BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.5 Root of Trust for Update

NIST platform security: roots of trust, firmware and secure enclaves SP 800-147B
All changes in this version
first version loaded 2 Background part of 2

Title

Root of Trust for Update

Control

A Root of Trust for Update (RTU) is an inherently trusted combination of hardware and firmware that performs a secure update of the BIOS and maintains the integrity of the BIOS. The RTU may comprise functionality for verifying digitally signed BIOS images, engaging and disengaging write-protection mechanisms, writing BIOS updates to flash, performing BIOS recovery, and updating the RTU itself. Section 3 specifies requirements on the RTU for performing secure BIOS updates and maintaining BIOS integrity. The inherent trust of the RTU is derived from an isolated execution environment—minimizing the risk to subvert the functionality of the RTU and hence maintaining the inherent trust of the RTU.

Each functional component of the RTU may be considered a Root of Trust for the specific function:

 The Verification Component is responsible for verifying a digitally signed BIOS image to determine if control should be passed to the image. This component has a trusted execution path since it is entered from a known good state of the machine. The verification component can be used to extend trusted execution to code in unprotected memory locations. The verification component verifies the BIOS image and if the verification is successful then it passes control to the image. If the verification fails then the verification component returns to the trusted execution path and does not pass control to the image.  The Recovery Component is responsible for initiating a return of the system to a known good state.  The Integrity Component is responsible for maintaining the integrity of a BIOS image. This may include engaging hardware and firmware based locking mechanisms to prevent unauthorized modification of the image. It also prevents race/logic conditions from unauthorized modification of a BIOS image.  The Update Component is responsible for performing a secure update of the RTU and maintaining the integrity of the RTU.