Systems and methods for binding secondary operating system to platform basic input/output system

An information handling system may include a processor, non-transitory computer readable media communicatively coupled to the processor and having stored thereon a primary operating system of the information handling system and a secondary operating system of the information handling system, and a basic input/output system communicatively coupled to the processor and having provisioned thereon a signed signature of the secondary operating system signed with a private key of a public-private key pair and a public key of the public-private key pair. The basic input/output system is configured to, responsive to a determination to boot to the secondary operating system in lieu of booting to the primary operating system of the information handling system verify the secondary operating system using the signed signature of the secondary operating system and the public key and responsive to verifying the secondary operating system, allow the information handling system to boot to the secondary operating system.

TECHNICAL FIELD

The present disclosure relates in general to information handling systems, and more specifically to binding a secondary operating system of an information handling system to a platform basic input/output system of the information handling system.

BACKGROUND

In some instances, an information handling system may be configured to boot to a secondary operating system (e.g., a service operating system, recovery operating system, or rescue operating system) when it is unable to boot to a primary host operating system of the information handling system. The secondary operating system may either be installed in a hidden partition of an internal storage resource (e.g., hard drive) of the information handling system or in an external storage resource (e.g., a Universal Serial Bus drive) that may be coupled to the information handling system. Such secondary operation system may be configured to perform one or more repair/recovery tasks, including executing diagnostics, repairing a system registry, or reinstalling the primary operating system from a factory image or other source image.

The existence of the secondary operating system may expose an undesirable security vulnerability. For example, a malicious actor may tamper with the secondary operating system such that user data stored on the information handling system may be extracted using tampered code of the secondary operating system. Thus, while user data may be protected by the primary operating system (e.g., by using Windows privileges in the Microsoft Windows operating system), a malicious actor may add malicious code to the secondary operating system code that may serve as a backdoor interface to access user data. Thus, it may be desirable to detect for such malicious code before it executes.

SUMMARY

In accordance with the teachings of the present disclosure, the disadvantages and problems associated with security vulnerabilities of a secondary operating system may be reduced or eliminated.

In accordance with embodiments of the present disclosure, an information handling system may include a processor, non-transitory computer readable media communicatively coupled to the processor and having stored thereon a primary operating system of the information handling system and a secondary operating system of the information handling system, and a basic input/output system communicatively coupled to the processor and having provisioned thereon a signed signature of the secondary operating system signed with a private key of a public-private key pair and a public key of the public-private key pair. The basic input/output system is configured to, responsive to a determination to boot to the secondary operating system in lieu of booting to the primary operating system of the information handling system verify the secondary operating system using the signed signature of the secondary operating system and the public key and responsive to verifying the secondary operating system, allow the information handling system to boot to the secondary operating system.

In accordance with these and other embodiments of the present disclosure, a method may include, in an information handling system comprising non-transitory computer readable media having stored thereon a primary operating system of the information handling system and a secondary operating system of the information handling system and the information handling system further comprising a basic input/output system communicatively having provisioned thereon a signed signature of the secondary operating system signed with a private key of a public-private key pair and a public key of the public-private key pair: responsive to a determination by the basic input/output system to boot to the secondary operating system in lieu of booting to the primary operating system of the information handling system, verifying, with the basic input/output system, the secondary operating system using the signed signature of the secondary operating system and the public key, and responsive to verifying the secondary operating system, allowing, by the basic input/output system, the information handling system to boot to the secondary operating system.

In accordance with these and other embodiments of the present disclosure, an article of manufacture may include a computer readable medium and computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to, in an information handling system comprising non-transitory computer readable media having stored thereon a primary operating system of the information handling system and a secondary operating system of the information handling system and the information handling system further comprising a basic input/output system communicatively having provisioned thereon a signed signature of the secondary operating system signed with a private key of a public-private key pair and a public key of the public-private key pair: responsive to a determination by the basic input/output system to boot to the secondary operating system in lieu of booting to the primary operating system of the information handling system, verify, with the basic input/output system, the secondary operating system using the signed signature of the secondary operating system and the public key, and responsive to verifying the secondary operating system, allow, by the basic input/output system, the information handling system to boot to the secondary operating system.

DETAILED DESCRIPTION

Preferred embodiments and their advantages are best understood by reference toFIGS. 1 through 4, wherein like numbers are used to indicate like and corresponding parts.

FIG. 1illustrates a block diagram of an example information handling system102, in accordance with embodiments of the present disclosure. In some embodiments, information handling system102may be a server. In other embodiments, information handling system102may be a personal computer (e.g., a desktop computer or a portable computer). As depicted inFIG. 1, information handling system102may include a processor103, a memory104communicatively coupled to processor103, a storage resource106communicatively coupled to processor103, a network interface108communicatively coupled to processor103, a basic input/output system (BIOS)110communicatively coupled to processor103, and a user interface116coupled to processor103.

