# US 12,001,562 B2 · Identification of devices in UEFI secure boot databases > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,562 B2 - Document ID: US12001562B2 - Status: Granted - Kind: B2 - Application number: 17/869,840 - Filed: 2022-07-21 - Published: 2024-01-25 - Granted: 2024-06-04 - Earliest claimed: 2022-07-21 - Assignees: Dell Products L.P. - Applicants: Dell Products L.P. - Inventors: William C. Munger; Marshal F. Savage - Web page: https://patentgrep.com/patent/US12001562B2 ## CPC - G06F 21/575: {Secure boot} - G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An information handling system includes a memory and a basic input/output system (BIOS). The memory stores a lookup table to associate each of a plurality of device firmware hashes with a corresponding one of a plurality of device identification strings. The BIOS calculates the each of the device firmware hashes. Each device firmware hash is associated with a different device firmware. The BIOS creates the lookup table based on the calculated device firmware hashes and the device identification strings. Based on the lookup table, the BIOS displays a secure boot allowed devices database list on a display device. ## Claims ### Claim 1 An information handling system comprising: a memory to store a lookup table to associate each of a plurality of device firmware hashes with a corresponding one of a plurality of device identification strings; and a basic input/output system (BIOS), during a first boot of the information handling system, the BIOS to: calculate each of the device firmware hashes, wherein each device firmware hash is associated with a different device firmware; create the lookup table based on the calculated device firmware hashes and the device identification strings; and based on the lookup table, display a secure boot allowed devices database list on a display device, wherein the secure boot allowed devices database list includes both a first device firmware hash and a first device identification string for a first device. ### Claim 2 (depends on 1) The information handling system of claim 1, further comprising a baseboard management controller to receive the lookup table from the BIOS, wherein the baseboard management controller to provide the first device firmware hash and the first device identification string for a first device. ### Claim 3 (depends on 1) The information handling system of claim 1, wherein the memory is a pre-boot volatile memory. ### Claim 4 (depends on 3) The information handling system of claim 3, wherein the lookup table is erased from the memory during a shutdown of the information handling system. ### Claim 5 (depends on 4) The information handling system of claim 4, wherein during a subsequent system boot, the BIOS to: re-calculate the each of the device firmware hashes, wherein each device firmware hash is associated with a different device firmware currently installed within the information handling system; create the lookup table based on the calculated each of the device firmware hashes and the device identification strings; and based on the lookup table, display a current secure boot allowed devices database list on the display device, wherein the current secure boot allowed devices database list includes both a second device firmware hash and a second device identification string for the first device. ### Claim 6 (depends on 5) The information handling system of claim 5, wherein the second device was installed in the information handling system after the first boot of the information handling system. ### Claim 7 (depends on 1) The information handling system of claim 1, wherein the memory is a non-volatile memory. ### Claim 8 (depends on 7) The information handling system of claim 7, wherein during a subsequent system boot, the BIOS to: re-calculate each of the device firmware hashes, wherein each device firmware hash is associated with a different device firmware currently installed within the information handling system; compare each of the re-calculated device firmware hashes to the device firmware hashes in the lookup table; remove device firmware hashes in the lookup table that do not match one of the re-calculated device firmware hashes; and add one or more of the re-calculate device firmware hashes to the lookup table that do not match one of the device firmware hashes currently in the lookup table. ### Claim 9 A method comprising: calculating, by a basic input/output system (BIOS) of an information handling system, device firmware hashes, wherein each device firmware hash is associated with a different device firmware; creating, by the BIOS, a lookup table based on the device firmware hashes and the device identification strings; storing the lookup table in a memory; and based on the lookup table, displaying a secure boot allowed devices database list on a display device, wherein the secure boot allowed devices database list includes both a first device firmware hash and a first device identification string for a first device. ### Claim 10 (depends on 9) The method of claim 9, further comprising providing, by the BIOS, the lookup table to a baseboard management device of the information handling system. ### Claim 11 (depends on 9) The method of claim 9, wherein the memory is a pre-boot volatile memory. ### Claim 12 (depends on 11) The method of claim 11, wherein the lookup table is erased from the memory during a shutdown of the information handling system. ### Claim 13 (depends on 12) The method of claim 12, wherein during a subsequent system boot, the method further comprising: re-calculating, by the BIOS, the each of the device firmware hashes, wherein each device firmware hash is associated with a different device firmware currently installed within the information handling system; creating the lookup table based on the calculated each of the device firmware hashes and the device identification strings; and based on the lookup table, displaying a current secure boot allowed devices database list on the display device, wherein the current secure boot allowed devices database list includes both a second device firmware hash and a second device identification string for the first device. ### Claim 14 (depends on 13) The method of claim 13, wherein the second device was installed in the information handling system after the first boot of the information handling system. ### Claim 15 (depends on 9) The method of claim 9, wherein the memory is a non-volatile memory. ### Claim 16 (depends on 15) The method of claim 15, wherein during a subsequent system boot, the method further comprising: re-calculating the each of the device firmware hashes, wherein each device firmware hash is associated with a different device firmware currently installed within the information handling system; comparing each of the re-calculate device firmware hashes to the device firmware hashes in the lookup table; removing device firmware hashes in the lookup table that do not match one of the re-calculated device firmware hashes; and adding one or more of the re-calculate device firmware hashes to the lookup table that do not match one of the device firmware hashes currently in the lookup table. ### Claim 17 An information handling system comprising: a memory to store a lookup table to associate each of a plurality of device firmware hashes with a corresponding one of a plurality of device identification strings; and a basic input/output system (BIOS), during a first boot of the information handling system, the BIOS to: calculate each of the device firmware hashes, wherein each device firmware hash is associated with a different device firmware; create the lookup table based on the device firmware hashes and the device identification strings; based on the lookup table, display a secure boot allowed devices database list on a display device, wherein the secure boot allowed devices database list includes both a first device firmware hash and a first device identification string for a first device; and based on the lookup table, display a secure boot deny devices database list on the display device, wherein the secure boot deny devices database list includes both a second device firmware hash and a second device identification string for a second device. ### Claim 18 (depends on 17) The information handling system of claim 17, wherein the memory is a pre-boot volatile memory. ### Claim 19 (depends on 18) The information handling system of claim 18, wherein the lookup table is erased from the memory during a shutdown of the information handling system. ### Claim 20 (depends on 19) The information handling system of claim 19, wherein during a subsequent system boot, the BIOS to: re-calculate the each of the device firmware hashes, wherein each device firmware hash is associated with a different device firmware currently installed within the information handling system; create the lookup table based on the calculated each of the device firmware hashes and the device identification strings; and based on the lookup table, display a current secure boot allowed devices database list on the display device, wherein the current secure boot allowed devices database list includes both a second device firmware hash and a second device identification string for the first device.