Bidirectional trust chaining for trusted boot

An Information Handling System (IHS) comprising:

• a flash memory;
• and
• an embedded controller coupled to the flash memory, wherein the embedded controller is configured to:
• retrieve, from the flash memory, an image of a current boot component of the sequence of boot components, wherein the current boot component follows a prior boot component in the ordered sequence of boot components, and wherein the image comprises hardware instructions for operation of the current boot component, and wherein the image further comprises a digital signature, and wherein the image further comprises a reference hash that is based on the hardware instructions for use by the current boot component and further based on a hash of hardware instructions for use by the prior boot component;
• authenticate the digital signature;
• calculate a hash based on the hardware instructions that will be used to operate the current boot component and further based on a hash value of hardware instructions in use by the operation of the prior boot component;
• compare the calculated hash and the reference hash to verify an integrity of the hardware instructions that will be used to operate the current boot component and the hardware instructions in use by the prior boot component, wherein a match between the calculated hash and the reference hash confirms the instructions that will be used to operate the current boot component and the instructions in use by the prior boot component have not been compromised;
• and
• initiate validation of a next boot component of the sequence of boot components, wherein the next boot component directly follows the current boot component in the ordered sequence of boot components.

An embedded controller coupled to a flash memory of an Information Handling System (IHS), wherein the embedded controller is configured to:

• retrieve, from the flash memory, an image of a current boot component of the sequence of boot components, wherein the current boot component follows a prior boot component in the ordered sequence of boot components, and wherein the image comprises hardware instructions for operation of the current boot component, and wherein the image further comprises a digital signature, and wherein the image further comprises a reference hash that is based on the hardware instructions for use by the current boot component and further based on a hash of hardware instructions for use by the prior boot component;
• authenticate the digital signature;
• calculate a hash based on the hardware instructions that will be used to operate the current boot component and further based on a hash value of hardware instructions in use by the operation of the prior boot component;
• compare the calculated hash and the reference hash to verify an integrity of the hardware instructions that will be used to operate the current boot component and the hardware instructions in use by the prior boot component, wherein a match between the calculated hash and the reference hash confirms the instructions that will be used to operate the current boot component and the instructions in use by the prior boot component have not been compromised;
• and
• initiate validation of a next boot component of the sequence of boot components, wherein the next boot component directly follows the current boot component in the ordered sequence of boot components.