference in the appended claims to an apparatus or system or a component of an apparatus or system being adapted to, arranged to, capable of, configured to, enabled to, operable to, or operative to perform a particular function encompasses that apparatus, system, or component, whether or not it or that particular function is activated, turned on, or unlocked, as long as that apparatus, system, or component is so adapted, arranged, capable, configured, enabled, operable, or operative.
All examples and conditional language recited herein are intended for pedagogical objects to aid the reader in understanding the disclosure and the concepts contributed by the inventor to furthering the art, and are construed as being without limitation to such specifically recited examples and conditions. Although embodiments of the present disclosure have been described in detail, it should be understood that various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the disclosure.
Defined terms. For the purposes of this disclosure, unless expressly indicated otherwise an information handling system may include any instrumentality or aggregate of instrumentalities operable to compute, classify, process, transmit, receive, retrieve, originate, switch, store, display, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, entertainment, or other purposes. For example, an information handling system may be a personal computer, a personal digital assistant (PDA), a consumer electronic device, a network storage device, or any other suitable device and may vary in size, shape, performance, functionality, and price. The information handling system may include memory, one or more processing resources such as a central processing unit (“CPU”), microcontroller, or hardware or software control logic. Additional components of the information handling system may include one or more storage devices, one or more communications ports for communicating with external devices as well as various input/output (“I/O”) devices, such as a keyboard, a mouse, and a video display. The information handling system may also include one or more buses operable to transmit communication between the various hardware components.
Additionally, an information handling system may include firmware for controlling and/or communicating with, for example, hard drives, network circuitry, memory devices, I/O devices, and other peripheral devices. For example, the hypervisor and/or other components may comprise firmware. As used in this disclosure, firmware includes software embedded in an information handling system component used to perform predefined tasks. Firmware is commonly stored in non-volatile memory, or memory that does not lose stored data upon the loss of power. In certain embodiments, firmware associated with an information handling system component is stored in non-volatile memory that is accessible to one or more information handling system components. In the same or alternative embodiments, firmware associated with an information handling system component is stored in non-volatile memory that is dedicated to and comprises part of that component.
For the purposes of this disclosure, computer-readable media may include any instrumentality or aggregation of instrumentalities that may retain data and/or instructions for a period of time. Computer-readable media may include, without limitation, storage media such as a direct access storage device (e.g., a hard disk drive or floppy disk), a sequential access storage device (e.g., a tape disk drive), compact disk, CD-ROM, DVD, random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and/or flash memory; as well as communications media such as wires, optical fibers, microwaves, radio waves, and other electromagnetic and/or optical carriers; and/or any combination of the foregoing.
For the purposes of this disclosure, information handling resources may broadly refer to any component system, device or apparatus of an information handling system, including without limitation processors, service processors, basic input/output systems (BIOSs), buses, memories, I/O devices and/or interfaces, storage resources, network interfaces, motherboards, and/or any other components and/or elements of an information handling system.
For the purposes of this disclosure, when two or more elements are referred to as “coupled” to one another, such term indicates that such two or more elements are in electronic communication, mechanical communication, including thermal and fluidic communication, as applicable, whether connected indirectly or directly, with or without intervening elements.
