TECHNICAL FIELD

The present disclosure relates in general to information handling systems, and more specifically to binding a secondary operating system of an information handling system to a platform basic input/output system of the information handling system.

BACKGROUND

As the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option available to users is information handling systems. An information handling system generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes thereby allowing users to take advantage of the value of the information. Because technology and information handling needs and requirements vary between different users or applications, information handling systems may also vary regarding what information is handled, how the information is handled, how much information is processed, stored, or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in information handling systems allow for information handling systems to be general or configured for a specific user or specific use such as financial transaction processing, airline reservations, enterprise data storage, or global communications. In addition, information handling systems may include a variety of hardware and software components that may be configured to process, store, and communicate information and may include one or more computer systems, data storage systems, and networking systems.

In some instances, an information handling system may be configured to boot to a secondary operating system (e.g., a service operating system, recovery operating system, or rescue operating system) when it is unable to boot to a primary host operating system of the information handling system. The secondary operating system may either be installed in a hidden partition of an internal storage resource (e.g., hard drive) of the information handling system or in an external storage resource (e.g., a Universal Serial Bus drive) that may be coupled to the information handling system. Such secondary operation system may be configured to perform one or more repair/recovery tasks, including executing diagnostics, repairing a system registry, or reinstalling the primary operating system from a factory image or other source image.

The existence of the secondary operating system may expose an undesirable security vulnerability. For example, a malicious actor may tamper with the secondary operating system such that user data stored on the information handling system may be extracted using tampered code of the secondary operating system. Thus, while user data may be protected by the primary operating system (e.g., by using Windows privileges in the Microsoft Windows operating system), a malicious actor may add malicious code to the secondary operating system code that may serve as a backdoor interface to access user data. Thus, it may be desirable to detect for such malicious code before it executes.

SUMMARY

In accordance with the teachings of the present disclosure, the disadvantages and problems associated with security vulnerabilities of a secondary operating system may be reduced or eliminated.

In accordance with embodiments of the present disclosure, an information handling system may include a processor, non-transitory computer readable media communicatively coupled to the processor and having stored thereon a primary operating system of the information handling system and a secondary operating system of the information handling system, and a basic input/output system communicatively coupled to the processor and having provisioned thereon a signed signature of the secondary operating system signed with a private key of a public-private key pair and a public key of the public-private key pair. The basic input/output system is configured to, responsive to a determination to boot to the secondary operating system in lieu of booting to the primary operating system of the information handling system verify the secondary operating system using the signed signature of the secondary operating system and the public key and responsive to verifying the secondary operating system, allow the information handling system to boot to the secondary operating system.

In accordance with these and other embodiments of the present disclosure, a method may include, in an information handling system comprising non-transitory computer readable media having stored thereon a primary operating system of the information handling system and a secondary operating system of the information handling system and the information handling system further comprising a basic input/output system communicatively having provisioned thereon a signed signature of the secondary operating system signed with a private key of a public-private key pair and a public key of the public-private key pair: responsive to a determination by the basic input/output system to boot to the secondary operating system in lieu of booting to the primary operating system of the information handling system, verifying, with the basic input/output system, the secondary operating system using the signed signature of the secondary operating system and the public key, and responsive to verifying the secondary operating system, allowing, by the basic input/output system, the information handling system to boot to the secondary operating system.

In accordance with these and other embodiments of the present disclosure, an article of manufacture may include a computer readable medium and computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to, in an information handling system comprising non-transitory computer readable media having stored thereon a primary operating system of the information handling system and a secondary operating system of the information handling system and the information handling system further comprising a basic input/output system communicatively having provisioned thereon a signed signature of the secondary operating system signed with a private key of a public-private key pair and a public key of the public-private key pair: responsive to a determination by the basic input/output system to boot to the secondary operating system in lieu of booting to the primary operating system of the information handling system, verify, with the basic input/output system, the secondary operating system using the signed signature of the secondary operating system and the public key, and responsive to verifying the secondary operating system, allow, by the basic input/output system, the information handling system to boot to the secondary operating system.

Technical advantages of the present disclosure may be readily apparent to one skilled in the art from the figures, description and claims included herein. The objects and advantages of the embodiments will be realized and achieved at least by the elements, features, and combinations particularly pointed out in the claims.

It is to be understood that both the foregoing general description and the following detailed description are examples and explanatory and are not restrictive of the claims set forth in this disclosure.