Storage resource106may be communicatively coupled to processor103and may include any system, device, or apparatus configured to retain program instructions or data for a period of time (e.g., a computer-readable medium). In some embodiments, storage resource106may include a hard disk drive, a magnetic tape library, an optical disk drive, a magneto-optical disk drive, a compact disc drive, a solid state storage drive, a flash drive and/or any other suitable computer-readable medium. In some embodiments, storage resource106may reside internal to a chassis or other enclosure comprising information handling system102and not be readily accessible without opening such chassis or other enclosure. In other embodiments, storage resource106may reside internal to a chassis or other enclosure comprising information handling system102. As shown inFIG. 1, storage resource106may have stored thereon a primary, or host, operating system (OS)107and a secondary OS109.

Primary operating system107may comprise any program of executable instructions, or aggregation of programs of executable instructions, configured to manage and/or control the allocation and usage of hardware resources such as memory, processor time, disk space, and input and output devices, and provide an interface between such hardware resources and application programs hosted by OS107. Active portions of OS107may be transferred from storage resource106to memory104for execution by processor103.

Secondary OS109may comprise any program of executable instructions, or aggregation of programs of executable instructions, configured as a special-purpose OS to perform diagnostics, recovery, and/or repair to primary OS107and/or other components of information handling system102. In some embodiments, secondary OS109may be stored in a hidden partition of storage resource106, and may be configured to boot in lieu of primary OS107if information handling system102is unable to boot to primary OS107.

Network interface108may comprise any suitable system, apparatus, or device operable to serve as an interface between information handling system102and a network comprising one or more other information handling systems. Network interface108may enable information handling system102to communicate over such a network using any suitable transmission protocol and/or standard, including without limitation, Fibre Channel, Frame Relay, Asynchronous Transfer Mode (ATM), Internet protocol (IP), other packet-based protocol, small computer system interface (SCSI), Internet SCSI (iSCSI), Serial Attached SCSI (SAS) or any other transport that operates with the SCSI protocol, advanced technology attachment (ATA), serial ATA (SATA), advanced technology attachment packet interface (ATAPI), serial storage architecture (SSA), integrated drive electronics (IDE), and/or any combination thereof. Network interface108may interface with one or more networks implemented as, or as part of, a storage area network (SAN), personal area network (PAN), local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a wireless local area network (WLAN), a virtual private network (VPN), an intranet, the Internet or any other appropriate architecture or system that facilitates the communication of signals, data and/or messages (generally referred to as data). In certain embodiments, network interface108may comprise a network interface card, or “NIC.”

BIOS110may be communicatively coupled to processor103and may include any system, device, or apparatus configured to identify, test, and/or initialize information handling resources of information handling system102. “BIOS” may broadly refer to any system, device, or apparatus configured to perform such functionality, including without limitation, a Unified Extensible Firmware Interface (UEFI). In some embodiments, BIOS110may be implemented as a program of instructions that may be read by and executed on processor103to carry out the functionality of BIOS110. In these and other embodiments, BIOS110may comprise boot firmware configured to be the first code executed by processor103when information handling system102is booted and/or powered on. As part of its initialization functionality, BIOS code may be configured to set components of information handling system102into a known state, so that one or more applications (e.g., an operating system or other application programs) stored on compatible media (e.g., memory104) may be executed by processor103and given control of information handling system102.

As shown inFIG. 1, BIOS110may comprise signed secondary OS signature112and public key114. As described in greater detail below, signed secondary OS signature112and public key114may be stored within BIOS110during provisioning of information handling system102. Signed secondary OS signature112may comprise a hash or other unique signature of the image of secondary OS109signed with a private key of a public-private key pair. Public key114may be the public key of the public-private key pair that includes the private key used to sign signed secondary OS signature112.

User interface116may comprise any instrumentality or aggregation of instrumentalities by which a user may interact with information handling system102. For example, user interface116may permit a user to input data and/or instructions into information handling system102(e.g., via a keyboard, pointing device, and/or other suitable component), and/or otherwise manipulate information handling system102and its associated components. User interface116may also permit information handling system102to communicate data to a user, e.g., by way of a display device.

FIG. 2illustrates a flow chart of an example method200for provisioning information handling system102to bind secondary OS109to BIOS110, in accordance with embodiments of the present disclosure. According to one embodiment, method200may begin at step202. As noted above, teachings of the present disclosure may be implemented in a variety of configurations of information handling system102. As such, the preferred initialization point for method200and the order of the steps comprising method200may depend on the implementation chosen.

At step202, a provisioning process (e.g., a factory provisioning process) for information handling system102may generate a signature (e.g., a hash) for the image (e.g., Windows image file) for secondary OS109. At step204, the provisioning process may sign the signature with the private key of the public-private key pair that includes public key114in order to generate signed secondary OS signature112. At step206, the provisioning process may build BIOS110such that BIOS110includes signed secondary OS signature112and public key114. After conclusion of step206, method200may end.

AlthoughFIG. 2discloses a particular number of steps to be taken with respect to method200, method200may be executed with greater or lesser steps than those depicted inFIG. 2. In addition, althoughFIG. 2discloses a certain order of steps to be taken with respect to method200, the steps comprising method200may be completed in any suitable order.

