Method and apparatus for boot variable protection

Patent metadata

Field	Value
Publication number	US-10417429-B2
Application number	US-201715721502-A
Country	US
Kind code	B2
Filing date	Sep 29, 2017
Priority date	Jun 2, 2017
Publication date	Sep 17, 2019
Grant date	Sep 17, 2019

Abstract

A method and apparatus for protecting boot variables is disclosed. A computer system includes a main processor and an auxiliary processor. The auxiliary processor includes a non-volatile memory that stores variables associated with boot code that is also stored thereon. The main processor may send a request to the auxiliary processor to alter one of the variables stored in the non-volatile memory. Responsive to receiving the request, the auxiliary processor may execute a security policy to determine if the main processor meets the criteria for altering the variable. If the auxiliary processor determines that the main processor meets the criteria, it may grant permission to alter the variable.

First claim

What is claimed is:

1. A method, comprising:
a first processor receiving a request from a second processor to alter a first variable stored in a non-volatile memory associated with the first processor, wherein the first variable is associated with boot code that is also stored in the non-volatile memory;
the first processor executing a security policy to determine if the second processor meets criteria for altering the first variable, wherein the criteria include determining if the second processor is operating in a recovery mode, wherein the recovery mode has a reduced set of capabilities relative to a set of capabilities available during execution of an operating system by the second processor after a boot procedure, and wherein the criteria include determining if the second processor has provided proper credentials for altering the first variable; and
wherein the first processor is configured, according to the security policy, to grant permission to the second processor to alter the first variable responsive to determining that the second processor meets the criteria for altering the first variable; and
wherein the first processor is configured, according to the security policy, to inhibit the second processor from altering the first variable responsive to determining that the second processor does not meet the criteria for altering the first variable.

2. The method as recited in claim 1 , further comprising:
the non-volatile memory storing a plurality of variables accessed during a boot procedure, wherein the plurality of variables includes the first variable.

3. The method as recited in claim 2 , further comprising:
the second processor requesting access to one of the plurality of variables during a boot procedure, wherein the first processor is configured to execute the security policy to determine whether to grant access to the one of the plurality of variables.

4. The method as recited in claim 2 , wherein the first processor is configured to limit access of the plurality of variables by the second processor to a single one of the variables at a given time.

5. The method as recited in claim 2 , further comprising:
the second processor conveying a request to the first processor to delete one of the plurality of variables;
responsive to receiving the request, the first processor executing the security policy to determine if the first processor is authorized to delete the one of the plurality of variables; and
responsive to determining that the second processor is authorized, the first processor granting permission to the second processor to delete the one of the plurality of variables.

6. The method as recited in claim 2 , further comprising:
the first processor adding a new variable to the plurality of variables; and
the first processor setting attributes associated with the new variable.

7. The method as recited in claim 6 , wherein the attributes associated with the new variable include one or more of the following:
an operating mode in which the new variable may be altered;
an indication as to whether the new variable can be deleted; and
credentials required for access to the new variable.

8. A computer system, comprising:
a main processor;
an auxiliary processor; and
non-volatile memory having a plurality of variables stored therein, wherein the variables are used by the main processor during a boot procedure;
wherein the auxiliary processor is configured to:
receive, from the main processor, a request to alter a first variable of the plurality of variables;
in response to the request, execute a security policy to determine if the main processor meets criteria for altering the first variable, wherein the criteria include determining if the main processor is operating in a recovery mode that has a reduced set of capabilities relative to a set of capabilities available during execution of an operating system by the main processor after the boot procedure, and wherein the criteria include determining if the main processor has provided proper credentials for altering the first variable;
grant permission to alter the first variable to the main processor responsive to determining that the main processor meets the criteria for altering the first variable; and
deny access to the first variable by the main processor responsive to determining that the main processor has not met the criteria for altering the variable.

9. The computer system as recited in claim 8 , wherein the main processor is further configured to request access to one of the plurality of variables during a boot procedure, wherein, responsive to receiving the request, the auxiliary processor is configured to execute the security policy to determine whether to grant access to the one of the plurality of variables.

10. The computer system as recited in claim 8 , wherein the auxiliary processor is configured to limit access to the plurality of variables, by the main processor, to one variable at a time.

11. The computer system as recited in claim 8 , wherein the main processor is further configured to convey a request to the auxiliary processor to delete one of the plurality of variables, and wherein the auxiliary processor is configured to determine whether to allow deletion of the one of the plurality of variables based on at least a current operating mode of the main processor and credentials provided by the main processor.

12. A method, comprising:
a main processor in a computer system sending a request to an auxiliary processor to alter a first one of a plurality of variables pertaining to a boot procedure of the main processor;
executing, using the auxiliary processor, a security policy to determine whether to grant permission to alter the first one of the plurality of variables;
wherein the auxiliary processor is configured, according to the security policy, to grant permission to the main processor to alter the first one of the plurality of variables in response to:
determining that the main processor is operating in recovery mode, wherein the recovery mode has a reduced set of capabilities relative to a set of capabilities available during execution of an operating system by the main processor after the boot procedure; and
determining that the main processor has provided required credentials for altering the first one of the plurality of variables; and

wherein the auxiliary processor is configured, according to the security policy, to deny permission to alter the first one of the plurality of variables responsive to determining the main processor is not operating in the recovery mode or the main processor has not provided the required credentials for altering the first one of the plurality of variables.

13. The method as recited in claim 12 , further comprising:
the main processor requesting access to one or more of the plurality of variables during the boot procedure;
the auxiliary processor executing the security policy to determine whether to grant access to the one or more of the plurality of variables by the main processor; and
the auxiliary processor enabling access to the one or more of the plurality of variables responsive to determining that the main processor is authorized to access the one or more of the plurality of variables.

Assignees

• Apple Inc

Inventors

• De Cesare Joshua P
• Paaske Timothy R
• Kovah Xeno S
• Schlej Nikolaj
• Wilcox Jeffrey R
• Doshi Hardik K
• Alderfer Kevin H
• Kallenberg Corey T

Classifications

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title

• G06F9/4401

  Bootstrapping (security arrangements therefor G06F21/57) · CPC title

• G06F21/575 Primary

  Secure boot · CPC title

• G06F21/73

  by creating or determining hardware identification, e.g. serial numbers · CPC title