# US 12,003,960 B2 · Booting and operating computing devices at designated locations > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,960 B2 - Document ID: US12003960B2 - Status: Granted - Kind: B2 - Application number: 17/397,944 - Filed: 2021-08-09 - Published: 2021-11-25 - Granted: 2024-06-04 - Earliest claimed: 2018-11-06 - Assignees: Red Hat, Inc. - Applicants: Red Hat, Inc. - Inventors: Jens Reimann - Web page: https://patentgrep.com/patent/US12003960B2 ## CPC - H04W 12/06: Authentication - G06F 21/575: {Secure boot} - H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB} - H04L 9/14: using a plurality of keys or algorithms - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/47: using near field communication [NFC] or radio frequency identification [RFID] modules - H04W 12/63: Location-dependent; Proximity-dependent - G06F 2221/031: Protect user input by software means - H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor - H04W 12/33: using wearable devices, e.g. using a smartwatch or smart-glasses - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Aspects of the disclosure provide for mechanisms for booting and operating a computing device at a target location. A method of the disclosure includes determining, at a startup process of a computing device, whether the computing device is present at a designated target location by checking, using a first near-field communication (NFC) device associated with the computing device, presence of a second NFC device positioned at the target location. The method further includes in response to detecting the presence of the second NFC device, acquiring a cryptographic key from the second NFC device. The method also includes decrypting contents associated with the computing device using the cryptographic key, and performing, using the decrypted contents, a boot process for the computing device in response to determining that the computing device is at the target location. ## Claims ### Claim 1 A method comprising: determining, at a startup process of a computing device, whether the computing device is present at a designated target location by: checking, using a first near-field communication (NFC) device associated with the computing device, presence of a second NFC device positioned at the target location, acquiring, from the second NFC device, an identifier of the second NFC device, comparing the received identifier of the second NFC device with an identifier of an authenticated NFC device, wherein the identifier of the authenticated NFC device comprises a stored identifier stored in a memory associated with firmware of the computing device, and in response to the received identifier matching the stored identifier, authenticating the second NFC device; in response to authenticating the second NFC device, acquiring a cryptographic key from the second NFC device; decrypting, using the cryptographic key, contents of a storage device of the computing device; and performing, using the decrypted contents, a boot process for the computing device in response to determining that the computing device is at the target location. ### Claim 2 (depends on 1) The method of claim 1, further comprising performing a validation process to authenticate the second NFC device using credential information obtained from the second NFC device. ### Claim 3 (depends on 1) The method of claim 1, wherein authenticating the second NFC device further comprises determining that the second NFC device is in a predetermined proximity of the first NFC device. ### Claim 4 (depends on 3) The method of claim 3, wherein authenticating the second NFC device further comprises performing a handshaking process via the first NFC device. ### Claim 5 (depends on 2) The method of claim 2, wherein performing the validation process comprises comparing the credential information with known credential information of an authenticated NFC device positioned at the target location. ### Claim 6 (depends on 2) The method of claim 2, further comprising performing the validation process using the firmware of the computing device. ### Claim 7 (depends on 2) The method of claim 2, further comprising: in response to failing to authenticate the second NFC device, shutting down the computing device. ### Claim 8 (depends on 1) The method of claim 1, further comprising: checking the presence of the second NFC device after completion of the boot process; and in response to detecting absence of the second NFC device, shutting down the computing device. ### Claim 9 A system comprising: a memory; and a processing device operatively coupled to the memory, wherein the processing device is configured to: determine, at a startup process of a computing device, whether the computing device is present at a designated target location by: checking, using a first near-field communication (NFC) device associated with the computing device, presence of a second NFC device positioned at the target location, acquiring, from the second NFC device, an identifier of the second NFC device, comparing the received identifier of the second NFC device with an identifier of an authenticated NFC device, wherein the identifier of the authenticated NFC device comprises a stored identifier stored in a memory associated with firmware of the computing device, and in response to the received identifier matching the stored identifier, authenticating the second NFC device; in response to authenticating the second NFC device, acquire a cryptographic key from the second NFC device; decrypt, using the cryptographic key, contents of a storage device of the computing device; and perform, using the decrypted contents, a boot process for the computing device in response to determining that the computing device is at the target location. ### Claim 10 (depends on 9) The system of claim 9, wherein the processing device is further to perform a validation process to authenticate the second NFC device using credential information obtained from the second NFC device. ### Claim 11 (depends on 9) The system of claim 9, wherein to authenticate the second NFC device, the processing device is to determine that the second NFC device is in a predetermined proximity of the first NFC device. ### Claim 12 (depends on 11) The system of claim 11, wherein to authenticate the second NFC device, the processing device is to perform a handshaking process via the first NFC device. ### Claim 13 A non-transitory machine-readable storage medium including instructions that, when accessed by a processing device, cause the processing device to: determine, at a startup process of a computing device, whether the computing device is present at a designated target location by: checking, using a first near-field communication (NFC) device associated with the computing device, presence of a second NFC device positioned at the target location, acquiring, from the second NFC device, an identifier of the second NFC device, comparing the received identifier of the second NFC device with an identifier of an authenticated NFC device, wherein the identifier of the authenticated NFC device comprises a stored identifier stored in a memory associated with firmware of the computing device, and in response to the received identifier matching the stored identifier, authenticating the second NFC device; in response to authenticating the second NFC device, acquire a cryptographic key from the second NFC device; decrypt, using the cryptographic key, contents of a storage device of the computing device; and perform, using the decrypted contents, a boot process for the computing device in response to determining that the computing device is at the target location. ### Claim 14 (depends on 13) The non-transitory machine-readable storage medium of claim 13, wherein the processing device is further to perform a validation process to authenticate the second NFC device using credential information obtained from the second NFC device. ### Claim 15 (depends on 13) The non-transitory machine-readable storage medium of claim 13, wherein to authenticate the second NFC device, the processing device is to determine that the second NFC device is in a predetermined proximity of the first NFC device. ### Claim 16 (depends on 13) The non-transitory machine-readable storage medium of claim 13, wherein to authenticate the second NFC device, the processing device is to perform a handshaking process via the first NFC device. ### Claim 17 (depends on 1) The method of claim 1, wherein: acquiring the cryptographic key from the second NFC device is in further response to determining whether a predetermined policy is satisfied; and the predetermined policy comprises that a platform configuration register (PCR) of a trusted platform module of the computing device is in a predetermined state. ### Claim 18 (depends on 17) The method of claim 17, wherein the predetermined state comprises a predetermined value of the PCR. ### Claim 19 (depends on 8) The method of claim 8, wherein checking the presence of the second NFC device after completion of the boot process comprises checking the presence of the second NFC device a random amount of time after completion of the boot process.