Method200may be implemented using information handling system102or any other system operable to implement method200. In certain embodiments, method200may be implemented partially or fully in software and/or firmware embodied in computer-readable media.

FIG. 3illustrates a flow chart of an example method300for hardening a service operating system partition in connection with information handling system provisioning, in accordance with embodiments of the present disclosure. According to one embodiment, method300may begin at step302. As noted above, teachings of the present disclosure may be implemented in a variety of configurations of information handling system102. As such, the preferred initialization point for method300and the order of the steps comprising method300may depend on the implementation chosen.

At step302, a provisioning process (e.g., a factory provisioning process) for information handling system102may create a secondary OS partition namespace. At step304, the provisioning process may encrypt the namespace using a private key (e.g., the same private key used in step204of method200). At step306, the provisioning process may copy the image for the secondary OS into the secondary OS partition namespace. At step308, the provisioning process may build BIOS110such that BIOS110includes the encrypted secondary OS partition namespace and public key114. After conclusion of step306, method300may end.

AlthoughFIG. 3discloses a particular number of steps to be taken with respect to method300, method300may be executed with greater or lesser steps than those depicted inFIG. 3. In addition, althoughFIG. 3discloses a certain order of steps to be taken with respect to method300, the steps comprising method300may be completed in any suitable order.

Method300may be implemented using information handling system102or any other system operable to implement method300. In certain embodiments, method300may be implemented partially or fully in software and/or firmware embodied in computer-readable media.

FIG. 4illustrates a flow chart of an example method400for verification of secondary operating system109, in accordance with embodiments of the present disclosure. According to one embodiment, method400may begin at step402. As noted above, teachings of the present disclosure may be implemented in a variety of configurations of information handling system102. As such, the preferred initialization point for method400and the order of the steps comprising method400may depend on the implementation chosen.

At step402, BIOS110may determine whether to perform a boot to primary OS107or secondary OS109. The determination of whether to perform boot to primary OS107or secondary OS109is beyond the scope of this disclosure, and such determination may be made based on any suitable number and/or combination of factors, actions, and/or events. If BIOS110determines to boot to primary OS107, method400may proceed to step404. Otherwise, if BIOS110determines to boot to secondary OS109, method400may proceed to step406.

At step404, BIOS110may load a bootloader for primary OS107and may proceed to boot to primary OS107. The integrity and security of primary OS107may be ensured by existing secure boot techniques, and is thus outside the scope of this disclosure. After completion of step404, method400may end.

At step406, BIOS110may use public key114to decrypt/unsign signed secondary OS signature112.

At step408, BIOS110may determine if an image for secondary OS109is present on storage resource106. If image for secondary OS109is present on storage resource106, method400may proceed to step410. Otherwise, method400may proceed to step420.

At step410, BIOS110may determine if storage resource106is a Non-Volatile Memory Enhanced (NVMe) hard drive. If storage resource106is an NVMe hard drive, method400may proceed to step412. Otherwise method400may proceed to step414.

At step412, BIOS110may attempt to authenticate an NVMe namespace of storage resource106. If BIOS110is able to authenticate an NVMe namespace of storage resource106, method400may proceed to step414. Otherwise, method400may proceed to step420.

At step414, BIOS110may read the image (e.g., Windows image file) of secondary OS109(e.g., as stored on storage resource106or as downloaded) and generate a signature (e.g., hash) for the image.

At step416, BIOS110may compare the decrypted/unsigned secondary OS signature112to the signature for secondary OS109generated at step414. If the signatures match, the image for secondary OS109is verified and method400may proceed to step418. If the signatures do not match, the verification of secondary OS109has failed and method400may proceed to step420.

At step418, BIOS110may load a bootloader for secondary OS109and may proceed to boot to secondary OS109. After completion of step418, method400may end.

At step420, BIOS110may (e.g., using a preboot network service) communicate (e.g., via the Internet or other network coupled to network interface108) a version manifest for the secondary OS to a trusted location (e.g., to a server maintained by the provider of information handling system102and/or secondary OS109). At step422, BIOS110may download (e.g., via the Internet or other network coupled to network interface108) an image file for secondary OS109from a trusted location (e.g., from a server maintained by the provider of information handling system102and/or secondary OS109), wherein such image file is based on the version manifest. After completion of step422, method400may proceed again to step414to verify the new downloaded image file for secondary OS109.

AlthoughFIG. 4discloses a particular number of steps to be taken with respect to method400, method400may be executed with greater or lesser steps than those depicted inFIG. 4. In addition, althoughFIG. 4discloses a certain order of steps to be taken with respect to method400, the steps comprising method400may be completed in any suitable order.

Method400may be implemented using information handling system102or any other system operable to implement method400. In certain embodiments, method400may be implemented partially or fully in software and/or firmware embodied in computer-readable media.

Although exemplary embodiments are illustrated in the figures and described above, the principles of the present disclosure may be implemented using any number of techniques, whether currently known or not. The present disclosure should in no way be limited to the exemplary implementations and techniques illustrated in the figures and described above.

Unless otherwise specifically noted, articles depicted in the figures are not necessarily drawn to scale.