Hewlett-packard Development Company, L.P.

Compaq Computer Corporation, Inc.

Hewlett Packard Enterprise Development LP

Valiuddin Y Ali

Lan Wang

Boris Balacheff

Jeffrey Kevin Jeansonne

James M Mann

Chris I Dalton

Jose Paulo Xavier Pires

Manuel Novoa

Richard A Bramley, Jr

Jennifer E Rios

James Luke Mondshine

Richard Bramley

Jeffrey C Parker

Graeme John Proudler

Joshua Serratelli Schiffman

Christopher H Stewart

Henry M D'Souza

Baraneedharan Anbazhagan

James Robert Waldron

Gokalp Bayramoglu

Christopher Charles Mohrman

Patrick L Gibbons

Endrigo Nadin Pinheiro

Endrigo Pinheiro

Adrian John Baldwin

David Plaquin

Ronaldo Rod Ferreira

Leonard E Russo

Matthew J Wagner

Pablo J Salazar

Tevin Richards

Fabio D Riffel

Peter D Hunt

Robert Stephen Craig

Jon Liu

Adilson Arthur Mohr

Jose Paulo Pires

Eduardo Moschetta

Eric Teller

Stacy L Wolff

Kevin L Massaro

Paul J Doczy

Helen Balinsky

John Michael Stivoric

Steven S Homer

Jeffrey A Lev

Christoph J Graham

Mark E Taylor

Wael M Ibrahim

Walter G Fry

Maugan Villatel

Dallas M Barlow

Larry W Kunkel

Walter A Gaspard

Christopher Ian Dalton

Mason Andrew Gunyuzlu

Stanley Hyojun Park

Shab H Madina

Chee Keat Fong

Rick Bramley

Edson Schardosim Behnck

Jon P Styskal

Nazih H Hage

Rodrigo Dias Correa

James Scott Love

Duane J Gatlin

Karthick Periyakulam Tharakraj

Mark J Altendorf

Ronaldo Rob Ferreira

Gary L Riechmann

Michael J Chroback

Alexander Gruzen

George R Pariza

Giridhar Busam

Anthony B Rorke

Ajay Chaturvedi

Lorri J Jefferson

Jeff Parker

Ronaldo Ron Ferreira

Richard Alden Bramley Jr

Fabio Delazeri Riffel

Wael Mohamad Ibrahim

Jennifer Rios

Systems and methods are provided for a computing device with a basic input/output system (BIOS) comprising BIOS settings that are to be changed by BIOS actions. An application may request a BIOS action to change a BIOS setting. Using a received key from the BIOS, a processor of the computing device may implement a kernel driver to sign the request from the application in response to determining that the application is authorized to request the BIOS action. Further, the BIOS may perform the BIOS action without requiring an administrative password upon receiving the signed action request from the kernel driver.

BIOS action request for authorized application

An example computing device includes a storage device, a random-access memory, a read only memory, and a processor. The processor is to determine, during a booting process, whether an operating system being booted is a primary operating system, in response to a determination that the operating system being booted is different from the primary operating system, determine whether the operating system being booted satisfies a first criteria, and, in response to a determination that the operating system being booted fails to satisfy the first criteria, disable software persistence.

Disabling software persistence

According to aspect of the disclosure, there are provided methods and apparatus for connecting a peripheral device to a computer system, including an apparatus for interfacing with a peripheral device, the apparatus comprising a port configured to couple to the peripheral device, a processor, a memory coupled to the processor and comprising a software module comprising instructions that when executed on the processor protect the device from a peripheral device coupled to the port, and a hardware security controller coupled to the port, the hardware security controller configured to monitor execution of the software module by the processor and to disable the port in response to determining that the software module is not executing.

Protected peripheral ports

According to examples, an apparatus may include a processor that may delete portions of firmware instructions responsive to an indication that the portions should be disabled. To facilitate the foregoing, the firmware instructions may be deployed in a segmented architecture stored in respective regions of a storage device. The regions may include a metadata region, a main region, and excludable regions. The metadata region may store metadata that describes the structure of the firmware instructions and/or the various other regions. The main region may store core firmware instructions that may not be deleted. Each excludable region may store respective excludable firmware instructions. Each excludable firmware instructions may be associated with a flag that indicates whether or not the instructions should be disabled. If so, the corresponding excludable region in the storage device is identified and the contents may be removed, permanently disabling the excludable firmware instructions that were stored there.

