Secure method for BIOS flash data update
AssigneeInternational Business Machines Corporation
InventorsJoseph Wayne Freeman, Steven Dale Goodman, Randall Scott Springfield
Life of this patent
Estimating the term…
Abstract
The disclosed methods enable users to securably modify BIOS data blocks within an EEPROM to update and/or verify non-executable data without requiring that the entire EEPROM and segments thereof be available for open access.
Claims14
A method for securably updating predetermined segments of non-executable data in an EEPROM having locked segments, comprising the steps of:
- issuing a user's unlock request to modify non-executable data present in one or more predetermined segments to be updated of the EEPROM,
- assessing said user's unlock request by an authorization means,
- wherein if said user's unlock request is authenticated by said authorization means,
- unlocking one or more predetermined segments to be updated, and
- updating non-executable data of said one or more predetermined segments to be updated.
A method to securably program one or more selective segments of non-executable data in an EEPROM having one or more locked segments, comprising the steps of:
- identifying selective segments of an EEPROM to be programmed,
- issuing a program command comprising a data area identifier and a hash value of replacement data,
- verifying said program command with an authentication means,
- generating a first set of hash values for data blocks for each segment, and
- generating a first hash aggregate representative of said first set of hash values,
- unlocking one or more selective segments for programming of non-executable data,
- programming said non-executable data of said one or more selective segments with replacement data, and
- generating a second set of hash values for data blocks for each segment subsequent to the step of programming, and generating a second hash aggregate representative of said second set of hash values,
- verifying said programming step modified only said selected non-executable data of said one or more selective segments by comparing first hash aggregate with second hash aggregate.
A system to notify a user of an existing security violation upon powering on a user's system having an EEPROM, comprising the steps of:
- calculating a hash value for each data object in a segment of the EEPROM upon powering on,
- determining a second hash aggregate representative of all calculated hash values,
- comparing hash aggregate with a first hash aggregate, stored in a storage means, and determined during user's prior update session wherein non-executable data for one or more predetermined segments was modified,
- and in response to said comparing step,
- notifying user of security breach if first hash aggregate value is different than second hash aggregate value.
Dependencies are inferred from the claim text.