Client authentication during network boot

A system comprising:

• a database comprising at least one identifier for a remote device and a public encryption key associated with said remote device;
• a network interface;
• a pre-boot communications engine configured to receive a network boot request and said at least one identifier from said remote device and establish communications with said remote device through said network interface;
• a command sequence comprising an ownership command for said remote device, said ownership command establishing a network boot server as having ownership of the remote device so as to prevent other devices from being able to perform network boot sequences with the remote device;
• an encryption mechanism configured to use said public encryption key to generate an encrypted ownership command;
• and
• said pre-boot communications engine configured to participate in a two-way authentication exchange with said remote device, including:
• transmit said encrypted ownership command to said remote device using a pre-boot communications service;
• receive a response from said remote device based on said command sequence, the response indicative of:
• said remote device having decrypted said encrypted ownership command using a matching private encryption key;
• and
• said remote device having at least attempted to perform said ownership command;
• and
• wherein said pre-boot communications are configured to be performed prior to booting said remote device and said remote device is configured to be authenticated prior to downloading bootable software.

A computer program product for use at a computer system, the computer program product for implementing a method for securely booting a device over a network, the computer program product comprising one or more computer storage devices having stored thereon computer-executable instructions that, when executed at a processor, cause the computer system readable to perform the method, including the following:

• receive a network boot request from a remote device, said network boot request comprising an identifier for said remote device, and said network boot request being a Preboot eXecution Environment (PXE) request;
• look up said identifier in a database to receive a public encryption key for said remote device, said identifier being received into said database through a secondary channel;
• encrypt an ownership command for a Trusted Platform Module associated with said remote device to create an encrypted ownership command, said encrypting being performed with said public encryption key, said ownership command establishing a network boot server as having ownership of the remote device so as to prevent other devices from being able to perform network boot sequences with the remote device, the public encryption key included in a public-private key pair;
• participate in a two-way authentication exchange with said remote device, including:
• transmit said encrypted command to said remote device;
• and
• receive a response from said remote device based on said ownership command, the response indicative of:
• said remote device having decrypted said encrypted ownership command using a private encryption key, said private encryption key included in said public-private key pair;
• and
• said remote device having at least attempted to perform said ownership command;
• and
• transmit boot software to said remote device subsequent to participating in said two-way authentication exchange, the boot software for execution at said remote device to start up said remote device.