Back to results
US 12,755,022 B2Granted
Trust zone attestation for secure loading of service OS
AssigneeDell Products L.P.
InventorsShekar Babu Suryanarayana, Manjunath Gr, Venkata Rama Krishna Rao Atta
Life of this patent
Estimating the term…
Abstract
Disclosed subject matter implements a secure, cloud-based boot sequence for a recovery OS. In at least some embodiments, a three phase solution is employed. The first phase, which may occur during the DXE phase of a boot sequence, establishes trust by configuring at least a portion of the system memory as a trust zone RAM disk and attesting modules that interact with the RAM disk. The second phase downloads files from the cloud and performs a cumulative hash verification and handshaking with the EC. During the third phase, a memory identification table for the trust zone is migrated to OS runtime environment to enable secured, OS runtime access to the RAM disk contents.
Claims12
A method, comprising:
- during a pre-EFI initialization (PEI) phase of a universal extensible firmware interface (UEFI) boot sequence for an information handling system including a central processing unit (CPU), a system memory of one or more random access memory (RAM) devices, an embedded controller (EC) to provide one or-more system management functions and one or more keyboard control functions, and a trusted platform manager (TPM), configuring, by the EC, at least a portion of the system memory as a trust zone;
- provisioning, by the TPM, a trust zone attestor (TZA) service to enable secure access to a RAM disk, wherein the RAM disk comprises a portion of the trust zone and wherein provisioning the TZA service includes provisioning the TZA service with a memory identifier (ID) table, wherein the memory ID table includes memory identifiers indicative of the portion of the trust zone corresponding to the RAM disk;
- attesting, by the TZA service, one or more disk interaction modules to enable said one or more disk interaction modules to access the RAM disk;
- fetching a list file, wherein the list file includes a listing of recovery operating system (OS) files for booting the information handling system to a recovery OS, individual hash values for each of the recovery OS files, and a first cumulative hash value encompassing the recovery OS files;
- downloading the recovery OS files to the RAM disk;
- and
- performing a cumulative hash verification of the recovery OS files, wherein the cumulative hash verification includes calculating, with a cryptographic hash function, individual hash values for each of the recovery OS files and calculating a second cumulative hash value for the recovery OS files residing on the RAM disk and determining whether the second cumulative hash values matches the first cumulative hash value, wherein the second cumulative hash value is calculated by a sum of the individual hash values;
- and
- responsive to the second cumulative hash value matching the first cumulative hash value, migrating the memory ID table to a recovery OS runtime environment to enable secure access to RAM disk contents during the OS runtime.
6 more elements
An information handling system, comprising:
- a central processing unit (CPU);
- a trusted platform manager (TPM);
- an embedded controller (EC) to provide one or more system management functions and one or more keyboard controller functions;
- and
- a system memory, of one or more random access memory (RAM) devices, including processor-executable instructions that, when executed by the CPU, cause the system to perform operations including:
- during a pre-EFI initialization (PEI) phase of a universal extensible firmware interface (UEFI) boot sequence for the information handling system, configuring, by the EC, at least a portion of the system memory as a trust zone;
- provisioning, by the TPM, a trust zone attestor (TZA) service to enable secure access to a RAM disk, wherein the RAM disk comprises a portion of the trust zone and wherein provisioning the TZA service includes provisioning the TZA service with a memory identifier (ID) table, wherein the memory ID table includes memory identifiers indicative of the portion of the trust zone corresponding to the RAM disk;
- attesting, by the TZA service, one or more disk interaction modules to enable said one or more disk interaction modules to access the RAM disk;
- fetching a list file, wherein the list file includes a listing of recovery operating system (OS) files for booting the information handling system to a recovery OS, individual hash values for each of the recovery OS files, and a first cumulative hash value encompassing the recovery OS files;
- downloading the recovery OS files to the RAM disk;
- and
- performing a cumulative hash verification of the recovery OS files, wherein the cumulative hash verification includes calculating a second cumulative hash value for the recovery OS files residing on the RAM disk and determining whether the second cumulative hash values matches the first cumulative hash value;
- and
- responsive to the second cumulative hash value matching the first cumulative hash value, migrating the memory ID table to a recovery OS runtime environment to enable secure access to RAM disk contents during the OS runtime.
11 more elements
Dependencies are inferred from the claim text.