# US 2018/0024840 A1 · Booting computer from user trusted device with an operating system loader stored thereon

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0024840 A1
- Document ID: US20180024840A1
- Status: Published application
- Kind: A1
- Application number: 15/721,999
- Filed: 2017-10-02
- Published: 2018-01-25
- Earliest claimed: 2014-06-26
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Thomas Gschwind
- Web page: https://patentgrep.com/patent/US20180024840A1

## CPC

- G06F 9/441: {Multiboot arrangements, i.e. selecting an operating system to be loaded}
- G06F 9/4408: {Boot device selection}
- G06F 21/575: {Secure boot}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

In an approach to allowing a computer to boot from a user trusted device (UTD), the computer comprises a data storage device storing operating system (OS) services, and a version of an OS loader. The UTD is connectable to the computer and stores a boot loader, detectable by a firmware executing at the computer, and an OS loader, and wherein the UTD prevents an unauthenticated user to modify the boot loader and the OS loader stored thereon. The computer then, upon connection, lets the boot loader be detected by the firmware for execution of the boot loader at least partly at the computer, to cause to transfer the OS loader from the UTD to the computer, and executes the transferred OS loader at least partly from the computer, to execute at least one crypto driver for the OS, to start the OS services and complete booting of the computer.

## Claims

### Claim 1

A computer program product for allowing a computer to boot from a user trusted device, the computer program product comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions executable by the computer to cause the computer to perform a method comprising:
upon connection of the user trusted device to the computer, letting a boot loader be detected by a firmware for subsequent execution of the boot loader at least partly at the computer, to cause to transfer a OS loader from the user trusted device to the computer; and
executing the transferred OS loader at least partly from the computer, to cause to execute at least one crypto driver for the operating system and a kernel of the operating system, to start the operating system services and complete booting of the computer.

### Claim 2 (depends on 1)

The computer program product according to claim 1, wherein letting the boot loader be detected by the firmware further comprises:
storing an initial boot block comprising an initial 512 bytes of the transferred OS loader in a main memory of the computer at an address comprising 0000:7c00;
storing a remainder of the transferred OS loader in a long-term data storage device; and
modifying a boot environment by setting a dl register to a device identifier of the long-term data storage device;
wherein executing the transferred OS loader further comprises executing the transferred OS loader at least partly from the long-term data storage device of the computer and at least partly from the main memory of the computer;
wherein the method further comprises:
upon connection of the user trusted device to the computer, letting the boot loader be detected by a firmware of the computer for subsequent execution at least partly at the computer, to cause to:
compare the first version of the OS loader already on the computer to the transferred OS loader as transferred from the user trusted device;
if the compared versions do not differ, execute the transferred OS loader at least partly from the computer; and
if the compared versions differ, notifying a user that the compared versions differ;
monitoring, after completing the booting of the computer, changes to the version of the transferred OS loader, which resides unencrypted on the long-term data storage device of the computer; and
upon detecting a change to the version of the transferred OS loader, authenticating to the user trusted device and updating the OS loader stored on the user trusted device accordingly.