US6560706B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Interface for ensuring system boot image integrity and authenticity
Assignee: Intel Corp
•
Filing: 1999-01-21
•
Granted: 2003-05-06
•
Expires: 2019-01-21
Abstract
Abstract A method and apparatus for ensuring system boot image integrity and authenticity is described. In one embodiment, the invention provides security from the end of Basic Input/Output System (BIOS) initialization to the point in time at which control is transferred to a high-level operating system (OS). The OS boot image is obtained via a network connection and is checked for integrity and authority to run on a particular platform. For this purpose, the invention provides a boot image security usage model that is simple and flexible enough to cover a variety of needs. Because receipt of boot images via a network connection can be subject to size constraints, the invention allows software to bootstrap more sophisticated security software if desired. In general, the invention utilizes one or more Remote-Boot Authorization Certificates for each group of platforms to be managed. The authorization certificate for a group of platforms is configured into each of the platforms in a group as the source of authority for allowing boot images to be executed. The authorization certificate is also the source of authority for allowing reconfiguration commands, including reconfiguration commands that transfer the source of authority to another authority. In one embodiment, IT organizations can create different authorization certificates for different groups to allow the different groups to be managed by different authorities. Authority can also be transferred between management groups. The Remote-Boot Authorization Certificates provide protection against remote-boot images that have been damaged and/or tampered with either in transit or on a server, the ability to designate and enforce which boot images are permitted, and a mechanism to limit the scope of management authorities having remote-boot authority.
Inventors
- 👤 John M. Carbajal
- 👤 Eric R. Dittert
- 👤 Paul C. Drews
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-01 21:58
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/57; G06F21/572; G06F9/00; G06F9/06; G06F9/44; G06F9/4401; G06F9/4416
Claims Analysis
Total Claims: 42
Claim 1
Independent Claim
83 words
A method of performing remote boot operations, the method comprising: receiving a first segment of a boot image from a remote device; verifying integrity of the first segment of the boot image; determining authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image; and executing a sequence of instructions represented by the first segment of the boot image.
Claim 2
Independent Claim
83 words
A method of performing remote boot operations, the method comprising: receiving a first segment of a boot image from a remote device; verifying integrity of the first segment of the boot image; determining authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image; and executing a sequence of instructions represented by the first segment of the boot image.
Claim 3
Dependent Claim
40 words
The method of claim 1 further comprising receiving a signed manifest associated with the first segment of the boot image, the signed manifest having a digital certificate and a hash value corresponding to the first segment of the boot image.
Claim 4
Dependent Claim
46 words
The method of claim 2 wherein verifying integrity of the first segment of the boot image further comprises: performing a hash function on the first segment of the boot image; and comparing a result of the hash function to the hash value from the signed manifest.
Claim 5
Dependent Claim
56 words
The method of claim 1 wherein receiving a first segment of a boot image from a remote device further comprises: determining an address of the remote device; determining a file name for the first segment of the boot image; and downloading the first segment of the boot image from the named file in the remote device.
Claim 6
Independent Claim
136 words
A method of performing remote boot operations, the method comprising: receiving a first segment of a boot image from a remote device; verifying integrity of the first segment of the boot image; determining authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image and further wherein the Remote-Boot Authorization Certificate is configurable by the remote device by receiving a reconfiguration operation from the remote device, checking the integrity of the reconfiguration operation, determining whether the reconfiguration operation is authorized to be performed, and modifying a parameter set based; at least in part, on the reconfiguration operation; and executing a sequence of instructions represented by the first segment of the boot image.
Claim 7
Independent Claim
136 words
A method of performing remote boot operations, the method comprising: receiving a first segment of a boot image from a remote device; verifying integrity of the first segment of the boot image; determining authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image and further wherein the Remote-Boot Authorization Certificate is configurable by the remote device by receiving a reconfiguration operation from the remote device, checking the integrity of the reconfiguration operation, determining whether the reconfiguration operation is authorized to be performed, and modifying a parameter set based; at least in part, on the reconfiguration operation; and executing a sequence of instructions represented by the first segment of the boot image.
