Method and apparatus for firmware authentication

Claim 2

A boot PROM (programmable read only memory) having programming instructions for initializing a computer system containing the boot PROM, the boot PROM comprising: a software programmable data section having a plurality of micro-code configured to initialize the computer system; and an authentication section having a hash generator configured to generate a data hash of the plurality of micro-code programmed in the software programmable data section, wherein the authentication section authenticates the plurality of micro-code with the data hash to authorize execution of the plurality of micro-code.

Claim 3

The boot PROM according to claim 1, wherein: the software programmable data section includes a predetermined signature; and the authentication section includes a predetermined public key and a decryptor configured to provide a verification hash from the predetermined signature and the public key.

Claim 4

The boot PROM according to claim 2, wherein the authentication section includes a comparator configured to compare the data hash with the verification hash to authenticate the plurality of micro-code of the software programmable data section.

Claim 5

The boot PROM according to claim 2, wherein the predetermined signature includes an encryption of a private key and an initial hash of a plurality of initial micro-code programmed to the software programmable data section.

Claim 6

The boot PROM according to claim 1, wherein the authentication section includes a plurality of trusted micro-code configured to initiate execution of the plurality of micro-code of the software programmable data section in response to proper authentication of the plurality of micro-code.

Claim 7

The boot PROM according to claim 5, wherein the proper authentication of the micro-code programmed in the software programmable data section by the authentication section raises the plurality of micro-code to a level of trusted code.

Claim 8

The boot PROM according to claim 1, wherein the software programmable data section includes a flash memory configured to enable software reprogramming of the plurality of micro-code.

Claim 9

The boot PROM according to claim 1, wherein the authentication section includes a ROM (read only memory).

Claim 12

The method of operating a boot PROM according to claim 9, wherein: the software programmable data section includes a predetermined signatures; and the step of authenticating includes generating a verification hash from the predetermined signature and a public key stored in the authentication section of the boot PROM.

Claim 13

The method of operating a boot PROM according to claim 10, wherein the step of authenticating includes comparing the data hash with the verification hash to authenticate the plurality of micro-code of the software programmable data section.

Claim 14

The method of operating a boot PROM according to claim 10 further comprising the step of encrypting with a private key an initial hash of a plurality of initial micro-code programmed to the software programmable data section to provide the predetermined signature.

Claim 15

The method of operating a boot PROM according to claim 9, wherein the authentication section includes a plurality of trusted micro-code, further comprising the step of: propagating a level of trust to the plurality of micro-code of the software programmable data section in response to proper authentication of the plurality of micro-code.

Claim 16

The method of operating a boot PROM according to claim 9, wherein the software programmable data section includes a flash memory, further comprising the step of: reprogramming the plurality of micro-code in the software programmable data section.

Claim 17

The method of operating a boot PROM according to claim 9 wherein the authentication section includes a ROM (read only memory).

Claim 18

A memory module for initializing a computer system, comprising: a programmable section configured to store: a set of initialization instructions which, when executed by a processor, initialize a computer system in which the memory module and processor are installed; and a digital signature of said set of initialization instructions, wherein said digital signature is generated by encrypting a verification hash of said set of initialization instructions with a private encryption/decryption key; and a read-only section configured to store: a public encryption/decryption key corresponding to the private encryption/decryption key; a decryptor configured to decrypt said digital signature with said public encryption/decryption key to reproduce said verification hash; a hash generator configured to generate a test hash from said set of initialization instructions; a comparator configured to compare said test hash and said verification hash; and a set of trusted micro-code configured to execute before the computer system is operable by a user; wherein, upon execution of said trusted micro-code, said initialization instructions are executed if said test hash matches said verification hash.

Claim 19

A memory module for initializing a computer system, comprising: a programmable section configured to store: a set of initialization instructions which, when executed by a processor, initialize a computer system in which the memory module and processor are installed; and a digital signature of said set of initialization instructions, wherein said digital signature is generated by encrypting a verification hash of said set of initialization instructions with a private encryption/decryption key; and a read-only section configured to store: a public encryption/decryption key corresponding to the private encryption/decryption key; a decryptor configured to decrypt said digital signature with said public encryption/decryption key to reproduce said verification hash; a hash generator configured to generate a test hash from said set of initialization instructions; a comparator configured to compare said test hash and said verification hash; and a set of trusted micro-code configured to execute before the computer system is operable by a user; wherein, upon execution of said trusted micro-code, said initialization instructions are executed if said test hash matches said verification hash.