# US 2021/0334378 A1 · System and method of authenticating firmware > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0334378 A1 - Document ID: US20210334378A1 - Status: Published application - Kind: A1 - Application number: 16/857,518 - Filed: 2020-04-24 - Published: 2021-10-28 - Earliest claimed: 2020-04-24 - Assignees: Dell Products L.P. - Applicants: Dell Products L.P. - Inventors: Jeffrey Leighton Kennedy; Milton Olavo Taveira - Web page: https://patentgrep.com/patent/US20210334378A1 ## CPC - G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]} - G06F 13/36: for access to common bus or bus system - G06F 21/575: {Secure boot} - G06F 21/76: in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD] - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3236: {using cryptographic hash functions} - H04L 9/3247: {involving digital signatures} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one or more embodiments, one or more systems, one or more methods, and/or one or more processes may: receive firmware of an integrated circuit (IC) of an information handling system; receive a digital signature of the firmware, where the digital signature includes an encrypted hash value, encrypted with a private encryption key; determine a first hash value of the firmware; decrypt the encrypted hash value, via a public encryption key associated with the private encryption key, to obtain a second hash value; determine if the first hash value matches the second hash value; if so, permit the information handling system to boot an operating system; and if not, prevent, by the authentication device, the information handling system from booting the operating system. ## Claims ### Claim 1 An information handling system, comprising: at least one processor; and a first memory medium, coupled to the at least one processor, that stores instructions executable by the at least one processor; an integrated circuit (IC); and an authentication device; wherein the authentication device is configured to: access a second memory medium memory medium, which stores firmware of the IC and a digital signature of the firmware, to obtain the firmware; receive the firmware from the second memory medium; access the second memory medium to obtain the digital signature of the firmware, wherein the digital signature includes an encrypted hash value, encrypted via an asymmetric encryption process with a private encryption key; receive the digital signature of the firmware from the second memory medium; determine a first hash value of the firmware; decrypt the encrypted hash value, via the asymmetric encryption process with a public encryption key associated with the private encryption key, to obtain a second hash value; determine if the first hash value matches the second hash value; if the first hash value matches the second hash value, permit the information handling system to boot an operating system; and if the first hash value does not match the second hash value, prevent the information handling system from booting the operating system. ### Claim 2 (depends on 1) The information handling system of claim 1, wherein the authentication device includes the at least one processor, a platform controller hub of the information handling system, a baseboard management controller of the information handling system, or a microcontroller of the information handling system. ### Claim 3 (depends on 2) The information handling system of claim 2, wherein the authentication device includes the baseboard management controller or the microcontroller; and wherein the baseboard management controller or the microcontroller stores the public encryption key. ### Claim 4 (depends on 2) The information handling system of claim 2, further comprising: a non-volatile memory medium; wherein the non-volatile memory medium stores the public encryption key; wherein the authentication device includes the processor or the platform controller hub; and wherein the authentication device is further configured to: access the non-volatile memory medium to obtain the public encryption key; and receive the public encryption key from the non-volatile memory medium. ### Claim 5 (depends on 1) The information handling system of claim 1, wherein the IC includes a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). ### Claim 6 (depends on 1) The information handling system of claim 1, wherein, to receive the firmware of the IC, the authentication device is further configured to receive the firmware via one or more direct couplings; and wherein, to receive the digital signature, the authentication device is further configured to receive the digital signature via the one or more direct couplings. ### Claim 7 (depends on 1) The information handling system of claim 1, wherein, to receive the firmware of the IC, the authentication device is further configured to receive the firmware via a bus shared with at least one component of the information handling system other than the IC and the authentication device; and wherein, to receive the digital signature, the authentication device is further configured to receive the digital signature via the bus. ### Claim 8 A method, comprising: accessing, by an authentication device an information handling system, a memory medium associated with an integrated circuit (IC) of the information handling system to obtain firmware the IC; receiving, by the authentication device, the firmware of the IC from the memory medium; accessing, by the authentication device, the memory medium to obtain a digital signature of the firmware, wherein the digital signature includes an encrypted hash value, encrypted via an asymmetric encryption process with a private encryption key; receiving, by the authentication