On-the-fly physical memory encryption [4] such as the one presented in [17]
would not help here. However, a cryptographic technique using message authen-
tication codes (MAC) or signature schemes could guaranty SMI handler code
authenticity and integrity. To do so, the processor must be able to securely store
keys and certificates. Such countermeasures would require drastic changes in the
processor or motherboard structures.
More specific methods may be used. One obvious countermeasure would be
to set the D LCK bit as early as possible. Ideally, this should be done by the
. Most BIOSes do not seem to care to do so. Changing this in future PCs
Unless explicitly configured not to lock the register (to be compatible with operating
systems that would actually use SMM).
may seem easy, but updating BIOSes in every currently-used PC could be quite
challenging. Another possibility would be to patch the operating system so that
it sets the bit itself if necessary.
In the particular case of OpenBSD, the easiest workaround (if graphical mode
is not needed) would be for the local administrator to permanently set the al-
lowaperture variable to 0. Wherever this would not be accepted for ergonomy
reasons, the display server should be launched during boot sequence, and the
kernel should be patched so that it is impossible for the display server to be
killed. This could be done by preventing the X server from receiving dangerous
signals from processes other than init.

### Language ###
English

### Assessment ###
The text mentions MAC as a security solution, so we could ask about what MAC means in cybersecurity.

### Query ###
What does MAC stand for in computer security?
What does MAC stand for in computer security?