Method and apparatus for assessing integrity of computer system software

A computer system comprising:

• a processor;
• random access memory;
• read only memory containing a first program executed by said processor upon resetting of the computer system;
• storage means for storing second and third programs to be executed by said processor;
• and
• a non-volatile memory device having a first code value and accessible to said processor, said first code value being a modification detection code of said second program, said non-volatile memory device being readable and writable by said processor after a first reset of the computer system, being write protected after receipt of a designated signal from said processor and being made writable again only after a second reset of the computer system,
• wherein said first program includes:
• means to load said second program into said random access memory;
• means to the compute the modification detection code of said second program loaded into said random access memory;
• means to determine if said computed modification detection code of said second program is equal to said code value stored in said non-volatile memory device, to provide said designated signal to said non-volatile memory device if said computed modification detection code of said second program is equal to said code value and to cause execution of said second program loaded into said random access memory after providing said designated signal;
• and
• means to halt operation of the computer system if said computed modification code of said second program is not equal to said first code value, and
• wherein said second program includes:
• means to store a second code value being a modification detection code of said third program;
• means to load said third program into said random access memory;
• means to compute the modification detection code of said third program loaded into said random access memory;
• means to determine if said computed modification detection code of said third program is equal to said second code value stored in said second program and to cause execution of said third program loaded into said random access memory if said computed modification detection code of said third program is equal to said second code value;
• and
• means to halt operation of the computer system if said computed modification code of said third program is not equal to said second code value.

The computer system of claim 14, wherein said storage means stores a fourth program to be executed by said processor and wherein said second program further includes:

• means to store a third code value being a modification detection code of said fourth program;
• means to load said fourth program into said random access memory;
• means to compute the modification detection code of said fourth program loaded into said random access memory;
• means to determine if said computed modification detection code of said fourth program is equal to said third code value stored in said second program and to cause execution of said fourth program loaded into said random access memory if said computed modification detection code of said fourth program is equal to said third code value;
• and
• means to halt operation of the computer system if said computed modification code of said fourth program is not equal to said third code value.

A computer system comprising:

• a processor;
• random access memory;
• read only memory containing a first program executed by said processor upon resetting of the computer system;
• first storage means for storing first operating system and user programs executed by said processor, said first storage means including a region for storing a second program loaded and executed by said processor;
• and
• a non-volatile memory device having a location for storing a first code value and accessible to said processor, said first code value being a modification detection code of said second program, said location being readable and writable by said processor after a first reset of the computer system, being write protected after receipt of a designated signal from said processor and being made writable again only after a second reset of the computer system,
• wherein said first program includes:
• means to determine if said second program is present and to load said second program into said random access memory if said second program is present;
• means to compute the modification detection code of said second program loaded into said random access memory;
• means to determine if said computed modification code of said second program is equal to said first code value stored in said non-volatile memory device, to provide said designated signal to said non-volatile memory device if said computed modification detection code of said second program is equal to said first code value and to cause execution of said second program loaded into said random access memory after providing said designated signal;
• and
• means to prevent execution of said second program if said computed modification code of said second program is not equal to said first code value.

A computer system comprising:

• a processor;
• random access memory;
• read only memory containing a first program executed by said processor upon resetting of the computer system;
• first storage means for storing a plurality of programs executed by said processor, said plurality of programs including second, third and fourth programs;
• a non-volatile memory device having a location for storing a first code value and accessible to said processor, said first code value being a modification detection code of said third program, said location being readable and writable by said processor after a first reset of the computer system, being write protected after receipt of a designated signal from said processor and being made writable again only after a second reset of the computer system;
• and
• means for controlling loading of said plurality of programs so that said second program is loaded and executed before said fourth program is loaded and executed,
• wherein said second program includes:
• means for storing a first identification sequence;
• means to receive an identification sequence;
• means to determine if said received identification sequence is equal to said first stored identification sequence and to complete operation of said second program without providing said designated signal to said non-volatile memory device if said received identification sequence is equal to said first stored identification sequence before completing operation of said second program;
• and
• means to determine if said received identification sequence is not equal to said first stored identification sequence and to provide said designated signal to said non-volatile memory device if said received identification sequence is not equal to said first stored identification sequence before completing operation of said second program;
• wherein said third program includes:
• means to load one of a plurality of said plurality of programs into said random access memory, said plurality of said plurality of programs including said second program;
• means for storing a modification detection code for said one of a plurality of programs loaded into said random access memory;
• means to compute the modification detection code of said one of a plurality of programs loaded into said random access memory;
• means to determine if said computed modification code of said one of a plurality of programs is equal to said stored modification code and to cause execution of said one of a plurality of programs loaded into said random access memory if said computed modification detection code of said one of a plurality of programs is equal to said stored modification code without providing said designated signal to said non-volatile memory device;
• and
• means to prevent execution of said one of a plurality of programs if said computed modification code of said one of a plurality of programs is not equal to said stored modification code,
• wherein said fourth program is a program other than said plurality of programs having modification detection codes stored by said third program, and
• wherein said first program includes:
• means to load said third program into said random access memory;
• means to compute the modification detection code of said third program loaded into said random access memory;
• means to determine if said computed modification code of said third program is equal to said first code value stored in said non-volatile memory device and to cause execution of said third program loaded into said random access memory if said computed modification detection code of said third program is equal without providing said designated signal to said non-volatile memory device;
• and
• means to prevent execution of said third program if said computed modification code of said third program is not equal to said first code value.

A method for operating a computer system, the computer system including a processor;

• random access memory;
• read only memory containing a first program executed by said processor upon resetting of the computer system;
• first storage means for storing first operating system and user programs executed by said processor, said first storage means including a region for storing a second program loaded and executed by said processor to commence booting the computer system from said first storage means;
• second storage means for storing second operating system and user programs executed by said processor, said second storage means including a region for storing a third program loaded and executed by said processor to commence booting the computer system from said second storage means;
• and a non-volatile memory device having locations for storing first and second code values and accessible to said processor, said first code value being a modification detection code of said second program and said second code value being a modification detection code of said third program, said locations being readable and writable by said processor after a first reset of the computer system, being write protected after receipt of a designated signal from said processor and being made writable again only after a second reset of the computer system, the method comprising the steps of:
• resetting the computer system and executing the first program,
• whereupon the first program causes execution of the following steps:
• determining if either of said second or third programs is present and loading said second or third program into said random access memory;
• computing the modification detection code of the program loaded into said random access memory;
• determining if said computed modification code is equal to said first code value stored in said non volatile memory device;
• providing said designated signal to said non-volatile memory device if said computed modification detection code is equal to said first code value;
• executing the program loaded into said random access memory after providing said designated signal;
• determining if said computed modification detection code is equal to said second code value stored in said non-volatile memory device;
• executing the program loaded into said random access memory without providing said designated signal to said non-volatile memory device if said computed modification detection code is equal to said second code value;
• and
• halting operation of the computer system if said computed modification code is not equal to either said first code value or said second code value.

A method for operating a computer system, the computer system including a processor;

• random access memory;
• read only memory containing a first program executed by said processor upon resetting of the computer system;
• storage means for storing second and third programs to be executed by said processor;
• and a non-volatile memory device having a first code value and accessible to said processor, said first code value being a modification detection code of said second program, said location being readable and writable by said processor after a first reset of the computer system, being write protected after receipt of a designated signal from said processor and being made writable again only after a second reset of the computer system, the method comprising the steps of:
• resetting the computer system and executing the first program,
• whereupon the first program causes execution of the following steps:
• loading said second program into said random access memory;
• computing the modification detection code of said second program loaded into said random access memory;
• determining if said computed modification detection code of said second program is equal to said code value stored in said non-volatile memory device;
• providing said designated signal to said non-volatile memory device if said computed modification detection code of said second program is equal to said code value;
• executing said second program loaded into said random access memory after providing said designated signal;
• and
• halting operation of the computer system if said computed modification code of said second program is not equal to said first code value, and
• whereupon the second program causes execution of the following steps:
• loading said third program into said random access memory;
• computing the modification detection code of said third program loaded into said random access memory;
• determining if said computed modification detection code of said third program is equal to a second code value stored in said second program;
• executing said third program loaded into said random access memory if said computed modification detection code of said third program is equal to said second code value;
• and
• halting operation of the computer system if said computed modification code of said third program is not equal to said second code value.

