# US 11,907,375 B2 · System and method for signing and interlocking a boot information file to a host computing system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,375 B2 - Document ID: US11907375B2 - Status: Granted - Kind: B2 - Application number: 17/228,917 - Filed: 2021-04-13 - Published: 2022-10-13 - Granted: 2024-02-20 - Earliest claimed: 2021-04-13 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Lee A. Preimesberger; Vartan Yosef Kasheshian; Jorge Cisneros - Web page: https://patentgrep.com/patent/US11907375B2 ## CPC - G06F 21/575: {Secure boot} - G06F 9/4406: {Loading of operating system} - G06F 16/2379: {Updates performed during online database operations; commit processing} - G06F 21/44: Program or device authentication - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - G06F 9/4401: Bootstrapping (security arrangements therefor G06F21/57) - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Example implementations relate to system and method of signing a boot information file by a manageability controller, and interlocking host computing system to signed boot information file. The boot information file may include a boot loader file and/or an OS kernel file of the host computing system. The manageability controller receives the boot information file from a processor of a computing device. Further, the manageability controller signs the boot information file with a hashed data of a unique identifier, to generate and communicate the signed boot information file to the processor. Later, the manageability controller updates a boot database stored in non-volatile random-access memory of a firmware engine of the host computing system with a thumbprint data of the signed boot information file to interlock the host computing system to the signed boot information file, in response to successful download of the signed boot information file by the processor. ## Claims ### Claim 1 A method comprising: receiving, by a manageability controller of a host computing system, a boot information file of the host computing system from a processor of a computing device; signing, by the manageability controller, the boot information file with a hashed data of a unique identifier, to generate a signed boot information file; communicating, by the manageability controller, the signed boot information file to the processor; in response to successful download of the signed boot information file by the processor, updating, by the manageability controller, a boot database stored in a non-volatile random-access memory of a firmware engine of the host computing system with a thumbprint data of the signed boot information file for interlocking the host computing system to the signed boot information file; and appending, by the manageability controller, the boot information file stored in a non-volatile storage drive of the host computing system, by using the hashed data of the unique identifier to generate an appended boot information file, wherein the appended boot information file and the signed boot information file are similar files. ### Claim 2 (depends on 1) The method of claim 1, further comprising, repeating the steps of signing the boot information file, communicating the signed boot information file, updating the boot database in the firmware engine, and appending the boot information file stored in the non-volatile storage drive, by the manageability controller, upon receiving an updated boot information file from the processor. ### Claim 3 (depends on 1) The method of claim 1, further comprising upon subsequent booting of the host computing system: accessing, by the firmware engine, the appended boot information file stored in the non-volatile storage drive of the host computing system based on the thumbprint data stored in the boot database; validating, by the firmware engine, the hashed data of the unique identifier in the appended boot information file by using a public key of the manageability controller; and in response to successful validation, allowing, by the firmware engine, the processor to use the boot information file for loading an operating system of the host computing system. ### Claim 4 (depends on 1) The method of claim 1, wherein receiving the boot information file comprises: establishing, by the processor, a secure connection with the manageability controller; posting, by the processor, a pre-determined link to a non-volatile storage drive of the host computing system for sharing the boot information file with the manageability controller; and accessing, by the manageability controller, the pre-determined link to receive the boot information file from the non-volatile storage drive of the host computing system. ### Claim 5 (depends on 1) The method of claim 1, wherein receiving the boot information file comprises: establishing, by the processor, a connection with the manageability controller; posting, by the processor, a pre-determined link to a non-volatile storage drive of the host computing system for sharing the boot information file with the manageability controller; and accessing, by the manageability controller, the pre-determined link to validate a customer signature in the boot information file, and receive the boot information file from the non-volatile storage drive of the host computing system upon successful validation of the customer signature in the boot information file. ### Claim 6 (depends on 1) The method of claim 1, wherein the boot information file is a customized boot information file having a plurality of parameters configured for running one or more workloads in the host computing system. ### Claim 7 (depends on 1) The method of claim 1, wherein the boot information file comprises at least one of a boot loader file or an operating system (OS) kernel file of the host computing system. ### Claim 8 (depends on 1) The method of claim 1, wherein the unique identifier is a private key corresponding to the manageability controller that is stored in a trusted platform module of the manageability controller. ### Claim 9 (depends on 1) The method of claim 1, further comprising in response to successful download of the signed boot information file by the processor, purging, by the manageability controller, pre-existing boot data in the boot database into a purged boot database stored in the non-volatile random-access memory of the firmware engine before updating the boot database with the thumbprint data of the signed boot information file. ### Claim 10 A manageability controller of a host computing system, comprising: a machine readable medium that stores program instructions; and a processing resource operably coupled to the machine readable medium, wherein the processing resource executes the program instructions to: receive a boot information file of the host computing system from a processor of a computing device; sign the boot information file with a hashed data of a unique identifier, to generate a signed boot information file; communicate the signed boot information file to the processor; in response to successful download of the signed boot information file by the processor, update a boot database stored in a non-volatile random-access memory of a firmware engine of the host computing system with a thumbprint data of the signed boot information file for interlocking the host computing system to the signed boot information file; and append the boot information file stored in a non-volatile storage drive of the host computing system, by using the hashed data of the unique identifier to generate an appended boot information file, wherein the appended boot information file and the signed boot information file are similar files. ### Claim 11 (depends on 10) The manageability controller of claim 10, wherein the processing resource further executes the program instructions to repeat the steps of signing the boot information file, communicating the signed boot information file, updating the boot database in the firmware engine, and appending the boot information file stored in the non-volatile storage drive, by the manageability controller, upon receiving an updated boot information file from the processor. ### Claim 12 (depends on 10) The manageability controller of claim 10, wherein the boot information file is a customized boot information file having a plurality of parameters configured for running one or more workloads in the host computing system. ### Claim 13 (depends on 10) The manageability controller of claim 10, wherein the boot information file comprises at least one of a boot loader file or an operating system (OS) kernel file of the host computing system. ### Claim 14 (depends on 10) The manageability controller of claim 10, wherein the unique identifier is a private key corresponding to the manageability controller that is stored in a trusted platform module of the manageability controller. ### Claim 15 (depends on 10) The manageability controller of claim 10, further comprising in response to successful download of the signed boot information file by the processor, purging, by the manageability controller, pre-existing boot data in the boot database into a purged boot database stored in the non-volatile random-access memory of the firmware engine before updating the boot database with the thumbprint data of the signed boot information file. ### Claim 16 A non-transitory machine readable medium that stores instructions executable by a manageability controller of a host computing system, wherein instructions comprising: a first instruction to receive a boot information file of the host computing system from a processor of a computing device, wherein the processor is separate from the manageability controller; a second instruction to sign the boot information file with a hashed data of a unique identifier, to generate a signed boot information file; a third instruction to communicate the signed boot information file to the processor; a fourth instruction to update a boot database stored in a non-volatile random-access memory of a firmware engine of the host computing system with a thumbprint data of the signed boot information file for interlocking the host computing system to the signed boot information file, in response to successful download of the signed boot information file by the processor; and a fifth instruction to append the boot information file stored in a non-volatile storage drive of the host computing system, by using the hashed data of the unique identifier to generate an appended boot information file, wherein the appended boot information file and the signed boot information file are similar files. ### Claim 17 (depends on 16) The non-transitory machine readable medium of claim 16, wherein the instructions further comprise a sixth instruction to repeat the second instruction to sign the boot information file, the third instruction to communicate the boot information file, the fourth instruction to update the boot information file, and the fifth instruction to append the boot information file in the non-volatile storage drive, upon receiving an updated boot information file from the processor. ### Claim 18 (depends on 16) The non-transitory machine readable medium of claim 16, wherein the boot information file is a customized boot information file having a plurality of parameters configured for running one or more workloads in the host computing system. ### Claim 19 (depends on 16) The non-transitory machine readable medium of claim 16, wherein the unique identifier is a private key corresponding to the manageability controller that is stored in a trusted platform module of the manageability controller. ### Claim 20 (depends on 16) The non-transitory machine readable medium of claim 16, further comprising, in response to successful download of the signed boot information file by the processor, the instructions to purge pre-existing boot data in the boot database into a purged boot database stored in the non-volatile random-access memory of the firmware engine before updating the boot database with the thumbprint data of the signed boot information file.