2022/08/31

[Michael Kubacki (makubacki)]

Right now, we are in the "brainstorming" phase of what this will look like.

Areas brought up to consider:

• Ability to evict UEFI variables based on data prioritization
  • Define the eviction policy
  • Associate the policy with the backend store?
• Apply different properties to different variable stores
• Compression
• Data integrity
• Encryption
• Fault tolerance
• Include variable policy in variable creation
  • Have a default policy - make the default very strict so people are forced to adjust it
• Iterative development
• Multiple variable stores
• OS attack of UEFI variables - policy around variables at OS Runtime
• Offload engines
• Protection against physical attack
• Replay protection
• Rust implementation of UEFI variables
• SMM - Can we get rid of it? Minimize its impact?
• Settings configuration / profiles - InTune, DFCI
• Test driven UEFI variable development
• Traceability
• Variable policy like protection and the OS / UEFI Spec
• Variable routing
  • Abstraction of variable backend stores
• Write ability in PEI