Abstract: Systems and methods for establishing Core Root of Trust Measurement (CRTM) for Basic Input/Output (BIOS) image recovery are described. In some embodiments, an Information Handling System (IHS) may include a processor and a BIOS coupled to the processor, the BIOS having program instructions that, upon execution, cause the IHS to: during a boot process, verify integrity of a BIOS recovery image using a CRTM, and determine whether to restore the BIOS recovery image in response to the verification.

Abstract: In one or more embodiments, one or more systems, methods, and/or processes may obtain first multiple samples of a signal conveyed via a coupling of a memory medium of an information handling system; may convert the first multiple samples to respective first multiple digital values; may determine an impedance based at least on the first multiple digital values; may compare the impedance with a baseline impedance; may determine an inconsistency based at least on comparing the impedance with the baseline impedance of the coupling of the memory medium; and may, in response to determining the inconsistency, shut down the information handling system.

Abstract: Configuration options to be displayed at a basic input/output system (BIOS) setup interface of an information handling system are specified using a software application executed at the system. The configuration options are communicated to a software agent, and the software agent updates BIOS firmware based on the configuration option.

Abstract: Systems and methods for establishing Core Root of Trust Measurement (CRTM) for Basic Input/Output (BIOS) image recovery are described. In some embodiments, an Information Handling System (IHS) may include a processor and a BIOS coupled to the processor, the BIOS having program instructions that, upon execution, cause the IHS to: during a boot process, verify integrity of a BIOS recovery image using a CRTM, and determine whether to restore the BIOS recovery image in response to the verification.

Abstract: An information handling system includes a processor operable to provide a branch trace message, and an embedded controller coupled to the processor via a primary interface and via a management interface. The embedded controller receives a management transaction from the processor via the primary interface. In response to receiving the management transaction, the embedded controller requests the branch trace message via the management interface and determines if the processor is operating in a system management mode based upon the branch trace message.

Abstract: Methods and systems for license management using a basic input/output system (BIOS) may involve performing license activation, monitoring, and enforcement. The BIOS may store license information to manage licenses for hardware and/or software components of an information handling system. License management by the BIOS may include monitoring a system clock of the information handling system for changes to avoid tampering with license durations.

Abstract: Methods and systems for generating and using a BIOS security display include determining whether a change in a BIOS user setting is associated with security of an information handling system. When the BIOS user setting is associated with security, a security level for the BIOS may be calculated based on weighted security values for BIOS user settings. Security levels for boot phases may also be individually calculated. The security levels may be displayed in the BIOS to the user when the BIOS user setting is changed.

Abstract: A system, method, and computer-readable medium are disclosed for performing a platform security operation, comprising: presenting a platform security user interface, the platform security user interface including a plurality of security blocks, each of the plurality of security blocks corresponding to a particular security policy function configuring a security policy via the platform security user interface, the configuring comprising combining a set of the security blocks according to a desired security function; converting the set of security blocks to information representing the security policy; and, deploying the security policy to an information handling system.

Abstract: Data to be stored at a firmware memory is received. A random symmetric encryption key is generated. The data is encrypted using the generated key to provide encrypted data. The encrypted data and the encryption key are both stored at the firmware memory.

Abstract: An information handling system and method performs Unified Extensible Firmware Interface (UEFI) interception and pre-processing of data associated with block input/output (I/O) commands targeting encrypted storage devices. A UEFI interceptor block (IB) I/O driver intercepts each block I/O command targeting block addresses on a storage device and identifies whether any of the target block addresses is encrypted. In response to identifying an encrypted block address among the target block addresses, the UEFI IB I/O driver forwards data associated with the encrypted block address to an encryption-decryption module to perform one of an encryption and a decryption of the data. Final handling of the block I/O command is performed using a block I/O driver chained to the UEFI IB I/O driver. Data associated with I/O commands targeting encrypted block addresses is first processed by the encryption-decryption module before final handling of the I/O command is performed by the block I/O driver.

Abstract: A BIOS delivery installation package includes a basic input/output system (BIOS) update payload including a BIOS image. The BIOS delivery installation package also includes a first hash corresponding to a portion of the BIOS image.

