CROSS-REFERENCE TO RELATED APPLICATIONS

N/A

BACKGROUND

BIOS is the first software that is executed on the central processing unit (CPU) when a computing system is powered on. The primary task of the BIOS is to initialize the hardware and load the operating system (OS). For purposes of this specification and the claims, the term “firmware” should be construed as encompassing conventional (legacy) BIOS, Unified Extensible Firmware Interface (UEFI) BIOS and any other similar firmware that is used to boot a computing system and is intended to be distinguishable from the operating system. For example, on a Dell computing system, Dell may provide much of the firmware for booting the Windows operating system.

FIG. 1represents the boot process that the firmware performs on a computing system.FIG. 1is intended to encompass both conventional BIOS and UEFI boot processes but will be described primarily in the context of the UEFI.FIG. 1depicts hardware110which can represent all of the various types of hardware that may exist on a computing system including flash111. Flash111, which may be in the form of Serial Peripheral Interconnect (SPI) flash, is commonly employed to store the boot block. The boot block is the initial firmware that is loaded and executed when the computing system is powered on or resets (e.g., the code that the reset vector points to). Flash111may also typically store other portions of the firmware (e.g., UEFI variables).

During the PEI phase, PEIM modules (or drivers) are loaded to initialize the low level hardware such as the system memory. Additional UEFI services are also loaded and provide an interface for subsequent stages including the Driver Execution Environment (DXE) phase in which UEFI drivers are loaded to perform a variety of tasks. The boot process will then transition to the Boot Device Selection (BDS) phase where the GUID Partition Table (GPT) or Master Boot Record (MBR) is accessed to identify and load the OS boot loader. The OS boot loader will then load the OS kernel and transfer control the OS.

During this boot process, the firmware typically generates a number of firmware tables that provide information about the computing system. For example,FIG. 2provides a simplified example of a number of firmware tables that may be generated in memory205of a computing system200during the boot process including a BIOS information table, a system information table, a base board information table, a chassis information table, an OEM strings table, a memory device table, a processor table, a portable battery table, a system power supply table, etc. In addition to generating such firmware tables during the boot process, the firmware causes these firmware tables to remain accessible after the operating system is loaded. The operating system, in turn, typically provides functionality to enable applications, services or other components to read these firmware tables. For example, Windows provides a number of Windows Management Instrumentation (WMI) classes that could be used to read these or other firmware tables.

As represented inFIG. 2, the firmware tables that the firmware generates during the boot process may define one or more identifiers that could be used either individually or in combination to uniquely identify computing system200. For purposes of this specification and the claims, the term “unique identifiers” will be used to represent any combination of one or more identifiers that the firmware makes available while the operating system is loaded.

Because the unique identifiers remain accessible after the operating system is loaded, they could be used to bypass mechanisms for anonymizing computing system200. As an example,FIG. 3represents a scenario where a webpage loaded in a browser on computing system200could employ any suitable operating-system-provided functionality to read the system information table to identify the manufacturer, product name and serial number of computing system200. The webpage could then relay these “unique identifiers” to a tracker on a server which could then employ the unique identifiers to track computing system200's internet activity. In this way, even if the operating-system-level components on computing system200are configured to prevent such tracking (e.g., by using incognito mode in the browser, by blocking cookies, by hiding computing system200's MAC address, etc.), tracking will not be prevented.

BRIEF SUMMARY

The present invention extends to methods, systems, and computer program products for preventing discovery of unique identifiers in firmware. By preventing discovery of the unique identifiers, embodiments of the present invention can prevent tracking or otherwise anonymize a computing system. During the boot process on a computing system, and after the firmware has generated firmware tables containing unique identifiers, an anonymizer module of the firmware can generate an anonymized version of the firmware tables and cause the anonymized version of the firmware tables, rather than the original, system-unique firmware tables, to be accessible after the operating system is loaded. In this way, once the operating system is loaded, when a module attempts to read the firmware tables, the read will be performed against the anonymized version of the firmware tables thereby preventing the module from obtaining any of the computing system's unique identifiers.

In some embodiments, the anonymizer module may also be configured to retain a copy of the firmware tables in addition to the anonymized version of the firmware tables. In such cases, the anonymizer module can be configured to evaluate a request to read the firmware tables and, when the request is made by an authorized module, process the request against the copy of the original, system-unique firmware tables. In contrast, when the request is made by an unauthorized module, the anonymizer module can process the request against the anonymized version of the firmware tables.

In some embodiments, the present invention may be implemented as a method for preventing discovery of unique identifiers in firmware. During a boot process on a computing system, a firmware table that includes one or more unique identifiers of the computing system can be identified. An anonymized version of the firmware table can be created by replacing at least one of the one or more unique identifiers with an anonymized identifier. The anonymized version of the firmware table rather than the firmware table can then be made accessible to an operating system.

In some embodiments, the present invention may be implemented as computer storage media storing computer executable instructions which when executed on a computing system perform a method for preventing discovery of unique identifiers in firmware. This method may include, after a firmware table has been generated, creating an anonymized version of the firmware table, and causing the anonymized version of the firmware table rather than the firmware table to be accessible to an operating system.

In some embodiments, the present invention may be implemented as a computing system that includes one or more processors, memory and firmware that includes an anonymizer module that is configured to prevent discovery of unique identifiers in the firmware. The anonymizer module can identify one or more firmware tables that have been generated in the memory. For each of the one or more firmware tables, the anonymizer module can create an anonymized version of the firmware table. The anonymizer module may also store a copy of each of the firmware tables separately from the anonymized version of each of the one or more firmware tables.

This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter.

