An apparatus to facilitate descriptor resiliency in a computer system platform is disclosed. The apparatus comprises a non-volatile memory to store firmware for a computer system platform, wherein the firmware comprises a primary descriptor including access permission details for platform components and a secondary descriptor including a backup copy of the access permission details and a controller, coupled to the first non-volatile memory, including recovery hardware to detect a problem during a platform reset with the primary descriptor, recover the contents of the primary descriptor from the backup copy included in the secondary descriptor and store the contents of the backup copy to primary descriptor.

Mobile device security, device management, and policy enforcement are described in a cloud-based system where the “cloud” is used to pervasively enforce security and policy and perform device management regardless of device type, platform, location, etc. A method includes receiving one or more mobile profiles for one or more mobile devices each associated with a user from an enterprise; responsive to enrollment of a mobile device of the one or more mobile devices, communicating to the mobile device; determining an associated mobile profile of the one or more mobile profiles for the mobile device; and configuring the mobile device based on the associated mobile profile.

A method in a communication device, and a communication device, for executing a software updating process at the communication device is suggested, where the method is executed by acquiring data captured by at least one sensor which is accessible to the communication device, by comparing the acquired data to predefined conditions for initiating a software updating process, and by initiating the software updating process at the communication device in response to determining that the acquired data meet with predefined conditions for updating software at the communication device.

An example computing device includes: a storage device; a first controller to retrieve basic input/output system (BIOS) instructions, including a set of filter criteria, from the storage device, and execute the BIOS instructions to: detect a command to change a set of BIOS variables associated with the BIOS instructions; store the command in a log; compare a payload of the command with the set of filter criteria; and accept or reject the change to the set of BIOS variables according to the comparison.

The embodiments of the present disclosure provide a firmware data verification device and method, and a firmware updating device, method and system. The verification method includes: receiving first firmware data sent by a data generation device, wherein the first firmware data includes second firmware data encrypted by the data generation device and a digital signature; verifying the digital signature of the first firmware data; in the situation in which the digital signature has been verified, removing the digital signature from the first firmware data so as to obtain the second firmware data; splitting the second firmware data so as to generate a plurality of encrypted data packets; and sending the plurality of encrypted data packets to a firmware updating device, so that the firmware updating device decrypts the plurality of data packets and performs firmware updating. Therefore, the hardware cost of a firmware updating device may be reduced, and the updating efficiency is improved; in addition, the flexibility of a firmware updating mode may be improved.

Examples of computing devices are described herein. In some examples, a computing device may include a controller to generate a key upon boot of the computing device. In some examples, the computing device may include a kernel driver. In some examples, the kernel driver may be to receive the key from a basic input/output system (BIOS) during operating system (OS) boot. In some examples, the kernel driver may be to receive an action request for a BIOS action from an application. In some examples, the kernel driver may be to sign the action request with the key in response to determining that the application is authorized to request the BIOS action. In some examples, the computing device may include the BIOS to perform the BIOS action in response to receiving the signed action request.

A method includes (a) receiving i-th data among first to n-th data transmitted in a multicast manner from a firmware providing apparatus, (b) acquiring partitioning information thereof, a MAC chaining value, length information, i-th firmware data, and MAC from the i-th data, (c) authenticating the MAC chaining value of the i-th firmware data, the length information, and the i-th firmware data by comparing a MAC of the i-th firmware data with a value computed by a first MAC generation algorithm, which uses the MAC chaining value of the i-th firmware data, the length information, and the i-th firmware data as a relevant input; (d) authenticating the order of the i-th firmware data by using the MAC chaining value of the i-th firmware data and a second MAC generation algorithm; and (e) obtaining the firmware by combining a first to an n-th firmware data obtained by executing (a) to (d).

An apparatus comprises a processing device configured to determine, utilizing a firmware-based agent running in firmware, a boot flag status during a boot process of the processing device. The processing device is also configured to execute, responsive to the boot flag status being a first value, a system update handler of the firmware-based agent configured for provisioning of a secured runtime operating system on the processing device, wherein the provisioning comprises digitally signing an image of the secured runtime operating system utilizing a hardware-based root of trust key. The processing device is further configured to execute, responsive to the boot flag status being a second value, a secured operating system boot handler of the firmware-based agent configured for validating and loading secured runtime operating system, wherein the validation comprises performing attestation of a signature of the image of the secured runtime operating system utilizing the hardware-based root of trust key.

A method includes receiving, by an embedded universal integrated circuit card (eUICC), first information from a local profile assistant (LPA), where the first information includes a first certificate issuer (CI) public key identifier, and the first CI public key identifier is a CI public key identifier that the eUICC does not have. The method further includes sending, by the eUICC, second information to an OPS, where the second information includes the first CI public key identifier. The method further includes receiving, by the eUICC, a patch package from the OPS, where the patch package includes at least a first CI public key corresponding to the first CI public key identifier. The method further includes updating, by the eUICC, a CI public key of the eUICC by using the first CI public key.

An information handling system may determine a personality flag value during a boot process and execute, responsive to detecting that the information handling system entered a secure environment and based on the personality flag value, a system update handler configured for discovering and connecting to a control plane. The system may also provision a secure ephemeral operating system, including receiving an image of the secure ephemeral operating system from the control plane responsive to a secure profile and validating the image prior to loading the secure ephemeral operating system to a random access memory.