Abstract: A method recovers an information handling system (IHS) from a non-operational state. The method includes determining if the non-operational state of the IHS has occurred. In response to determining that the non-operational state of the IHS has occurred, a basic input-output (BIOS) recovery device is identified as being coupled to an embedded controller. In response to identifying that the BIOS recovery device is coupled to the embedded controller, an IHS type is transmitted to the BIOS recovery device. The BIOS recovery device is signaled to determine if the BIOS recovery device contains a BIOS payload corresponding to the IHS type. In response to determining that the BIOS recovery device contains the BIOS payload corresponding to the IHS type, the BIOS recovery device is triggered to transmit the BIOS payload to the embedded controller. The IHS is triggered to restart using the new BIOS payload.

Abstract: An information handling system includes a processor operable to receive a system management interrupt, and an embedded controller coupled to the processor via a primary interface and via a system management interrupt interface. The embedded controller receives a command to enable address decoding from the processor via the primary interface, sends the system management interrupt via the system management interrupt interface in response to receiving the command, and receives an indication from the processor via the primary interface, the indication including a determination if the processor was operating in a system management mode when the processor sent the command.

Abstract: An information handling system and method performs Unified Extensible Firmware Interface (UEFI) interception and pre-processing of data associated with block input/output (I/O) commands targeting encrypted storage devices. A UEFI interceptor block (IB) I/O driver intercepts each block I/O command targeting block addresses on a storage device and identifies whether any of the target block addresses is encrypted. In response to identifying an encrypted block address among the target block addresses, the UEFI IB I/O driver forwards data associated with the encrypted block address to an encryption-decryption module to perform one of an encryption and a decryption of the data. Final handling of the block I/O command is performed using a block I/O driver chained to the UEFI IB I/O driver. Data associated with I/O commands targeting encrypted block addresses is first processed by the encryption-decryption module before final handling of the I/O command is performed by the block I/O driver.

Abstract: Methods and systems for license management using a basic input/output system (BIOS) may involve performing license activation, monitoring, and enforcement. The BIOS may store license information to manage licenses for hardware and/or software components of an information handling system. License management by the BIOS may include monitoring a system clock of the information handling system for changes to avoid tampering with license durations.

Abstract: Methods and systems for generating and using a BIOS security display include determining whether a change in a BIOS user setting is associated with security of an information handling system. When the BIOS user setting is associated with security, a security level for the BIOS may be calculated based on weighted security values for BIOS user settings. Security levels for boot phases may also be individually calculated. The security levels may be displayed in the BIOS to the user when the BIOS user setting is changed.

Abstract: An information handling system and method performs Unified Extensible Firmware Interface (UEFI) interception and pre-processing of data associated with block input/output (I/O) commands targeting encrypted storage devices. A UEFI interceptor block (IB) I/O driver intercepts each block I/O command targeting block addresses on a storage device and identifies whether any of the target block addresses is encrypted. In response to identifying an encrypted block address among the target block addresses, the UEFI IB I/O driver forwards data associated with the encrypted block address to an encryption-decryption module to perform one of an encryption and a decryption of the data. Final handling of the block I/O command is performed using a block I/O driver chained to the UEFI IB I/O driver. Data associated with I/O commands targeting encrypted block addresses is first processed by the encryption-decryption module before final handling of the I/O command is performed by the block I/O driver.

Abstract: In accordance with embodiments of the present disclosure, a method may include generating a master cryptographic key for encrypting and decrypting the one or more variables stored in a non-transitory computer-readable medium accessible to a basic input/output system of an information handling system. The method may also include encrypting the master cryptographic key with a system password, such that the master cryptographic key as encrypted with the system password may be decrypted and used to encrypt and decrypt the one or more variables in response to entry by a user of the system password. The method may further include encrypting the master cryptographic key with an administrator password, such that the master cryptographic key as encrypted with the administrator password may be decrypted and used to encrypt and decrypt the one or more variables in response to entry by an administrator of the administrator password.

Abstract: Methods and systems for license management using a basic input/output system (BIOS) may involve performing license activation, monitoring, and enforcement. The BIOS may store license information to manage licenses for hardware and/or software components of an information handling system. License management by the BIOS may include monitoring a system clock of the information handling system for changes to avoid tampering with license durations.

Abstract: A BIOS delivery installation package includes a basic input/output system (BIOS) update payload including a BIOS image. The BIOS delivery installation package also includes a first hash corresponding to a portion of the BIOS image.