Firmware Verified Boot

A computer-implemented boot process for a computing system, the boot process comprising:

• verifying, by a processor of the computing system, an encrypted signature corresponding with a first portion of a read-write portion of firmware of the computing system using a first public-key and a first cryptographic hash algorithm, wherein the computing system halts the boot process if the verification of the encrypted signature corresponding with the first portion of the read only firmware fails;
• verifying, by the processor, an encrypted signature corresponding with a second portion of the read-write portion of the firmware using a second public-key and a second cryptographic hash algorithm, wherein the computing system halts the boot process if the verification of the encrypted signature corresponding with the second portion of the read-write firmware fails;
• verifying, by the processor, an encrypted signature corresponding with a third portion of the read-write portion of the firmware using the second public-key and the second cryptographic hash algorithm, wherein the computing system halts the boot process if the verification of the encrypted signature corresponding with the third portion of the read-write firmware fails;
• verifying, by the processor, an encrypted signature corresponding with a first portion of an operating-system kernel using the second public-key and the second cryptographic hash algorithm, wherein the computing system halts the boot process if the verification of the encrypted signature corresponding with the first portion of the operating-system kernel fails;
• and
• verifying, by the processor, an encrypted signature corresponding with a second portion of an operating-system kernel using a third public-key and a third cryptographic hash algorithm, wherein the computing system halts the boot process if the verification of the encrypted signature corresponding with the second portion of the operating-system kernel fails.

A computing system comprising one or more machine readable storage media having instructions stored thereon, the instructions, when executed by a processor of the computing system, cause the computing system to:

• read, during a boot process, a header section of a read-write portion of firmware of the computing system;
• generate, using a first cryptographic hash algorithm, a message digest corresponding with the header;
• decrypt, using a first public-key, an encrypted signature corresponding with the header;
• compare the message digest corresponding with the header and the decrypted signature corresponding with the header;
• in the event the message digest corresponding with the header and the decrypted signature corresponding with the header match, continue the boot process;
• and
• in the event the message digest corresponding with the header and the decrypted signature corresponding with the header do not match, halt the boot process.

A computing system comprising one or more machine readable storage media having instructions stored thereon, the instructions, when executed by a processor of the computing system, cause the computing system to:

• verify an encrypted signature corresponding with a first portion of a read-write portion of firmware of the computing system using a first public-key and a first cryptographic hash algorithm, wherein the instructions cause the computing system to halt the boot process if the verification of the encrypted signature corresponding with the first portion of the read only firmware fails;
• verify an encrypted signature corresponding with a second portion of the read-write portion of the firmware using a second public-key and a second cryptographic hash algorithm, wherein the instructions cause the computing system to halt the boot process if the verification of the encrypted signature corresponding with the second portion of the read-write firmware fails;
• verify an encrypted signature corresponding with a third portion of the read-write portion of the firmware using the second public-key and the second cryptographic hash algorithm, wherein the instructions cause the computing system to halt the boot process if the verification of the encrypted signature corresponding with the third portion of the read-write firmware fails;
• verify an encrypted signature corresponding with a first portion of an operating-system kernel using the second public-key and the second cryptographic hash algorithm, wherein the instructions cause the computing system to halt the boot process if the verification of the encrypted signature corresponding with the first portion of the operating-system kernel fails;
• and
• verify an encrypted signature corresponding with a second portion of an operating-system kernel using a third public-key and a third cryptographic hash algorithm, wherein the instructions cause the computing system to halt the boot process if the verification of the encrypted signature corresponding with the second portion of the operating-system kernel fails.

A computer-implemented boot process for a computing system, the boot process comprising:

• verifying, by a processor of the computing system, an encrypted signature corresponding with a first portion of a read-write portion of firmware of the computing system using a first public-key and a first cryptographic hash algorithm, wherein the computing system halts the boot process if the verification of the encrypted signature corresponding with the first portion of the read only firmware fails;
• verifying, by the processor, an encrypted signature corresponding with a second portion of the read-write portion of the firmware using a second public-key and a second cryptographic hash algorithm, wherein the computing system halts the boot process if the verification of the encrypted signature corresponding with the second portion of the read-write firmware fails;
• verifying, by the processor, an encrypted signature corresponding with a first portion of an operating-system kernel using the second public-key and the second cryptographic hash algorithm, wherein the computing system halts the boot process if the verification of the encrypted signature corresponding with the first portion of the operating-system kernel fails;
• and
• verifying, by the processor, an encrypted signature corresponding with a second portion of an operating-system kernel using a third public-key and a third cryptographic hash algorithm, wherein the computing system halts the boot process if the verification of the encrypted signature corresponding with the second portion of the operating-system kernel fails.

A computer-implemented boot process for a computing system, the boot process comprising:

• verifying, by a processor of the computing system, an encrypted signature corresponding with a first portion of a read-write portion of firmware of the computing system using a first public-key and a first cryptographic hash algorithm;
• if the verification of the encrypted signature corresponding with the first portion of the read-write portion of the firmware is successful, verifying, by the processor, an encrypted signature corresponding with a second portion of the read-write portion of the firmware using a second public-key and a second cryptographic hash algorithm;
• if the verification of the encrypted signature corresponding with the second portion of the read-write portion of the firmware is successful, verifying, by the processor, an encrypted signature corresponding with a third portion of the read-write portion of the firmware using the second public-key and the second cryptographic hash algorithm;
• if the verification of the encrypted signature corresponding with the third portion of the read-write portion of the firmware is successful, verifying, by the processor, an encrypted signature corresponding with a first portion of an operating-system kernel using the second public-key and the second cryptographic hash algorithm;
• and
• if the verification of the encrypted signature corresponding with the first portion of an operating-system kernel is successful, verifying, by the processor, an encrypted signature corresponding with a second portion of an operating-system kernel using a third public-key and a third cryptographic hash algorithm.