device, the digital signature of the firmware from the memory medium; determining, by the authentication device, a first hash value of the firmware; decrypting, by the authentication device, the encrypted hash value, via the asymmetric encryption process with a public encryption key associated with the private encryption key, to obtain a second hash value; determining, by the authentication device, if the first hash value matches the second hash value; if the first hash value matches the second hash value, permitting, by the authentication device, the information handling system to boot an operating system; and if the first hash value does not match the second hash value, preventing, by the authentication device, the information handling system from booting the operating system. ### Claim 9 (depends on 8) The method of claim 8, wherein the authentication device includes a processor of the information handling system, a platform controller hub of the information handling system, a baseboard management controller of the information handling system, or a microcontroller of the information handling system. ### Claim 10 (depends on 9) The method of claim 9, wherein the authentication device includes the baseboard management controller or the microcontroller; and wherein the baseboard management controller or the microcontroller stores the public encryption key. ### Claim 11 (depends on 9) The method of claim 9, wherein a non-volatile memory medium of the information handling system stores the public encryption key; and wherein the authentication device includes the processor or the platform controller hub; the method further comprising: accessing, by the authentication device, the non-volatile memory medium of the information handling system to obtain the public encryption key; and receiving, by the authentication device, the public encryption key from the non-volatile memory medium of the information handling system. ### Claim 12 (depends on 8) The method of claim 8, wherein the IC includes a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). ### Claim 13 (depends on 8) The method of claim 8, wherein the receiving the firmware of the IC includes receiving the firmware via one or more direct couplings; and wherein the receiving the digital signature includes receiving the digital signature via the one or more direct couplings. ### Claim 14 (depends on 8) The method of claim 8, wherein the receiving the firmware of the IC includes receiving the firmware via a bus shared with at least one component of the information handling system other than the IC and the authentication device; and wherein the receiving the digital signature includes receiving the digital signature via the bus. ### Claim 15 An authentication device, comprising: a processor; and a first memory medium, coupled to the processor, that stores instructions executable by the processor, which when executed by the processor, cause the authentication device to: access a second memory medium associated with an integrated circuit (IC) of an information handling system to obtain firmware the IC; receive the firmware from the second memory medium; access the second memory medium of the IC to obtain a digital signature of the firmware, wherein the digital signature includes an encrypted hash value, encrypted via an asymmetric encryption process with a private encryption key; receive the digital signature of the firmware from the second memory medium; determine a first hash value of the firmware; decrypt the encrypted hash value, via the asymmetric encryption process with a public encryption key associated with the private encryption key, to obtain a second hash value; if the first hash value matches the second hash value, permit the information handling system to boot an operating system; and if the first hash value does not match the second hash value, prevent the information handling system from booting the operating system. ### Claim 16 (depends on 15) The authentication device of claim 15, wherein the authentication device includes a baseboard management controller or a microcontroller; and wherein the baseboard management controller or the microcontroller stores the public encryption key. ### Claim 17 (depends on 16) The authentication device of claim 16, wherein a non-volatile memory medium of the information handling system stores the public encryption key; and wherein the authentication device includes a processor of the information handling system or a platform controller hub of the information handling system; wherein the authentication device is further configured to: access the non-volatile memory medium to obtain the public encryption key; and receive the public encryption key from the non-volatile memory medium. ### Claim 18 (depends on 15) The authentication device of claim 15, wherein the IC includes a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). ### Claim 19 (depends on 15) The authentication device of claim 15, wherein, to receive the firmware of the IC, the authentication device is further configured to receive the firmware via one or more direct couplings; and wherein, to receive the digital signature, the authentication device is further configured to receive the digital signature via the one or more direct couplings. ### Claim 20 (depends on 15) The authentication device of claim 15, wherein, to receive the firmware of the IC, the authentication device is further configured to receive the firmware via a bus shared with at least one component of the information handling system other than the IC and the authentication device; and wherein, to receive the digital signature, the authentication device is further configured to receive the digital signature via the bus.