Technologies for performing a secure firmware update include a compute device that includes a memory device to store firmware update payload, one or more devices that have direct memory access (DMA) to the memory, a DMA remap module, and a firmware update module. The DMA remap module is to create a memory isolation domain for each of the one or more devices. Each memory isolation domain comprises a physical address space in the memory that is mutually exclusive to the physical address spaces of the other memory isolation domains. The firmware update module is to (i) analyze the firmware update payload to identify one or more of the devices associated with the firmware update payload and (ii) move the firmware update payload to the memory isolation domains of each associated device to enable secure transmission of the firmware update payload to the associated devices.

Technologies for securing a firmware update

Aspects of the disclosed technology relate to ways to determine the optimal storage of data structures across different memory device is associated with physically disparate network nodes. In some aspects, a process of the technology can include steps for receiving a first retrieval request for a first object, searching a local PMEM device for the first object based on the first retrieval request, in response to a failure to find the first object on the local PMEM device, transmitting a second retrieval request to a remote node, wherein the second retrieval request is configured to cause the remote node to retrieve the first object from a remote PMEM device. Systems and machine-readable media are also provided.

Accessing composite data structures in tiered storage across network nodes

Embodiments detailed herein describe a system comprising a manageability server to generate an encrypted sideband message having at least one command; a server including: a radio frequency identification (RFID) device, the RFID device to include storage to store at least one encrypted sideband message having at least one command, and a security circuit coupled to the RFID device, the security circuit to: retrieve at least one encrypted sideband message from the RFID device storage, decrypt the one encrypted sideband message, determine validity of the decrypted sideband message using information from the decrypted sideband message, and perform an action in response to the at least one command.

Systems, apparatuses, and methods for platform security

A method includes receiving a firmware update package at an information handling system. The update package includes a payload containing a transition basic input-output system (BIOS) and another payload containing a new BIOS. The new BIOS is stored at an Extensible Firmware Interface system partition (ESP). A firmware image at a BIOS flash device at the information handling system is updated using the new BIOS retrieved from the ESP.

Multi-stage firmware update method and system therefor

Approaches for securing a host machine against security attacks conducted using Direct Memory Access (DMA). Platform firmware does not enable bus mastering during PCI bus enumeration. When the platform firmware determines that an expansion card has been plugged into an expansion card slot of the host machine, the platform firmware determines whether the expansion card slot has been approved by a user of the host machine for permitting Direct Memory Access (DMA) with the host machine. Unless the expansion card slot has been determined to be approved by the user for permitting Direct Memory Access (DMA) with the host machine, the platform firmware does not allow drivers that might enable DMA to connect to the device and does not grant permission to the expansion card slot and any upstream bridges to conduct Direct Memory Access (DMA) with the host machine.

Securing a host machine against direct memory access (DMA) attacks via expansion card slots

Systems and methods are provided that may be implemented to systems and methods that may be implemented to utilize direct memory access (DMA) remapping to control firmware updates and/or other configuration changes or device access control protocol for devices of an information handling system during the Unified Extensible Firmware Interface (UEFI) pre-boot phase before the booting the operating system (OS). The disclosed systems and methods may use DMA remapping during UEFI pre-boot to determine whether to allow or disallow pre-boot firmware updates and/or device configuration for hardware devices, and may be performed in the presence or absence of UEFI Secure Boot.

Systems and methods for secure multi-access of system firmware during pre-boot

An Information Handling System (IHS) has persistent memory device(s) coupled to a processor. Each memory device includes a first firmware image, version identifying information associated with the first firmware image, and device type identifying information. A firmware interface suite coupled to the processor has a firmware interface that is executed by the processor. The processor responds to identifying a trigger condition for automatic intra-system firmware update of a persistent memory device. The processor accesses the version identifying information and the device type identifying information for a first memory device containing the first firmware image of the persistent memory device(s). The processor associates the device type identifying information with device type information for a second memory device. In response to the first firmware image being different from the second firmware image, the processor selectively replaces the first firmware image on the first memory device with the second firmware image.

Automated intra-system persistent memory updates

An information handling system for enhanced system management mode (SMM) security may include a processor, system management random access memory (SMRAM), persistent memory, and basic input/output (BIOS) memory. The system may include instructions that, when loaded and executed by the processor, cause the processor to initialize the memory, initialize the BIOS memory, initialize the persistent memory, and check whether the system has previously executed a power-on self test (POST) routine. Based on a determination that the system has not previously executed a POST routine, the processor may unzip the SMM Code located in the BIOS memory store the unzipped SMM Code in the persistent memory and in the SMRAM. Based on a determination that the system has previously executed a POST routine, the processor may create a duplicate copy of the SMM Code from the persistent memory and store the duplicate copy in the SMRAM. The processor may further initialize the SMRAM, lock the SMRAM, and hide the SMM Code stored in the persistent memory.

Nijhawan Vijay B

Papers

Systems and methods for secure multi-access of system firmware during pre-boot

Automated intra-system persistent memory updates

System and method for enhanced security and update of smm to prevent malware injection