Claim 8
Dependent Claim
40 words
The method of claim 5 further comprising receiving a signed manifest associated with the first segment of the boot image, the signed manifest having a digital certificate and a hash value corresponding to the first segment of the boot image.
Claim 9
Dependent Claim
46 words
The method of claim 6 wherein verifying integrity of the first segment of the boot image further comprises: performing a hash function on the first segment of the boot image; and comparing a result of the hash function to the hash value from the signed manifest.
Claim 10
Dependent Claim
56 words
The method of claim 5 wherein receiving a first segment of a boot image from a remote device further comprises: determining an address of the remote device; determining a file name for the first segment of the boot image; and downloading the first segment of the boot image from the named file in the remote device.
Claim 11
Independent Claim
156 words
A method of performing remote boot operations, the method comprising: receiving a first segment of a boot image from a remote device; verifying integrity of the first segment of the boot image; determining authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image; and executing a sequence of instructions represented by the first segment of the boot image by receiving a second segment of the boot image from the remote device, verifying integrity of the second segment of the boot image, determining authorization of second segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the second segment of the boot image, and executing a sequence of instructions represented by the second segment of the boot image.
Claim 12
Independent Claim
156 words
A method of performing remote boot operations, the method comprising: receiving a first segment of a boot image from a remote device; verifying integrity of the first segment of the boot image; determining authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image; and executing a sequence of instructions represented by the first segment of the boot image by receiving a second segment of the boot image from the remote device, verifying integrity of the second segment of the boot image, determining authorization of second segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the second segment of the boot image, and executing a sequence of instructions represented by the second segment of the boot image.
Claim 13
Dependent Claim
40 words
The method of claim 6 further comprising receiving a signed manifest associated with the first segment of the boot image, the signed manifest having a digital certificate and a hash value corresponding to the first segment of the boot image.
Claim 14
Dependent Claim
46 words
The method of claim 10 wherein verifying integrity of the first segment of the boot image further comprises: performing a hash function on the first segment of the boot image; and comparing a result of the hash function to the hash value from the signed manifest.
Claim 15
Dependent Claim
56 words
The method of claim 9 wherein receiving a first segment of a boot image from a remote device further comprises: determining an address of the remote device; determining a file name for the first segment of the boot image; and downloading the first segment of the boot image from the named file in the remote device.
Claim 16
Dependent Claim
94 words
An article comprising a machine-readable medium having stored thereon sequences of instructions that when executed cause one or more processors to: receive a first segment of a boot image from a remote device; verify integrity of the first segment of the boot image; determine authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image; and execute a sequence of instructions represented by the first segment of the boot image.
Claim 17
Dependent Claim
94 words
An article comprising a machine-readable medium having stored thereon sequences of instructions that when executed cause one or more processors to: receive a first segment of a boot image from a remote device; verify integrity of the first segment of the boot image; determine authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image; and execute a sequence of instructions represented by the first segment of the boot image.
Claim 18
Dependent Claim
53 words
The article of claim 13 further comprising sequences of instructions that when executed cause the one or more processors to receive a signed manifest associated with the first segment of the boot image, the signed manifest having a digital certificate and a hash value corresponding to the first segment of the boot image.
Claim 19
Dependent Claim
69 words
The article of claim 14 wherein the sequences of instructions that cause the one or more processors to verify integrity of the first segment of the boot image further comprise sequences of instructions that cause the one or more processors to: perform a hash function on the first segment of the boot image; and compare a result of the hash function to the hash value from the signed manifest.
Claim 20
Dependent Claim
79 words
The article of claim 13 wherein the sequences of instructions that cause the one or more processors to receive a first segment of a boot image from a remote device further comprise sequences of instructions that cause the one or more processors to: determine an address of the remote device; determine a file name for the first segment of the boot image; and download the first segment of the boot image from the named file in the remote device.
Claim 21
Dependent Claim
144 words
An article comprising a machine-readable medium having stored thereon sequences of instructions that when executed cause one or more processors to: receive a first segment of a boot image from a remote device; verify integrity of the first segment of the boot image; determine authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image; and execute a sequence of instructions represented by the first segment of the boot image wherein the Remote-Boot Authorization Certificate is configurable by the remote device by receiving a reconfiguration operation from the remote device, checking the integrity of the reconfiguration operation, determining whether the reconfiguration operation is authorized to be performed, and modifying a parameter set based, at least in part, on the reconfiguration operation.
