UEFI-enabled Web3 Ecosystem for Device as a Service

Abstract

The growing digitalization of sectors such as education, healthcare, and public administration has driven Device-as-a-Service (DaaS) models. In the Portuguese educational context, the "Escola Digital" program is a clear example of this transformation, scaling the distribution and remote management of devices. With the massification of computer systems, risks of theft, misuse, and unauthorized configurations arise, exacerbated by profiles with low digital literacy (e.g., primary school students). Therefore, an agile and secure mechanism is needed to prevent or mitigate these issues before the operating system boots. Despite several proposals in the literature for device management and protection, existing solutions typically operate after boot, leaving a window open for attackers to exploit. This dissertation addresses this gap by introducing a UEFI module capable of querying and validating (cryptographically) the device’s state on a blockchain infrastructure before boot, reducing the attack surface and simplifying operational response. This dissertation investigates the feasibility of integrating a component into the UEFI firmware capable of communicating with a blockchain infrastructure to enhance device security and control during pre-boot. Specifically: (i) design a module that interacts with the blockchain before the operating system boots; and (ii) explore cryptographic mechanisms to verify the authenticity and integrity of received information.A UEFI module (EDK II) that queries the blockchain to obtain device status and enforce pre-boot lock/unlock policies is proposed and prototyped. The solution utilizes lightweight cryptographic mechanisms (authentication and anti-replay) and a key management and temporal lease scheme. The evaluation considers the impact on boot time, network latency, and on-chain cost. The results demonstrate technical feasibility, with modest boot overhead and reliable enforcement of control policies before the operating system boots.