Single Security Model In Booting A Computing Device

An electronic device, comprising:

• a processor;
• one or more hardware configuration registers to specify one or more hardware settings associated with the electronic device;
• a storage to store a plurality of executable code images, each representing a software components to be executed in order to establish an operating environment of the electronic device;
• and
• a secure ROM (read-only memory) to store one or more keys associated with the electronic device and a security code, wherein the security code when executed by the processor, is configured to authenticate each of the executable code images using the one or more keys and to verify each of the executable code images in view of the one or more hardware settings to ensure that each of the executable code images is compatible with the hardware settings before being executed.

A computer-implemented method, comprising:

• receiving an executable code image representing a software component to be installed in an electronic device, the software component being used to establish an operating environment of the electronic device;
• performing a hash of at least a portion of the executable code image to generate a signature for the executable code image;
• signing the signature using a certificate of a certificate chain derived from a root certificate that matches a fingerprint embedded within a secure ROM (read-only memory) of the electronic device;
• encapsulating the signature, the certificate chain, and the executable code image into an object signed by a leaf certificate of the certificate chain, wherein the object is to be stored in a storage within the electronic device, such that the object can be subsequently authenticated and verified using the certificate chain before being loaded in order to establish an operating environment of the electronic device.

A machine-readable medium having instructions stored therein, which when executable by a machine, cause the machine to perform a method, the method comprising:

• receiving an executable code image representing a software component to be installed in an electronic device, the software component being used to establish an operating environment of the electronic device;
• performing a hash of at least a portion of the executable code image to generate a signature for the executable code image;
• signing the signature using a certificate of a certificate chain derived from a root certificate that matches a fingerprint embedded within a secure ROM (read-only memory) of the electronic device;
• encapsulating the signature, the certificate chain, and the executable code image into an object signed by a leaf certificate of the certificate chain, wherein the object is to be stored in a storage within the electronic device, such that the object can be subsequently authenticated and verified using the certificate chain before being loaded in order to establish an operating environment of the electronic device.