System and method for firmware security event mitigation

Patent metadata

Field	Value
Publication number	US-12430440-B2
Application number	US-202217739832-A
Country	US
Kind code	B2
Filing date	May 9, 2022
Priority date	May 10, 2021
Publication date	Sep 30, 2025
Grant date	Sep 30, 2025

Abstract

Systems and methods for performing security event mitigation with firmware are discussed. A firmware-based security event framework receives notifications of security events occurring in a firmware-controlled operating environment on a computing platform, logs information related to the event and optionally performs mitigation operations to address the security event.

First claim

We claim:

1. A non-transitory medium holding executable instructions for performing security event mitigation with firmware on a computing platform equipped with one or more processors, the instructions when executed causing the computing platform to:
receive notification of detection of an occurrence of a security event occurring within a privileged firmware-controlled operating environment running outside the control of a main hypervisor or operating system on the computing platform, the detection occurring during runtime following completion of a boot sequence for the computing platform and a transition of control to the privileged firmware-controlled operating environment from the main hypervisor or operating system,

wherein the security event detected is one of unauthorized memory access, unauthorized register access, unauthorized use of specified privileged instructions, buffer overflow or integer arithmetic faults;
log, with the firmware, information regarding the cause of the event in a non-volatile storage location;
generate, with the firmware, a notification of the security event;
reset the computing platform based on the detection before performing a mitigation of the security event and
perform, with the firmware, a mitigation of the security event after the resetting of the computing platform.

2. The medium of claim 1 , wherein the mitigation blocks a firmware module from executing after the reset of the computing platform.

3. The medium of claim 1 , wherein the mitigation re-flashes an entire BIOS image, a firmware volume that contains a module causing the security event, or a specific driver causing the security event.

4. The medium of claim 1 , wherein the security event is caused by code executing when one or more processors of the computing platform are in System Management Mode.

5. The medium of claim 1 , wherein the security event is detected using central processing unit and chipset resources.

6. The medium of claim 1 , wherein the security event is detected at runtime using code injected by a compiler during build time.

7. A method for performing security event mitigation with firmware on a computing platform equipped with one or more processors, comprising:
receiving notification of detection of an occurrence of a security event occurring within a privileged firmware-controlled operating environment running outside the control of a main hypervisor or operating system on the computing platform, the detection occurring during runtime following completion of a boot sequence for the computing platform and a transition of control to the privileged firmware-controlled operating environment from the main hypervisor or operating system,

wherein the security event detected is one of unauthorized memory access, unauthorized register access, unauthorized use of specified privileged instructions, buffer overflow or integer arithmetic faults;
logging, with the firmware, information regarding the cause of the event in a non-volatile storage location;
generating, with the firmware, a notification of the security event;
resetting the computing platform based on the detection before performing a mitigation of the security event; and
performing, with the firmware, a mitigation of the security event after the resetting of the computing platform.

8. The method of claim 7 , wherein the mitigation blocks a firmware module from executing after the reset of the computing platform.

9. The method of claim 7 , wherein the mitigation re-flashes an entire BIOS image, a firmware volume that contains a module causing the security event, or a specific driver causing the security event.

10. The method of claim 7 , wherein the security event is caused by code executing when one or more processors of the computing platform are in System Management Mode.

11. The method of claim 7 , wherein the security event is detected using central processing unit and chipset resources.

12. The method of claim 7 , wherein the security event is detected at runtime using code injected by a compiler during build time.

13. A computing platform, comprising:
one or more processors; and
firmware including a security event framework, the security event framework including one or more firmware modules that when executed:
receive notification of an occurrence of a security event occurring within a privileged firmware-controlled operating environment running outside the control of a main hypervisor or operating system on the computing platform, the detection occurring during runtime following completion of a boot sequence for the computing platform and a transition of control to the privileged firmware-controlled operating environment from the main hypervisor or operating system,

wherein the security event detected is one of unauthorized memory access, unauthorized register access, unauthorized use of specified privileged instructions, buffer overflow or integer arithmetic faults;
log, with the firmware, information regarding the cause of the event in a non-volatile storage location;
generate, with the firmware, a notification of the security event;
reset the computing platform based on the detection before performing a mitigation of the security event; and
perform, with the firmware, a mitigation of the security event.

Assignees

• Insyde Software Corp

Inventors

• Lewis Timothy Andrew

Classifications

• G06F21/554

  involving event detection and direct action · CPC title

• G06F9/545

  where tasks reside in different layers, e.g. user- and kernel-space · CPC title

• G06F21/562

  Static detection · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title