Prevention of execution of unauthorized firmware from UEFI firmware volumes
AssigneeDell Products L.P.
InventorsBalasingh Samuel, Walter Phillips, Richard Tonry
Life of this patent
Estimating the term…
Abstract
Unauthorized code may be stored as data in a data volume of a firmware volume. To prevent or block execution of the unauthorized code, the firmware file system (FFS) file that includes the unauthorized code may be tagged, marked or deleted according to a system bios policy. These corrupted FFS files are thus blocked from execution during initialization or a boot process of a basic input/output system (BIOS) firmware as they are not published or enumerated to an execution list of the BIOS firmware.
Claims20
A method for firmware volume mapping by a basic input/output system (BIOS) firmware of an information handling system to block execution of one or more unauthorized files during initialization of the information handling system, comprising:
- receiving, by the BIOS firmware, an indicator to a firmware volume associated with the BIOS firmware;
- determining by the BIOS firmware, whether the firmware volume is a data volume based, at least in part, on whether the firmware volume comprises data;
- requesting by the BIOS firmware, one or more files within the data volume;
- determining by the BIOS firmware, if the requested one or more files comprise an associated entry point, wherein the entry point is indicative of executable code;
- tagging, by the BIOS firmware each of the requested one or more files determined to comprise the associated entry point as the one or more unauthorized files;
- and
- blocking, by the BIOS firmware, execution of each of the one or more unauthorized files during the initialization of the information handling system.
An information handling system, comprising:
- a memory;
- a processor coupled to the memory, wherein the processor has access to a firmware basic input/output system (BIOS) to block execution of one or more unauthorized files during initialization of the information handling system, wherein the firmware BIOS includes one or more instructions stored in the memory and executable by the processor to:
- receive an indicator to a firmware volume associated with the firmware BIOS;
- determine whether the firmware volume is a data volume based, at least in part, on whether the firmware volume comprises data;
- request one or more files within the data volume;
- determine if the requested one or more files comprise an associated entry point;
- tag as the one or unauthorized files each of the requested one or more files determined to comprise the associated entry point, wherein the entry point is indicative of executable code;
- and
- block execution of each of the one or more unauthorized files during the initialization of the information handling system by the firmware BIOS.
A non-transitory computer-readable medium storing one or more instructions, the one or more instructions representing a basic input/output system (BIOS) of a BIOS firmware, that, when executed by a processor of an information handling system to block execution of one or more unauthorized files during initialization of the information handling system, cause the processor to:
- receive an indicator to a firmware volume associated with the BIOS firmware;
- determine whether the firmware volume is a data volume based, at least in part, on whether the firmware volume comprises data;
- request one or more files within the data volume;
- determine if the requested one or more files comprise an associated entry point, wherein the entry point is indicative of executable code;
- tag as blocked for execution each of the requested one or more files determined to comprise the associated entry point as the one or more unauthorized files;
- and
- block execution of each of the one or more unauthorized files during the initialization of the information handling system by the BIOS firmware.
Dependencies are inferred from the claim text.