A method for operating a computer system, the computer system including a processor;

• random access memory;
• read only memory containing a first program executed by said processor upon resetting of the computer system;
• first storage means for storing first operating system and user programs executed by said processor, said first storage means including a region for storing a second program loaded and executed by said processor;
• and a non-volatile memory device having a location for storing a first code value and accessible to said processor, said first code value being a modification detection code of said second program, said location being readable and writable by said processor after a first reset of the computer system, being write protected after receipt of a designated signal from said processor and being made writable again only after a second reset of the computer system, the method comprising the steps of:
• resetting the computer system and executing the first program,
• whereupon the first program causes execution of the following steps:
• determining if said second program is present and loading said second program into said random access memory if present;
• computing the modification detection code of said second program loaded into said random access memory;
• determining if said computed modification code of said second program is equal to said first code value stored in said non-volatile memory device;
• providing said designated signal to said non-volatile memory device if said computed modification detection code of said second program is equal to said first code value;
• executing said second program loaded into said random access memory after providing said designated signal;
• and
• preventing execution of the second program if said computed modification code of said second program is not equal to said first code value.

A method for operating a computer system, the computer system including a processor;

• random access memory;
• read only memory containing a first program executed by said processor upon resetting of the computer system;
• first storage means for storing a plurality of programs executed by said processor, said plurality of programs including second, third and fourth programs;
• and a non-volatile memory device having a location for storing a first code value and accessible to said processor, said first code value being a modification detection code of said third program, said location being readable and writable by said processor after a first reset of the computer system, being write protected after receipt of a designated signal from said processor and being made writable again only after a second reset of the computer system, the method comprising the steps of:
• resetting the computer system and executing the first program;
• said second program causing the execution of the following steps on the computer system:
• receiving an identification sequence;
• determining if said received identification sequence is equal to a first identification sequence and to provide said designated signal to said non-volatile memory device if said received identification sequence is equal to said first identification sequence before completing execution of said second program;
• and
• determining if said received identification sequence is equal to a second identification sequence and to complete execution of said second program without providing said designated signal to said non volatile memory device if said received identification sequence is equal to said second identification sequence before completing execution of said second program;
• said third program causing execution of the following steps on the computer system:
• loading one of a plurality of said plurality of programs into said random access memory, said plurality of said plurality of programs including said second program;
• computing the modification detection code of said one of a plurality of programs loaded into said random access memory;
• determining if said computed modification code of said one of a plurality of programs is equal to a stored modification code of said one of a plurality of programs and causing execution of said one of a plurality of programs loaded into said random access memory if said computed modification detection code of said one of a plurality of programs is equal to said stored modification code without providing said designated signal to said non-volatile memory device;
• and
• preventing execution of said one of a plurality of programs if said computed modification code of said one of a plurality of programs is not equal to said stored modification code;
• said first program causing execution of the following steps on the computer system:
• loading said third program into said random access memory;
• computing the modification detection code of said third program loaded into said random access memory;
• determining if said computed modification code of said third program is equal to said first code value stored in said non-volatile memory device;
• executing said third program loaded into said random access memory if said computed modification detection code of said third program is equal without providing said designated signal to said non-volatile memory device;
• and
• preventing execution of said third program if said computed modification code of said third program is not equal to said first code value;
• and
• controlling loading of said plurality of programs so that said second program is loaded and executed before said fourth program is loaded and executed,
• wherein said fourth program is a program other than said plurality of programs having modification detection codes stored by said third program.