Bios protection using request interception and approval of bios modifications

Patent metadata

Field	Value
Publication number	US-12475227-B2
Application number	US-202318123005-A
Country	US
Kind code	B2
Filing date	Mar 17, 2023
Priority date	Mar 17, 2023
Publication date	Nov 18, 2025
Grant date	Nov 18, 2025

Abstract

Techniques are provided for basic input/output system (BIOS) protection using BIOS modification interception and approval. One method comprises, by an entity associated with an operating system of a device, obtaining a request to perform a reboot and/or a shutdown of the processing device; determining, prior to performing the reboot and/or the shutdown, whether an update of a BIOS of the device is pending; generating an approval request, responsive to determining that the update of the BIOS is pending and prior to performing the reboot and/or the shutdown; and initiating an automated action, responsive to a result of the approval request. In some embodiments, a BIOS update flag may be reset and/or a BIOS staging environment may be cleared following the updating of the image, responsive to a user not approving the update.

First claim

What is claimed is:

1 . A method, comprising:
obtaining, by at least one entity associated with an operating system of at least one processing device, a request to perform one or more of a reboot and a shutdown of the at least one processing device; performing the following steps in response to the obtained request: determining, by the at least one entity, prior to performing the one or more of the reboot and the shutdown, whether an update of a basic input/output system (BIOS) of the at least one processing device is pending; generating, by the at least one entity, an approval request, responsive to determining that the update of the BIOS is pending and prior to performing the one or more of the reboot and the shutdown, wherein the approval request requests a user to approve the pending BIOS update; and initiating, by the at least one entity, one or more automated actions, responsive to a result of the approval request; wherein the method is performed by the at least one processing device, wherein the at least one processing device comprises a processor coupled to a memory.

2 . The method of claim 1 , further comprising one or more of resetting a BIOS update flag and clearing a BIOS staging environment, responsive to the user not approving the update.

3 . The method of claim 1 , further comprising updating at least one BIOS chip using an image of a new BIOS version, responsive to a user approving the update.

4 . The method of claim 3 , wherein the image of the new BIOS version is stored in a BIOS staging environment of the at least one BIOS chip by an operating system of the at least one processing device.

5 . The method of claim 1 , wherein, prior to the determining whether the update of the BIOS is pending, a BIOS production environment of at least one BIOS chip comprises a production BIOS version and wherein a BIOS staging environment comprises an image of a new BIOS version.

6 . The method of claim 1 , wherein the one or more automated actions comprise one or more of suspending the one or more of the reboot and the shutdown; providing at least one notification to a user; providing at least one instruction to a user; and providing at least one software tool to a user.

7 . The method of claim 1 , wherein the determining whether the update of the BIOS is pending comprises one or more of detecting that a BIOS update flag is set and detecting that a BIOS staging environment comprises an image of a different BIOS version than a version of the BIOS.

8 . The method of claim 1 , wherein the at least one entity associated with the operating system comprises at least one software entity associated with an operating system kernel.

9 . An apparatus comprising:
at least one processing device comprising a processor coupled to a memory; the at least one processing device being configured to implement the following steps: obtaining, by at least one entity associated with an operating system of the at least one processing device, a request to perform one or more of a reboot and a shutdown of the at least one processing device; performing the following steps in response to the obtained request: determining, by the at least one entity, prior to performing the one or more of the reboot and the shutdown, whether an update of a basic input/output system (BIOS) of the at least one processing device is pending; generating, by the at least one entity, an approval request, responsive to determining that the update of the BIOS is pending and prior to performing the one or more of the reboot and the shutdown, wherein the approval request requests a user to approve the pending BIOS update; and initiating, by the at least one entity, one or more automated actions, responsive to a result of the approval request.

10 . The apparatus of claim 9 , further comprising one or more of resetting a BIOS update flag and clearing a BIOS staging environment, responsive to the user not approving the update.

11 . The apparatus of claim 9 , further comprising updating at least one BIOS chip using an image of a new BIOS version, responsive to a user approving the update.

12 . The apparatus of claim 9 , wherein, prior to the determining whether the update of the BIOS is pending, a BIOS production environment of at least one BIOS chip comprises a production BIOS version and wherein a BIOS staging environment comprises an image of a new BIOS version.

13 . The apparatus of claim 9 , wherein the one or more automated actions comprise one or more of suspending the one or more of the reboot and the shutdown;
providing at least one notification to a user; providing at least one instruction to a user; and providing at least one software tool to a user.

14 . The apparatus of claim 9 , wherein the determining whether the update of the BIOS is pending comprises one or more of detecting that a BIOS update flag is set and detecting that a BIOS staging environment comprises an image of a different BIOS version than a version of the BIOS.

15 . A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:
obtaining, by at least one entity associated with an operating system of the at least one processing device, a request to perform one or more of a reboot and a shutdown of the at least one processing device; performing the following steps in response to the obtained request: determining, by the at least one entity, prior to performing the one or more of the reboot and the shutdown, whether an update of a basic input/output system (BIOS) of the at least one processing device is pending; generating, by the at least one entity, an approval request, responsive to determining that the update of the BIOS is pending and prior to performing the one or more of the reboot and the shutdown, wherein the approval request requests a user to approve the pending BIOS update; and initiating, by the at least one entity, one or more automated actions, responsive to a result of the approval request.

16 . The non-transitory processor-readable storage medium of claim 15 , further comprising one or more of resetting a BIOS update flag and clearing a BIOS staging environment, responsive to the user not approving the update.

17 . The non-transitory processor-readable storage medium of claim 15 , further comprising updating at least one BIOS chip using an image of a new BIOS version, responsive to a user approving the update.

18 . The non-transitory processor-readable storage medium of claim 15 , wherein, prior to the determining whether the update of the BIOS is pending, a BIOS production environment of at least one BIOS chip comprises a production BIOS version and wherein a BIOS staging environment comprises an image of a new BIOS version.

19 . The non-transitory processor-readable storage medium of claim 15 , wherein the one or more automated actions comprise one or more of suspending the one or more of the reboot and the shutdown; providing at least one notification to a user; providing at least one instruction to a user; and providing at least one software tool to a user.

20 . The non-transitory processor-readable storage medium of claim 15 , wherein the determining whether the update of the BIOS is pending comprises one or more of detecting that a BIOS update flag is set and detecting that a BIOS staging environment comprises an image of a

Assignees

• Dell Products Lp

Inventors

• Shachar Tomer
• Buchman Ophir
• Gehtman Yevgeni

Classifications

• G06F9/4403

  Processor initialisation · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F8/654

  using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories · CPC title

• G06F9/4401

  Bootstrapping (security arrangements therefor G06F21/57) · CPC title

• G06F8/65

  Updates (security arrangements therefor G06F21/57) · CPC title