Copyright
©
2014
congatec
AG
TS87m13
121/124
Only the congatec utility interface to the SMI handler of the BIOS flash update is enabled. Other interfaces to the SMI handler are disabled to
prevent non congatec tools from writing to the BIOS flash. As a result of this restriction, flash utilities supplied by AMI or Intel will not work .
UEFI Secure Boot
Secure Boot is a security standard defined in UEFI specification 2.3.1 that helps prevent malicious software applications and unauthorized
operating systems from loading during system start up process. Without secure boot enabled (not supported or disabled), the computer
simply hands over control to the bootloader without checking whether it is a trusted operating system or malware. With secure boot supported
and enabled, the UEFI firmware starts the bootloader only if the bootloader’s signature has maintained integrity and also if one of the following
conditions is true:
•
The bootloader was signed by a trusted authority that is registered in the UEFI database.
•
The user has added the bootloader’s digital signature to the UEFI database. The BIOS provides the key management setup sub-menu for
this purpose.
Note
The congatec BIOS by default enables CSM (Compatibility Support Module) and disables secure boot because most of the industrial computers
today boot in legacy (non-UEFI) mode. Since secure boot is only enabled when booting in native UEFI mode, you must therefore disable the
CSM (compatibility support module) in the BIOS setup to enable Secure Boot.
A full description of secure boot is beyond the scope of this users guide. For more information about how secure boot leverages signature
databases and keys, see the secure boot vverview in the windows deployment options section of the Microsoft TechNet Library at http://
technet.microsoft.com.
11.7.1.2
Hard Disk Security Features
Hard Disk Security uses the Security Mode feature commands defined in the ATA specification. This functionality allows users to protect data
using drive-level passwords. The passwords are kept within the drive, so data is protected even if the drive is moved to another computer
system.
The BIOS provides the ability to ‘lock’ and ‘unlock’ drives using the security password. A ‘locked’ drive will be detected by the system, but no
data can be accessed. Accessing data on a ‘locked’ drive requires the proper password to ‘unlock’ the disk.
The BIOS enables users to enable/disable hard disk security for each hard drive in setup. A master password is available if the user can not
remember the user password. Both passwords can be set independently however the drive will only lock if a user password is installed. The
max length of the passwords is 32 bytes.
During POST each hard drive is checked for security mode feature support. In case the drive supports the feature and it is locked, the BIOS
prompts the user for the user password. If the user does not enter the correct user password within four attempts, the user is notified that the
