Unified extensible firmware interface (UEFI) credential-based access of hardware resources

Patent metadata

Field	Value
Publication number	US-9830457-B2
Application number	US-201514703912-A
Country	US
Kind code	B2
Filing date	May 5, 2015
Priority date	May 5, 2015
Publication date	Nov 28, 2017
Grant date	Nov 28, 2017

Abstract

Systems and methods for Unified Extensible Firmware Interface (UEFI) credential-based access of hardware resources. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: receive a credential for a given one of a plurality of users; and store the credential, where the credential is retrievable via a UEFI Device Path Protocol as part of a determination of whether the given user has access to a given one of a plurality of devices within the IHS, and where the given device is accessible via a UEFI Device Path.

First claim

The invention claimed is:

1. An Information Handling System (IHS), comprising:
a processor; and
a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to:
receive a credential provided by a given user of a plurality of users of the IHS, wherein the credential indicates whether the user has access to a given device among a plurality of devices coupled to the IHS;
receive a request by the given user to access the given device; and
at least one of:
(a) allow the user to access the given device by determining that a hardware Unified Extensible Firmware Interface (UEFI) Device Path corresponding to the request carries an authentication parameter indicating that the given user has provided the credential; or
(b) prevent the user from accessing the given device by determining that the hardware UEFI Device Path does not carry the authentication parameter.

2. The IHS of claim 1 , wherein the credential is independent of the given user's administrative authority or lack thereof with respect to the IHS.

3. The IHS of claim 1 , wherein the credential is received during a login portion of a boot service.

4. The IHS of claim 1 , wherein the credential is received via a runtime service after completion of a boot service.

5. The IHS of claim 1 , wherein the program instructions, upon execution by the processor, further cause the IHS to receive a request originated by the given user to retrieve the UEFI Device Path of the given device.

6. The IHS of claim 5 , wherein the request is part of an action upon an UEFI file system, UEFI shell, UEFI application, or UEFI driver.

7. The IHS of claim 5 , wherein retrieval of the UEFI Device Path occurs independently of any authentication or validation operation for the given device using a Secure Boot process.

8. The IHS of claim 5 , wherein the program instructions, upon execution by the processor, further cause the IHS to retrieve a file other than the UEFI Device Path in response to the credential indicating that the given user does not have access to the given device.

9. The IHS of claim 8 , wherein the retrieval of the file occurs after any authentication or validation operation for the given device using a Secure Boot process.

10. The IHS of claim 8 , wherein the file prevents a NULL value from being returned in response to the request.

11. The IHS of claim 8 , wherein the program instructions, upon execution by the processor, further cause the IHS to:
receive another request from the given user to delete the file; and
not fulfill the other request.

12. In an Information Handling System (IHS), a method comprising:
receiving a credential provided by a given user of a plurality of users of the IHS, wherein the credential indicates whether the user has access to a given device among a plurality of devices coupled to the IHS;
receiving a request by the given user to access the given device; and
at least one of:
(a) allowing the user to access the given device by determining that a hardware Unified Extensible Firmware Interface (UEFI) Device Path corresponding to the request carries an authentication parameter indicating that the given user has provided the credential; or
(b) preventing the user from accessing the given device by determining that the hardware UEFI Device Path does not carry the authentication parameter.

13. The method of claim 12 , wherein the credential is independent of the given user's administrative authority or lack thereof with respect to the IHS.

14. The method of claim 12 , wherein the credential is received during a login portion of a boot service.

15. The method of claim 12 , wherein the credential is received via a runtime service after completion of a boot service.

16. A memory device having program instructions stored thereon that, upon execution by a processor of an Information Handling System (IHS), cause the IHS to:
receive a credential provided by a given user of a plurality of users of the IHS, wherein the credential indicates whether the user has access to a given device among a plurality of devices coupled to the IHS;
receive a request by the given user to access the given device; and
at least one of:
(a) allow the user to access the given device by determining that a hardware Unified Extensible Firmware Interface (UEFI) Device Path corresponding to the request carries an authentication parameter indicating that the given user has provided the credential; or
(b) prevent the user from accessing the given device by determining that the hardware UEFI Device Path does not carry the authentication parameter.

17. The memory device of claim 16 , wherein the request is part of an action upon an UEFI file system, UEFI shell, UEFI application, or UEFI driver.

18. The memory device of claim 16 , wherein the program instructions, upon execution by the processor, further cause the IHS to:
receive another request from the given user to delete the information; and
not fulfill the other request.

Assignees

• Dell Products Lp

Inventors

• Vidyadhara Sumanth
• Puthillathe Chandrasekhar

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/575 Primary

  Secure boot · CPC title