Abstract: Communications, such as system event log messages, can be authenticated using a secondary message, as may be sent over a common channel. Each secondary message can be a copy of a corresponding primary message signed with a hash, where that hash can be generated using a secret, such as a secret key. In some embodiments, the secret can be stored in BIOS where the messages are generated, such that an operating system executing on a computing device cannot access the secret in order to send valid secondary messages that match content of the corresponding first messages.

Abstract: Communications, such as system event log messages, can be authenticated using a hash value included in the messages. In some embodiments, the hash can be generated using secret hash parameters to generate a hash of the prior message in the sequence. The hash is stored to BIOS memory that is inaccessible, or at least not exposed, to an operating system executing on the computing device. A recipient, such as the BMC on the computing device, receiving these messages over an appropriate interface can compare the received and expected hash values in order to attempt to authenticate those messages. Authenticated messages can be processed, while unauthenticated messages can be dropped and remedial action taken as appropriate.

Abstract: Vulnerabilities to physical memory, such as server dynamic random access memory (DRAM) with error correction code (ECC) capability, can be mitigated though the use of guard pages allocated in that physical memory. Physical memory pages can be mapped to virtual memory pages of a contiguous virtual address space. When an error such as a bit flip is detected in a physical memory page, the data from that physical memory page can be copied to a protected page, such as a guard page or page isolated from other sensitive data. Information such as an error correction code (ECC) can be used to determine and correct the erroneous bit. The mappings in a related page table can be updated such that the same virtual pages or addresses are then mapped to the guard page that now includes the relevant data.