Claim 22
Dependent Claim
144 words
An article comprising a machine-readable medium having stored thereon sequences of instructions that when executed cause one or more processors to: receive a first segment of a boot image from a remote device; verify integrity of the first segment of the boot image; determine authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image; and execute a sequence of instructions represented by the first segment of the boot image wherein the Remote-Boot Authorization Certificate is configurable by the remote device by receiving a reconfiguration operation from the remote device, checking the integrity of the reconfiguration operation, determining whether the reconfiguration operation is authorized to be performed, and modifying a parameter set based, at least in part, on the reconfiguration operation.
Claim 23
Dependent Claim
53 words
The article of claim 17 further comprising sequences of instructions that when executed cause the one or more processors to receive a signed manifest associated with the first segment of the boot image, the signed manifest having a digital certificate and a hash value corresponding to the first segment of the boot image.
Claim 24
Dependent Claim
69 words
The article of claim 17 wherein the sequences of instructions that cause the one or more processors to verify integrity of the first segment of the boot image further comprise sequences of instructions that cause the one or more processors to: perform a hash function on the first segment of the boot image; and compare a result of the hash function to the hash value from the signed manifest.
Claim 25
Dependent Claim
79 words
The article of claim 17 wherein the sequences of instructions that cause the one or more processors to receive a first segment of a boot image from a remote device further comprise sequences of instructions that cause the one or more processors to: determine an address of the remote device; determine a file name for the first segment of the boot image; and download the first segment of the boot image from the named file in the remote device.
Claim 26
Dependent Claim
167 words
An article comprising a machine-readable medium having stored thereon sequences of instructions that when executed cause one or more processors to: receive a first segment of a boot image from a remote device; verify integrity of the first segment of the boot image; determine authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image; and execute a sequence of instructions represented by the first segment of the boot image by receiving a second segment of the boot image from the remote device, verifying integrity of the second segment of the boot image, determining authorization of second segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the second segment of the boot image, and executing a sequence of instructions represented by the second segment of the boot image.
Claim 27
Dependent Claim
167 words
An article comprising a machine-readable medium having stored thereon sequences of instructions that when executed cause one or more processors to: receive a first segment of a boot image from a remote device; verify integrity of the first segment of the boot image; determine authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image; and execute a sequence of instructions represented by the first segment of the boot image by receiving a second segment of the boot image from the remote device, verifying integrity of the second segment of the boot image, determining authorization of second segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the second segment of the boot image, and executing a sequence of instructions represented by the second segment of the boot image.
Claim 28
Dependent Claim
53 words
The article of claim 21 further comprising sequences of instructions that when executed cause the one or more processors to receive a signed manifest associated with the first segment of the boot image, the signed manifest having a digital certificate and a hash value corresponding to the first segment of the boot image.
Claim 29
Dependent Claim
69 words
The article of claim 21 wherein the sequences of instructions that cause the one or more processors to verify integrity of the first segment of the boot image further comprise sequences of instructions that cause the one or more processors to: perform a hash function on the first segment of the boot image; and compare a result of the hash function to the hash value from the signed manifest.
Claim 30
Dependent Claim
79 words
The article of claim 21 wherein the sequences of instructions that cause the one or more processors to receive a first segment of a boot image from a remote device further comprise sequences of instructions that cause the one or more processors to: determine an address of the remote device; determine a file name for the first segment of the boot image; and download the first segment of the boot image from the named file in the remote device.
Claim 31
Independent Claim
91 words
An apparatus for performing remote boot operations, the apparatus comprising: means for receiving a first segment of a boot image from a remote device; means for verifying integrity of the first segment of the boot image; means for determining authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image; and means for executing a sequence of instructions represented by the first segment of the boot image.
Claim 32
Independent Claim
91 words
An apparatus for performing remote boot operations, the apparatus comprising: means for receiving a first segment of a boot image from a remote device; means for verifying integrity of the first segment of the boot image; means for determining authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image; and means for executing a sequence of instructions represented by the first segment of the boot image.
