# US 10,121,006 B2 · Mediated secure boot for single or multicore processors > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,121,006 B2 - Document ID: US10121006B2 - Status: Granted - Kind: B2 - Application number: 15/369,299 - Filed: 2016-12-05 - Published: 2017-03-23 - Granted: 2018-11-06 - Earliest claimed: 2014-01-13 - Assignees: Raytheon Company - Applicants: Raytheon Company - Inventors: Brandon Woolley; Norman Cramer; Brian McFarland; Matthew Hammond - Web page: https://patentgrep.com/patent/US10121006B2 ## CPC - G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]} - G06F 1/24: Resetting means - G06F 9/4405: {Initialisation of multiprocessor systems} - G06F 9/4418: {Suspend and resume; Hibernate and awake} - G06F 9/44505: {Configuring for program initiating, e.g. using registry, configuration files} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/575: {Secure boot} - G06F 9/4401: Bootstrapping (security arrangements therefor G06F21/57) - G06F 15/177: Initialisation or configuration control {(processor initialisation G06F9/4405)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and methods are disclosed for securely booting a processing system using a three step secure booting process. Several embodiments are presented, wherein upon power-on-reset, the first boot step uses a secure boot device comprising of a programmable device or an FPGA which boots up first, validates its configuration file and then validates the processor(s) configuration data before presenting the configuration data to the processor(s). This enables validation of ‘pre-boot’ information, such as the Reset Control Word and pre-boot processor configuration data. The second and third boot steps validate the internal secure boot code and external boot code respectively using one or more of secure validation techniques, such as encryption/decryption, Key mechanisms, privilege checking, pointer hashing or signature correlation schemes. This results in an end-to-end secure boot process for a variety of architectures, such as single processor systems, synchronous and asynchronous multiprocessing systems, single core systems and multi-core processing systems. ## Claims ### Claim 1 An apparatus, comprising: multiple processors or processing cores; and at least one secure boot device comprising one or more programmable logic devices or Field Programmable Gate Arrays (FPGAs), wherein the at least one secure boot device is configured to: while the multiple processors or processing cores are held in a reset state, validate first configuration data including at least one of configuration bits and logic states associated with the at least one secure boot device and validate second configuration data associated with the multiple processors or processing cores, and after the second configuration data is validated, release the multiple processors or processing cores from the reset state sequentially and provide the validated second configuration data to the multiple processors or processing cores. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the second configuration data comprises a reset control word and a pre-boot image, and wherein the at least one secure boot device is configured to provide the reset control word and the pre-boot image to the multiple processors or processing cores during a pre-boot loader phase of a boot sequence. ### Claim 3 (depends on 2) The apparatus of claim 2, wherein the at least one secure boot device is further configured to validate code for an Internal Secure Boot Code phase and an External Secure Boot Code phase of the boot sequence that follow the pre-boot loader phase of the boot sequence. ### Claim 4 (depends on 2) The apparatus of claim 2, wherein the reset control word and the pre-boot image are embedded as part of the first configuration data associated with the at least one secure boot device. ### Claim 5 (depends on 1) The apparatus of claim 1, further comprising: at least one non-volatile memory configured to store the first and second configuration data. ### Claim 6 (depends on 1) The apparatus of claim 1, further comprising: a non-volatile memory configured to store the first configuration data, the non-volatile memory accessible only by the at least one secure boot device. ### Claim 7 An apparatus, comprising: multiple processors or processing cores; and at least one secure boot device configured to be coupled to the multiple processors or processing cores and to control a boot sequence of the multiple processors or processing cores, wherein the at least one secure boot device comprises one or more programmable logic devices or Field Programmable Gate Arrays (FPGAs), and wherein the at least one secure boot device is configured, during a pre-boot loader phase of the boot sequence, to: while holding the multiple processors or processing cores in a reset state: obtain and validate first configuration data including at least one of configuration bits and logic states associated with the at least one secure boot device, and after the first configuration data is validated, obtain and validate second configuration data associated with the multiple processors or processing cores, and after the second configuration data is validated, release the multiple processors or processing cores from the reset state concurrently or sequentially and provide the validated second configuration data to the multiple processors or processing cores. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein the second configuration data comprises a reset control word and a pre-boot image, and the at least one secure boot device is configured to provide the reset control word and the pre-boot image to the multiple processors or processing cores during the pre-boot loader phase of the boot sequence. ### Claim 9 (depends on 7) The apparatus of claim 7, wherein the at least one secure boot device is further configured to validate code for an Internal Secure Boot Code phase and an External Secure Boot Code phase of the boot sequence that follow the pre-boot loader phase of the boot sequence. ### Claim 10 (depends on 7) The apparatus of claim 7, further comprising: at least one non-volatile memory configured to store the first and second configuration data. ### Claim 11 (depends on 7) The apparatus of claim 7, further comprising: a non-volatile memory configured to store the first configuration data, the non-volatile memory accessible only by the at least one secure boot device. ### Claim 12 A method, comprising: using at least one secure boot device comprising one or more programmable logic devices or Field Programmable Gate Arrays (FPGAs): while multiple processors or processing cores are held in a reset state, validating first configuration data including at least one of configuration bits and logic states associated with the at least one secure boot device and validating second configuration data associated with the multiple processors or processing cores, and after the second configuration data is validated, releasing the multiple processors or processing cores from the reset state sequentially and providing the validated second configuration data to the multiple processors or processing cores. ### Claim 13 (depends on 12) The method of claim 12, wherein the second configuration data comprises a reset control word and a pre-boot image, and wherein the reset control word and the pre-boot image are provided to the multiple processors or processing cores during a pre-boot loader phase of a boot sequence. ### Claim 14 (depends on 13) The method of claim 13, further comprising: using the at least one secure boot device, validating code for an Internal Secure Boot Code phase and an External Secure Boot Code phase of the boot sequence that follow the pre-boot loader phase of the boot sequence. ### Claim 15 (depends on 13) The method of claim 13, wherein the reset control word and the pre-boot image are embedded as part of the first configuration data associated with the at least one secure boot device. ### Claim 16 (depends on 12) The method of claim 12, wherein the first and second configuration data are stored in at least one non-volatile memory. ### Claim 17 (depends on 12) The method of claim 12, wherein the first configuration data comprises configuration bits and logic states for the at least one secure boot device.