Using TPM to improve boot security at BIOS layer

Boot security is fundamental to system security of PC and PC-based consumer products. Current BIOS exploits TPM to establish a trusted boot. However, it does not mean a secure boot. That is, the TPM does not prohibit booting into an insecure OS or using an insecure boot loader. In this work, we extend TPM BIOS interrupt calls to support (1) performing RAS encryption and decryption and (2) accessing the NVRAM. Furthermore, the following techniques were implemented in BIOS to improve boot security: (1) enhancing the security of the encrypted BIOS password using TPM RSA engine instead of conventional encryption techniques, (2) storing the encrypted password to TPM NVRAM such that an attacker can not clear it by removing the battery, (3) always authenticating BIOS password before passing control to OS boot-loader and (4) using TPM SHA-1 engine to verify data integrity of the full MBR and determine if the booting continues.