Secure initial program load (IPL) code loading attributes facility
AssigneeInternational Business Machines Corporation
InventorsLouis P. Gomes, Peter Oberparleiter
Life of this patent
Estimating the term…
Abstract
A method, system, and computer program product are provided for preventing malicious code injection during Initial Program Load (IPL). A secure code loading attributes block (SCLAB) is appended to a variable sized signed binary code component to generate a combined component. The variable sized signed binary code component is Operating System (OS) code for an initial program load (IPL) process. The SCLAB comprises contents that include a length field, an identifier, flag fields, a load program status word (PSW) and a load address. The combined component is digitally signed. During IPL, the unsigned component table entries associated with the signed component are verified against the SCLAB contents.
Claims20
A method, comprising:
- appending a secure-code-loading-attributes block (SCLAB) to a variable sized signed binary code component to generate a combined component, wherein the variable sized signed binary code component is Operating System (OS) code for an initial program load (IPL) process, and wherein the SCLAB comprises contents including a length field, an identifier, flag fields, a load program status word (PSW) and a load address,
- signing the combined component using a private key, and
- verifying the signed combined component during the IPL.
A computer program product, the computer program product comprising a non-transitory tangible storage device having program code embodied therewith, the program code executable by a processor of a computer to perform a method, the method comprising:
- appending a secure-code-loading-attributes block (SCLAB) to a variable sized signed binary code component to generate a combined component, wherein the variable sized signed binary code component is Operating System (OS) code for an initial program load (IPL) process, and wherein the SCLAB comprises contents including a length field, an identifier, flag fields, a load program status word (PSW) and a load address;
- signing the combined component using a private key;
- and
- verifying the signed combined component against the SCLAB contents during the IPL.
A computer system, comprising:
- one or more processors;
- a memory coupled to at least one of the processors;
- a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform actions of:
- appending a secure-code-loading-attributes block (SCLAB) to a variable sized signed binary code component to generate a combined component, wherein the variable sized signed binary code component is Operating System (OS) code for an initial program load (IPL) process, and wherein the SCLAB comprises contents including a length field, an identifier, flag fields, a load program status word (PSW) and a load address;
- signing the combined component using a private key;
- and
- verifying the signed combined component against the SCLAB contents during the IPL.
Dependencies are inferred from the claim text.