Deletion of firmware instructions

In an example, a system includes a firmware controller to initiate a SM execution mode of the system. The firmware controller scans memory for a process pool tag. The firmware controller compares the process pool tag to a set of operating system process pool tags and detects a coherency discrepancy between the process pool tag and the set of operating system process pool tags. The firmware controller exits the SM execution mode of the system.

System management memory coherency detection

An example computing device includes a user interface, a network interface, a non-volatile memory, a processor coupled to the user interface, the network interface, and the non-volatile memory, and a set of instructions stored in the non-volatile memory. The set of instructions, when executed by the processor, is to perform a hardware initialization of the computing device according to a setting, establish a local trust domain and a remote trust domain, use a local-access public key to issue a challenge via the user interface to grant local access to the setting, and use a remote-access public key to grant remote access via the network interface to remote access to the setting.

Access to firmware settings with asymmetric cryptography

An example non-transitory computer readable storage medium comprising instructions that when executed cause a processor of a computing device to: in response to a trigger of a system management mode (SMM), verify all processor threads have been pulled into the SMM; in response to a successful verification, enable write access to a non-volatile memory of the computing device via two registers, where the writing access is disabled upon booting of the computing device; and upon exiting the SMM, disable the write access via the two registers.

Non-volatile memory write access control

In an example implementation according to aspects of the present disclosure, a method may include randomly generating a value, illustrating a code containing the value, and scanning for a device advertising a service that is to use the value. Upon discovering the device advertising the service that is to use the value, the method may include associating with the device by connecting to the service and exchanging information with the device.

Association between devices

An example computing device includes a memory accessible at startup of the computing device, a buffer, and a set of instructions. The memory stores a configuration setting that is configurable by the application of a change request. The memory also stores a first public key and a second public key. The buffer stores change requests submitted by a remote entity, including a first change request to make a first setting change and a second change request to make a second setting change. The first change request is signed by a first private key corresponding to the first public key, and the second change request is signed by a second private key corresponding to the second public key. The set of instructions retrieves a change request from the buffer, determines whether the change request is authenticated by a public key, and if authenticated, applies the change request.

Signed change requests to remotely configure settings

Examples associated with network compliance detection are described. One example includes storing a set of security rules for a device. The device monitors the device for compliance with the security rules. Upon detecting noncompliance with an identified security rule, the device may disable network access for the device, and establish a trigger. The trigger may disable network access for the device when network access for the device is restored prior to returning the device to compliance with the identified security rule.

Network device compliance

In some examples, a device includes a processor, a core hardware logic to execute instructions to perform a task in the device, and a controller separate from the processor. The controller detects corruption of the instructions, and in response to detecting the corruption, load a recovery code to the core hardware logic to trigger recovery of the core hardware logic from the corruption of the instructions.

Recovery from corruption

A controller that is separate from a processor of the system verifies controller code for execution on the controller. In response to verifying the controller code, the controller verifies system boot code.

Verifying controller code

An example computing device includes a memory to store a cryptographic key, a processor coupled to the memory, and a set of instructions stored in the memory. The set of instructions, when executed by the processor, is to capture an encrypted passcode originating from a basic input/output system (BIOS) of a managed device as a challenge to grant local access to the BIOS and authenticate with a server using a user credential. When authentication with the server is successful, the set of instructions is to decrypt the encrypted passcode with the cryptographic key to obtain a decrypted passcode and output the decrypted passcode. When authentication with the server is unsuccessful, the set of instructions is to delete the cryptographic key.

Cryptographic access to bios

Examples herein disclose monitoring an expected functionality upon execution of a system management mode (SMM) code. The examples detect whether a change has occurred to the SMM code based on the monitoring of the expected functionality. The change indicates that the SMM code is compromised.

Detecting a change to system management mode bios code

In an example implementation according to aspects of the present disclosure, a method may include receiving by a controller a BIOS image, extracting a current manufacturing programming mode state corresponding to a computer system. A BIOS personality of the BIOS image is evaluated, wherein the BIOS personality is based on a differentiation of hardware and software functionality. Based on the current manufacturing programming state and the BIOS personality, a compatibility with the computer system is determined. Based on the compatibility, the BIOS image is written to non-volatile memory.

BIOS personalities

Growing community of inventors

Cypress, TX, United States of America

Valiuddin Y Ali