Hewlett-packard Development Company, L.p.

Baraneedharan Anbazhagan

Christopher H Stewart

Lan Wang

Valiuddin Y Ali

Patrick L Gibbons

Jeffrey Kevin Jeansonne

Rosilet Retnamoni Braduke

Jayne E Scott

Tevin Richards

Scott B Marcak

John D Roche

Erich Wolfgang Gestacker McMillan

Diep V Nguyen

Richard A Bramley, Jr

Richard Bramley

Thong Thai

Dong Wei

Dallas M Barlow

Stanley Hyojun Park

Jon Liu

Richard A Bramley Jr

An example storage medium is described, wherein the storage medium comprises instructions that, when executed cause a processor of an electronic device to store a private key in a first memory of the electronic device. The controller also stores an encrypted version of a password and validity information defining a condition to the password's validity in a second memory of the electronic device. During a boot process of the electronic device, the controller may detect a failure to decrypt data stored in a third memory and, upon this detection, decrypt the encrypted version of the password using the private key, and determine, using the validity information, whether the password is valid. If the password is valid, the controller may input the decrypted password to a decryption service, wherein the decryption service is to decrypt the data stored in the third memory.

Encrypted storage

An example storage medium is described, wherein the storage medium comprises instructions that, when executed cause a processor of an electronic device to store authentication data in a first memory of the electronic device. Upon detecting a failure to decrypt information, the processor is to perform an authentication with a webservice, receive a recovery code, and input the recovery code to a recovery service. The recovery code is obscured from the user.

Recovery request

An example apparatus may include a hardware component, a memory, and a processor. The processor may retrieve a firmware for the hardware component subsequent to the firmware being loaded on the hardware component. The processor may determine that a firmware signature associated with the firmware is stored in the memory. In some examples, in response to a determination that the firmware signature associated with the firmware is stored in the memory, the processor may initiate authentication of the firmware.

Authentication of hardware component firmware

An example non-transitory computer readable storage medium comprising instructions that when executed cause a processor of a computing device to: in response to a trigger of a system management mode (SMM), verify all processor threads have been pulled into the SMM; in response to a successful verification, enable write access to a non-volatile memory of the computing device via two registers, where the writing access is disabled upon booting of the computing device; and upon exiting the SMM, disable the write access via the two registers.

Non-volatile memory write access control

A computer system includes an independent compute core; and an isolated secure data storage device to store data accessible only to the independent compute core. The independent compute core is to open an Application Program Interface (API) during runtime of the computer system in response to receiving a verified message containing secure data to be written to the secure data storage device.

Securely writing data to a secure data storage device during runtime

In some examples, a device includes a memory, a processor, and a controller separate from the processor to derive a security credential based on information comprising a key accessible by the controller. The controller communicates the derived security credential in a secure manner to a program code executable on the processor, and uses the derived security credential to protect data stored in the memory against unauthorized access.

Security credential derivation

The update progress of a basic input/output system (BIOS) is displayed on a display screen. A first chipset lock is applied to a first region of a shared serial peripheral interface (SPI) chip of the BIOS of a computer system containing a first program of instructions. A system management memory mode lock is applied to a second and a third region of the shared SPI chip containing a second and third programs of instructions respectively. The second program of instructions is updated, and control of the BIOS is transferred to the updated second program of instructions. The updated second program of instructions updates the first program of instructions. The BIOS update progress visual is displayed on the display screen of the computer system while updating the first program of instructions.

Displaying a BIOS update progress

Examples associated with boot data validity are described. One example includes determining whether NVRAM boot data structure is valid. When the NVRAM boot data structure is valid, a NVRAM boot data structure validity flag is set to indicate the boot data structure is invalid. The validity flag is set to indicate the NVRAM boot data structure is valid once a point in a startup process is reached that indicates the startup process will complete successfully. When the NVRAM boot data structure is invalid, errors identified in the NVRAM boot data structure are repaired, and the startup process is restarted.

Boot data validity

Example embodiments disclosed herein relate to backing up firmware. An operating system can be initialized. During the initialization process, memory can be set. The firmware can be backed up to storage based on the set memory.

Backing up firmware during initialization of device

Examples herein disclose receiving a basic input output system (BIOS) policy change and authorizing the BIOS policy change. Upon the authorization of the BIOS policy change, a first copy of the BIOS policy is stored in a first memory accessible by a central processing unit. Additionally, a second copy of the BIOS policy change is transmitted for storage in a second memory electrically isolated from the central processing unit.

Authorizing a bios policy change for storage

A second physical-address-dependent code is generated from a first physical-address-dependent code using differential data, where the generating comprises converting a first physical address in a region of the first physical-address-dependent code to a second, different physical address for inclusion in a corresponding region of the second physical-address-dependent code.

Generating a second code from a first code

It is determined whether an updated first boot phase code is present. The updated first boot phase code is validated. In response to the validating, a current version of the first boot phase code is updated using the updated first boot phase code.

Updating boot code

A computing system includes a plurality of graphics controllers, a reserved memory region, a shadow memory region, and a system Basic Input Output System (BIOS). The reserved memory region is to store a plurality of video Basic Input Output System (BIOS) images. The shadow memory region is to store a selected video BIOS image corresponding to a selected graphics controller, such that the selected graphics controller is to display output in response to a service request for video BIOS services, without use of a graphics driver. The system BIOS is to enable changing the selected graphics controller, based on copying a video BIOS image from the reserved memory region to the shadow memory region.

Growing community of inventors

Houston, TX, United States of America

Baraneedharan Anbazhagan