US 10,771,264 B2Granted

Securing firmware

AssigneeHewlett Packard Enterprise Development LP

InventorsNigel Edwards, Ludovic Emmanuel Paul Noel Jacquin, Thomas Laffey, Theofrastos Koulouris

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method for secure data protection includes generating a firmware digital certificate for a layer of firmware. The firmware operates a hardware component of a compute node. The firmware digital certificate is an attribute certificate. The firmware digital certificate includes a cumulative hash of the layer of firmware and a nonce. The cumulative hash includes a concatenation of a hash of the layer of firmware and a hash of each one or more lower layers of the firmware. The method includes authenticating the layer of firmware using a trusted data store. The trusted data store includes a binary image of an expected layer of firmware and a certificate chain comprising the hardware digital certificate and the firmware digital certificate.

Claims18

Dependent claims

A method for securing firmware, comprising:

generating a firmware digital certificate for a layer of firmware, wherein the firmware operates a hardware component of a compute node, wherein the firmware digital certificate comprises an attribute certificate, and wherein the firmware digital certificate comprises:
a cumulative hash of the layer of firmware, wherein the cumulative hash comprises a concatenation of:
a hash of the layer of firmware;
and
a hash of each one or more lower layers of the firmware;
and
a nonce;
and
authenticating the layer of firmware using a trusted data store comprising a binary image of an expected layer of firmware, and a certificate chain comprising a hardware digital certificate and the firmware digital certificate;
generating an additional firmware digital certificate for an additional layer of firmware, wherein the additional firmware operates the hardware component of the compute node, wherein the additional firmware digital certificate is signed by a private key installed in a previous layer of firmware, and wherein the additional firmware digital certificate comprises:
an additional hash of the additional layer of firmware;
an additional cumulative hash with the additional layer of firmware added to the accumulation;
and
a new key pair with a new private key installed in the additional layer of firmware;
and
authenticating the additional layer of firmware using the trusted data store comprising an additional binary image of the additional layer of firmware, wherein the certificate chain comprises the additional firmware digital certificate.

13 more elements

A system, comprising:

a processor;
and
a memory component that stores instructions that cause the processor to:
generate a firmware digital certificate for a layer of firmware, wherein the firmware operates a hardware component of a compute node, wherein the firmware digital certificate comprises an attribute certificate, and wherein the firmware digital certificate comprises:
a cumulative hash of the layer of firmware, wherein the cumulative hash comprises a concatenation of:
a hash of the layer of firmware;
and
a hash of each one or more lower layers of the firmware;
and
a nonce;
and
authenticate the layer of firmware using a trusted data store comprising a binary image of an expected layer of firmware, and a certificate chain comprising a hardware digital certificate and the firmware digital certificate;
generate an additional firmware digital certificate for an additional layer of firmware, wherein the additional firmware operates the hardware component of the compute node, wherein the additional firmware digital certificate comprises an additional hash of the additional layer of firmware, wherein the additional firmware digital certificate is signed by a private key installed in a previous layer of firmware, and wherein the additional firmware digital certificate comprises:
an additional hash of the additional layer of firmware;
an additional cumulative hash with the additional layer of firmware added to the accumulation;
and
a new key pair with a new private key installed in the additional layer of firmware;
and
authenticate the additional layer of firmware using the trusted data store comprising an additional binary image of the additional layer of firmware, wherein the certificate chain comprises the additional firmware digital certificate.

16 more elements

A non-transitory, computer-readable medium storing computer-executable instructions, which when executed, cause a computer to:

generate a firmware digital certificate for a layer of firmware, wherein the firmware operates a hardware component of a compute node, wherein the firmware digital certificate comprises an attribute certificate, and wherein the firmware digital certificate comprises:
a cumulative hash of the layer of firmware, wherein the cumulative hash comprises a concatenation of:
a hash of the layer of firmware;
and
a hash of each one or more lower layers of the firmware;
a plurality of measurements of a corresponding plurality of layers of the firmware, wherein each of the measurements comprise a hash of a binary image of a corresponding layer of the firmware;
and
a nonce;
generate an additional firmware digital certificate for an additional layer of firmware, wherein the additional firmware operates the hardware component of the compute node, wherein the additional firmware digital certificate is signed by a private key installed in a previous layer of firmware, and wherein the additional firmware digital certificate comprises:
an additional hash of the additional layer of firmware;
an additional cumulative hash with the additional layer of firmware added to the accumulation;
and
a new key pair with a new private key installed in the additional layer of firmware;
authenticate the layer of firmware using a trusted data store comprising a binary image of an expected layer of firmware, and a certificate chain comprising a hardware digital certificate and the firmware digital certificate;
and
authenticate the additional layer of firmware using the trusted data store comprising an additional binary image of the additional layer of firmware, wherein the certificate chain comprises the additional firmware digital certificate.

13 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/155,983Filed 10 Oct 2018
Published: US 2020/0119929 A116 Apr 2020
Granted: 8 Sep 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 9/3265
Involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements: using…
G06F 21/572
Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates…:…
H04L 9/0643
The encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions;…
H04L 9/50
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: using hash chains, e.g.…

Family

US 2020/0119929 A1Pre-grant publication · published 16 Apr 2020
US 10,771,264 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key