BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.1 Update Mechanism 1: Secure BIOS Update at Anytime

NIST platform security: roots of trust, firmware and secure enclaves SP 800-147B
All changes in this version
first version loaded 4 Security Guidelines by Update Mechanism part of 4

Title

Update Mechanism 1: Secure BIOS Update at Anytime

Control

With this BIOS update mechanism, the secure update of the BIOS flash memory may occur during numerous operating states of the server. This includes being able to update the BIOS flash while the server operates, without requiring a reboot. While the new BIOS is not expected to execute until reboot, the flash can be updated at runtime using a System Management Interrupt (SMI) handler, a Service Processor, or other secure methods. The reboot that causes the new BIOS to execute could occur at any later time (potentially months after the actual flash update takes place).

Because this secure update mechanism prevents writing inauthentic code to the BIOS flash memory, it is not necessary to verify the BIOS during boot.

The relevant guidelines for implementing this BIOS update mechanism are listed below:  The BIOS update image must be digitally signed in accordance with the BIOS Update Authentication requirements in Section 3.1. An implementation may divide the BIOS update image into multiple, individually digitally signed parts.  An RTU, as defined in Section 2.5, must be available at runtime (and may be available during other operating states of the server) to update the BIOS flash memory.  A locking mechanism must exist such that only an RTU can write to the BIOS flash. Only an RTU should be able to unlock the flash and, when unlocked, only the RTU may have the ability to write to the BIOS flash memory. An RTU may always have access to write to the BIOS flash memory.  The digitally signed BIOS update image must be transferred to an RTU. The RTU must have the ability to store the BIOS update image in a location that does not allow unauthorized write access to the BIOS update image.

The general steps for implementing this mechanism are: 1. A digitally signed BIOS update image is transferred to the RTU. 2. The RTU stores the BIOS update image in a location that can only be written to by an RTU. 3. The RTU verifies the BIOS update image is authentic. If the BIOS update image is determined to be inauthentic, the BIOS update image will not be written to the BIOS flash memory. If the BIOS update image is authentic, the RTU configures the locking mechanism such that only an RTU has access to write the BIOS flash memory. A viable locking mechanism design could allow the RTU to always have access to write the BIOS flash memory as long as only RTUs have the same capability. 4. The RTU writes the BIOS update image into the BIOS flash memory.