# US 12,223,054 B2 · Denial of dynamic host configuration protocol internet protocol address allocation to an unauthorized node via cross secure boot verification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,054 B2 - Document ID: US12223054B2 - Status: Granted - Kind: B2 - Application number: 18/157,701 - Filed: 2023-01-20 - Published: 2024-07-25 - Granted: 2025-02-11 - Earliest claimed: 2023-01-20 - Assignees: Dell Products L.P. - Applicants: Dell Products L.P. - Inventors: Ankit Singh; Deepaganesh Paulraj - Web page: https://patentgrep.com/patent/US12223054B2 ## CPC - G06F 21/575: {Secure boot} - G06F 21/33: using certificates - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Denial of dynamic host configuration protocol (DHCP) internet protocol (IP) address allocation to an unauthorized node via cross secure boot verification is presented herein. A system enables storage of a boot storage certificate in a boot data store of a client device, in which the boot storage certificate has been signed by a key exchange key (KEK) that has been stored in a network boot data store of a network switch device of a network; intercepts a DHCP discover packet that has been directed, by the client device, to a DHCP device of the system that assigns respective IP addresses to client devices to facilitate respective accesses, via the client devices using the respective IP addresses, of the network; and in response to determining that the secure boot storage certificate has been signed by the KEK, assigns an IP address of the respective IP addresses to the client device. ## Claims ### Claim 1 A system, comprising: a processor; and a memory that stores executable components that, when executed by the processor, facilitate performance of operations by the system, the operations comprising: in response to a client device being determined to have been authorized to access a network, generating a secure boot storage certificate, and sending the secure boot storage certificate to the client device to facilitate storage of the secure boot storage certificate in a secure boot data store of the client device, wherein the secure boot storage certificate has been signed by a key exchange key that has been stored in a network boot data store of a network switch device of the network; intercepting a dynamic host configuration protocol discover packet that has been sent from the client device and that has been directed to a dynamic host configuration protocol device of the system, wherein the dynamic host configuration protocol device assigns respective internet protocol addresses to client devices to facilitate respective accesses, via the client devices using the respective internet protocol addresses, of the network; and in response to determining that the secure boot storage certificate, which has been stored in the secure boot data store of the client device, has been signed by the key exchange key that has been stored in the network boot data store, assigning an internet protocol address of the respective internet protocol addresses to the client device. ### Claim 2 (depends on 1) The system of claim 1, wherein the generating of the secure boot storage certificate comprises: based on a defined network access policy, determining whether the client device has been authorized to access the network; and in response to the client device being determined to have been authorized to access the network, generating the secure boot storage certificate. ### Claim 3 (depends on 1) The system of claim 1, wherein the generating of the secure boot storage certificate comprises: signing the secure boot storage certificate with the key exchange key that has been stored in the network boot data store. ### Claim 4 (depends on 3) The system of claim 3, wherein the secure boot data store of the client device and the network boot data store of the network switch correspond to respective unified extensible firmware interface based boot services. ### Claim 5 (depends on 1) The system of claim 1, wherein the sending of the secure boot storage certificate to the client device comprises: sending the secure boot storage certificate to the client device to facilitate the storage of the secure boot storage certificate in the secure boot data store of the client device utilizing a basic input output system based boot storage space modification procedure. ### Claim 6 (depends on 1) The system of claim 1, wherein the intercepting of the dynamic host configuration protocol discover packet comprises: in response to the detecting, via the network switch device, that the dynamic host configuration protocol discover packet has been received from the client device, extracting, from the dynamic host configuration protocol discover packet, a media access control address representing a distinct representation of the client device, and based on the media access control address, sending, to the client device, a request for the client device to send, to the system, the secure boot storage certificate that has been stored in the secure boot data store of the client device. ### Claim 7 (depends on 6) The system of claim 6, wherein the detecting that the dynamic host configuration protocol discover packet has been received comprises: preventing, via the network switch device, a dynamic host configuration protocol offer packet that has been transmitted from the dynamic host configuration protocol device from being forwarded to the client device pending a determination of whether the secure boot storage certificate that has been stored in the secure boot data store of the client device has been signed by the key exchange key that has been stored in the network boot data store. ### Claim 8 (depends on 7) The system of claim 7, wherein the determination of whether the secure boot storage certificate been signed by the key exchange key comprises: in response to the secure boot storage certificate being determined to have been signed by the key exchange key that has been stored in the network boot data store, forwarding the dynamic host configuration protocol offer packet to the client device to facilitate the assigning of the internet protocol address to the client device; and in response to the secure boot storage certificate being determined to have not been signed by the key exchange key that has been stored in the network boot data store, preventing the dynamic host configuration protocol offer packet from being forwarded to the client device to prevent an access of the respective accesses of the network by the client device. ### Claim 9 A method, comprising: in response to a device being determined to