Hewlett-packard Development Company, L.p.

Phoenix Technologies Ltd.

Richard A Bramley, Jr

Jeffrey Kevin Jeansonne

Valiuddin Y Ali

Joshua Serratelli Schiffman

Maugan Villatel

Dallas M Barlow

Adrian John Baldwin

Christopher H Stewart

Boris Balacheff

David Plaquin

Vali Ali

Baraneedharan Anbazhagan

Patrick L Gibbons

Stanley Hyojun Park

Tevin Richards

Endrigo Pinheiro

Scott B Marcak

Robert Stephen Craig

Jonathan T Huntington, Ii

Karthick Periyakulam Tharakraj

Duane J Gatlin

Giridhar Busam

Shubham Mankhand

Systems and methods are provided for a computing device with a basic input/output system (BIOS) comprising BIOS settings that are to be changed by BIOS actions. An application may request a BIOS action to change a BIOS setting. Using a received key from the BIOS, a processor of the computing device may implement a kernel driver to sign the request from the application in response to determining that the application is authorized to request the BIOS action. Further, the BIOS may perform the BIOS action without requiring an administrative password upon receiving the signed action request from the kernel driver.

BIOS action request for authorized application

According to aspect of the disclosure, there are provided methods and apparatus for connecting a peripheral device to a computer system, including an apparatus for interfacing with a peripheral device, the apparatus comprising a port configured to couple to the peripheral device, a processor, a memory coupled to the processor and comprising a software module comprising instructions that when executed on the processor protect the device from a peripheral device coupled to the port, and a hardware security controller coupled to the port, the hardware security controller configured to monitor execution of the software module by the processor and to disable the port in response to determining that the software module is not executing.

Protected peripheral ports

In some examples, a computing device includes memory including system memory, and a processor in electronic communication with the memory. In some examples, the processor receives a system management interrupt. In some examples, the processor identifies trigger code that triggered the system management interrupt. In some examples, the processor executes code from the system memory when the trigger code is a virtualization program.

Execution of code in system memory

An example storage medium includes instructions that, when executed, cause a processor of a computing device to read, during start-up of the computing device, first configuration data from a first storage device of the computing device; read second configuration data from a second storage device of the computing device; determine that there is an inconsistency between the first configuration data and the second configuration data; check a tamper status of the computing device; based on the tamper status and the determination that there is an inconsistency between the first configuration data and the second configuration data: (i) clear a secure storage location of the computing device, the secure storage location storing data to access protected data; or (ii) replace the first configuration data on the first storage device of the computing device based on second data and continue the start-up of the computing device.

Configuration data deletion based on tamper status

An example computing device includes a user interface, a network interface, a non-volatile memory, a processor coupled to the user interface, the network interface, and the non-volatile memory, and a set of instructions stored in the non-volatile memory. The set of instructions, when executed by the processor, is to perform a hardware initialization of the computing device according to a setting, establish a local trust domain and a remote trust domain, use a local-access public key to issue a challenge via the user interface to grant local access to the setting, and use a remote-access public key to grant remote access via the network interface to remote access to the setting.

Access to firmware settings with asymmetric cryptography

An example computing device includes a memory accessible at startup of the computing device, a buffer, and a set of instructions. The memory stores a configuration setting that is configurable by the application of a change request. The memory also stores a first public key and a second public key. The buffer stores change requests submitted by a remote entity, including a first change request to make a first setting change and a second change request to make a second setting change. The first change request is signed by a first private key corresponding to the first public key, and the second change request is signed by a second private key corresponding to the second public key. The set of instructions retrieves a change request from the buffer, determines whether the change request is authenticated by a public key, and if authenticated, applies the change request.

Signed change requests to remotely configure settings

A computer system includes an independent compute core; and an isolated secure data storage device to store data accessible only to the independent compute core. The independent compute core is to open an Application Program Interface (API) during runtime of the computer system in response to receiving a verified message containing secure data to be written to the secure data storage device.

Securely writing data to a secure data storage device during runtime

A computer program product for providing notifications to a user of an intrusion into firmware includes, in one example, non-transitory computer readable medium including computer usable program code embodied therewith to, when executed by a processor, detect intrusion to the firmware of a computing system during runtime in a system management mode.

Notice of intrusion into firmware

An example computing device includes a memory to store a cryptographic key, a processor coupled to the memory, and a set of instructions stored in the memory. The set of instructions, when executed by the processor, is to capture an encrypted passcode originating from a basic input/output system (BIOS) of a managed device as a challenge to grant local access to the BIOS and authenticate with a server using a user credential. When authentication with the server is successful, the set of instructions is to decrypt the encrypted passcode with the cryptographic key to obtain a decrypted passcode and output the decrypted passcode. When authentication with the server is unsuccessful, the set of instructions is to delete the cryptographic key.

Cryptographic access to bios

In one example, a system for a system management mode (SMM) privilege architecture includes a computing device comprising: a first portion of SMM instructions to set up a number of resources and implement a privilege architecture for the SMM of a computing device and a second portion of SMM instructions to execute a number of functions during the SMM of the computing device, wherein the privilege architecture assigns the first portion of SMM instructions to a first privilege level and assigns the second portion of SMM instructions to a second privilege level.

System management mode privilege architecture

Securely sending a complete initialization package in one example implementation can include adding a resource identifier that includes a mapping of a driver to a hardware component included in a physical machine hosting VMs to an initial random-access memory (RAM) file system (INITRAMFS) stored in memory of the physical machine to form a complete initialization package, sending the complete initialization package from read-only memory (ROM) of the physical machine to a location in RAM of the physical machine accessible by a hypervisor, and authenticating that the complete initialization package is secure.

Securely sending a complete initialization package

Example implementations relate to command source verification. An example device can include instructions executable to send a command via a predefined path to a predefined location within a memory resource storing instructions executable to verify a source of the command using a predefined protocol and execute the command in response to the source verification.

Command source verification

According to one example, to access at least one computer device from a virtual machine, a control domain accesses a list of at least one device. For each device in the list of devices, a determination is made as to whether the device is to be exposed to a virtual machine, and a table of devices determined to be exposed to the virtual machine is created and provided to the virtual machine. Determining whether a device is to be exposed to a virtual machine is based on at least one device attribute.

Virtual machine device access

Full virtual machine (VM) functionality in one example implementation can include sending a complete initialization package to a location in memory of a machine accessible by a hypervisor and generating a VM capable of providing a respective full functionality of a hardware component in the machine.

Full virtual machine functionality

Examples herein disclose establishing a connection from a controller in a computing device to a management server over a network. The examples retrieve a command from the management server.

Growing community of inventors

Mansfield, MA, United States of America

Richard A Bramley, Jr