Claim 33
Dependent Claim
42 words
The apparatus of claim 25 further comprising means for receiving a signed manifest associated with the first segment of the boot image, the signed manifest having a digital certificate and a hash value corresponding to the first segment of the boot image.
Claim 34
Dependent Claim
53 words
The apparatus of claim 26 wherein the means for verifying integrity of the first segment of the boot image further comprises: means for performing a hash function on the first segment of the boot image; and means for comparing a result of the hash function to the hash value from the signed manifest.
Claim 35
Dependent Claim
65 words
The apparatus of claim 25 wherein the means for receiving a first segment of a boot image from a remote device further comprises: means for determining an address of the remote device; means for determining a file name for the first segment of the boot image; and means for downloading the first segment of the boot image from the named file in the remote device.
Claim 36
Dependent Claim
104 words
A computer data signal embodied in a data communications medium shared among a plurality of network devices comprising sequences of instructions that, when executed, cause one or more electronic systems to: receive a first segment of a boot image from a remote device; verify integrity of the first segment of the boot image; determine authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image; and execute a sequence of instructions represented by the first segment of the boot image.
Claim 37
Dependent Claim
104 words
A computer data signal embodied in a data communications medium shared among a plurality of network devices comprising sequences of instructions that, when executed, cause one or more electronic systems to: receive a first segment of a boot image from a remote device; verify integrity of the first segment of the boot image; determine authorization of the first segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the first segment of the boot image; and execute a sequence of instructions represented by the first segment of the boot image.
Claim 38
Dependent Claim
55 words
The computer data signal of claim 29 further comprising sequences of instructions that when executed cause the one or more processors to receive a signed manifest associated with the first segment of the boot image, the signed manifest having a digital certificate and a hash value corresponding to the first segment of the boot image.
Claim 39
Dependent Claim
71 words
The computer data signal of claim 30 wherein the sequences of instructions that cause the one or more processors to verify integrity of the first segment of the boot image further comprise sequences of instructions that cause the one or more processors to: perform a hash function on the first segment of the boot image; and compare a result of the hash function to the hash value from the signed manifest.
Claim 40
Dependent Claim
81 words
The computer data signal of claim 29 wherein the sequences of instructions that cause the one or more processors to receive a first segment of a boot image from a remote device further comprise sequences of instructions that cause the one or more processors to: determine an address of the remote device; determine a file name for the first segment of the boot image; and download the first segment of the boot image from the named file in the remote device.
Claim 41
Dependent Claim
78 words
The computer data signal of claim 29 wherein the Remote-Boot Authorization Certificate is configurable by the remote device, configuration comprising sequences of instructions that when executed by the one or more processors cause the one or more processors to: receive a reconfiguration operation from the remote device; check the integrity of the reconfiguration operation determine whether the reconfiguration operation is authorized to be performed; and modify a parameter set based, at least in part, on the reconfiguration operation.
Claim 42
Dependent Claim
117 words
The computer data signal of claim 29 wherein the sequences of instructions that cause the one or more processors to execute the sequence of instructions of the first segment of the boot image comprise sequences of instructions that cause the one or more processors to: receive a second segment of the boot image from the remote device; verify integrity of the second segment of the boot image; determine authorization of second segment of the boot image, wherein authorization is determined, at least in part, by a Remote-Boot Authorization Certificate that indicates an authorized source for the second segment of the boot image; and execute a sequence of instructions represented by the second segment of the boot image.
References Cited (Backward Citations)
US4405829A
Cited
US5050212A
Cited
US5421006A
Cited
US5454000A
Cited
US5287519A
Cited
US6067640A
Cited
US5680547A
Cited
US5999711A
Cited
US5881287A
Cited
US5568552A
Cited
US5713009A
Cited
US5822565A
Cited
US5848231A
Cited
US6034832A
Cited
US5844986A
Cited
US5919257A
Cited
US6009524A
Cited
US6061794A
Cited
US6185678B1
Cited
US6189100B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2006-05-05 | 2006-11-04 | 2007-05-06 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2010-05-05 | 2010-11-04 | 2011-05-06 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2014-05-05 | 2014-11-04 | 2015-05-06 | $7700.00 | Window Closed / Lapsed |