be authorized to access a network, facilitating, by a system comprising at least one processor, sending an authentication key to the device to result in storage of the authentication key in a device boot storage space of the device, wherein the authentication key has been signed by a key exchange key that has been stored in a switch boot storage space of a network switch of the network; in response to a dynamic host configuration protocol discover packet being determined, via the network switch, to have been received from the device, determining, by the system, whether the device boot storage space comprises the authentication key that has been signed by the key exchange key that has been stored in the switch boot storage space; and in response to the device boot storage space being determined to comprise the authentication key that has been signed by the key exchange key that has been stored in the switch boot storage space, facilitating, by the system, an assignment of an internet protocol address to the device to facilitate an access of the network by the device. ### Claim 10 (depends on 9) The method of claim 9, wherein the facilitating of the sending of the authentication key comprises: generating the authentication key comprising signing the authentication key with the key exchange key that has been stored in the switch boot storage space. ### Claim 11 (depends on 9) The method of claim 9, further comprising: in response to the dynamic host configuration protocol discover packet being determined, via the network switch, to have been received from the device, blocking, by the system via the network switch, a dynamic host configuration protocol offer packet that has been transmitted from a dynamic host configuration protocol device of the system from being sent to the device awaiting the device being determined to be authorized to access the network. ### Claim 12 (depends on 11) The method of claim 11, wherein the determining whether the device boot storage space comprises the authentication key comprises: extracting, from the dynamic host configuration protocol discover packet, a media access control address representing the device; and based on the media access control address, facilitating sending, to the device, a request for the device to send the authentication key to the system. ### Claim 13 (depends on 12) The method of claim 12, further comprising: in response to the authentication key being determined to have not been received from the device, facilitating, by the system, sending, via the network switch, an internet protocol release notification to the dynamic host configuration protocol device to prevent the access of the network by the device. ### Claim 14 (depends on 12) The method of claim 12, further comprising: in response to the authentication key being determined to have been received from the device, determining, by the system, whether the authentication key has been signed by the key exchange key that has been stored in the switch boot storage space. ### Claim 15 (depends on 14) The method of claim 14, wherein the facilitating of the sending of the authentication key comprises: in response to the authentication key being determined to have been signed by the key exchange key that has been stored in the switch boot storage space, unblocking the dynamic host configuration protocol offer packet that has been transmitted from the dynamic host configuration protocol device to facilitate the assignment of the internet protocol address to the device. ### Claim 16 (depends on 14) The method of claim 14, further comprising: in response to the authentication key being determined to have not been signed by the key exchange key that has been stored in the switch boot storage space, facilitating, by the system, sending, via the network switch, an internet protocol release notification to the dynamic host configuration protocol device to prevent the access of the network by the device. ### Claim 17 A non-transitory machine-readable medium comprising instructions that, in response to execution, cause a system comprising at least one processor to perform operations, the operations comprising: in response to determining that a client device has been authorized to access a network, sending a boot storage network access key to the client device to facilitate storage of the boot storage network access key in a memory partition of a device boot memory space of the client device, wherein the boot storage network access key has been signed by a key exchange key that has been stored in a network switch boot memory space of a network switch of the network; in response to determining that a dynamic host configuration protocol discover packet has been received, via the network switch, from the client device, blocking a dynamic host configuration protocol offer packet that has been transmitted from a dynamic host configuration protocol device of the system from being forwarded to the client device pending the client device being determined to be authorized to access the network; and in response to determining that the boot storage network access key, which has been stored in the memory partition in the device boot memory space, has been signed by the key exchange key that has been stored in the network switch boot memory space, authorizing the client device to access the network by unblocking the dynamic host configuration protocol offer packet, wherein the unblocking comprises forwarding the dynamic host configuration protocol offer packet to the client device. ### Claim 18 (depends on 17) The non-transitory machine-readable medium of claim 17, wherein the sending of the boot storage network access key to the client device comprises: signing the boot storage network access key with the key exchange key that has been stored in the network switch boot memory space. ### Claim 19 (depends on 17) The non-transitory machine-readable medium of claim 17, wherein the device boot memory space of the client device and the network switch boot memory space of the network switch correspond to respective unified extensible firmware interface based boot services. ### Claim 20 (depends on 17) The non-transitory machine-readable medium of claim 17, wherein the determining that the dynamic host configuration protocol discover packet has been received from the client device comprises: extracting, from the dynamic host configuration protocol discover packet, a media access control address representing the device; and based on the media access control address, sending, to the device, a request for the device to send the boot storage network access key to the system.