# US 8,751,782 B2 · Secure local boot using third party data store (3PDS) based ISO image > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,751,782 B2 - Document ID: US8751782B2 - Status: Granted - Kind: B2 - Application number: 12/970,698 - Filed: 2010-12-16 - Published: 2012-06-21 - Granted: 2014-06-10 - Earliest claimed: 2010-12-16 - Assignees: Intel Corporation - Applicants: Hormuzd M. Khosravi; Divya Naidu Kolar Sundar; David M. Durham - Inventors: Hormuzd M. Khosravi; Divya Naidu Kolar Sundar; David M. Durham - Web page: https://patentgrep.com/patent/US8751782B2 ## CPC - G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]} - G06F 21/575: {Secure boot} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In some embodiments, the invention involves a method and apparatus for secure/authenticated local boot of a host operating system on a computing platform using active management technology (AMT) with a third party data store (3PDS)-based ISO firmware image. A portion of non-volatile memory is hardware secured against access by the host processor and OS, and accessible only to the AMT. The AMT comprises an AT/ATAPI protocol emulator to access an ISO boot image from secured memory, while appearing to the host processor as a communication with an AT/ATAPI device. Other embodiments are described and claimed. ## Claims ### Claim 1 A system for booting a host processor on a computing platform, the system comprising: a host processor on a computing platform coupled to a non-volatile memory residing on the computing platform and storing host firmware code; and a second processor on the computing platform coupled to an out-of-band communication interface, and also coupled to a protected portion of the non-volatile memory, the protected portion of non-volatile memory being inaccessible to the host processor; and manageability engine firmware executing on the second processor comprising: an emulator configured to emulate access protocols sent by the host firmware during host processor boot to transparently retrieve host processor boot information from the protected portion of the non-volatile memory, and wherein the emulator is further configured to locally emulate a remote IDE-Redirect server to communicate with a third-party data store (3PDS) flash memory to retrieve an international standard organization (ISO) boot image to serve as a local copy of the ISO boot image, wherein the emulator is further to read/write blocks from/to the local copy of the ISO boot image, wherein the host processor boot information includes the ISO boot image, and wherein the non-volatile memory includes the 3PDS flash memory. ### Claim 2 (depends on 1) The system as recited in claim 1, wherein the emulated access protocols are protocols for communication with an integrated development environment (IDE) storage device. ### Claim 3 (depends on 1) The system as recited in claim 1, wherein the emulator further comprises a block transfer logic unit. ### Claim 4 (depends on 1) The system as recited in claim 1, wherein the host processor boot information comprises boot strap code corresponding to the ISO boot image residing on a storage device coupled to the computing platform, wherein the ISO boot image resides in a sector other then sector 0 on the storage device, and wherein the second processor firmware further comprises an interface to the storage device. ### Claim 5 (depends on 1) The system as recited in claim 1, wherein the host processor is to access the protected portion of the non-volatile memory via the manageability engine firmware only during boot of the host processor. ### Claim 6 A computer implemented method for booting a host processor resident on a computing platform, the computing platform also having a second processor executing manageability engine firmware, the method comprising: commencing boot of the host processor on the computing platform; determining whether the host processor is provisioned to boot from a local IDE storage device utilizing the manageability engine firmware; sending integrated development environment (IDE) access commands by the host processor to access the IDE storage device; intercepting the sent IDE access commands by the manageability engine firmware; emulating, via an emulator, the IDE access commands, by the manageability engine firmware, wherein the emulator configured to emulate access protocols sent by the host firmware during host processor boot to transparently retrieve host processor boot information from the protected portion of the non-volatile memory; and returning boot information from a protected third party data store coupled to the computing platform, by the manageability engine firmware, wherein the protected third party data store is not directly accessible by the host processor, and wherein the emulator is further configured to locally emulate a remote IDE-Redirect server to communicate with a third-party data store (3PDS) flash memory to retrieve an international standard organization (ISO) boot image to serve as a local copy of the ISO boot image, wherein the emulator is further to read/write blocks from/to the local copy of the ISO boot image, wherein the host processor boot information includes the ISO boot image, and wherein the non-volatile memory includes the 3PDS flash memory. ### Claim 7 (depends on 6) The method as recited in claim 6, further comprising: booting the host processor using the ISO image, wherein access to the ISO image by the host processor is via the manageability engine firmware. ### Claim 8 (depends on 6) The method as recited in claim 6, wherein the boot information comprises boot strap code corresponding to a master boot record (MBR) in a storage device. ### Claim 9 (depends on 8) The method as recited in claim 8, further comprising: booting the host processor from the MBR in the storage device, wherein access to the storage device by the host processor is via an interface between the manageability engine firmware and the storage device. ### Claim 10 (depends on 8) The method as recited in claim 8, wherein the MBR corresponds to a non-Sector 0 location on the storage device. ### Claim 11 A non-transitory computer readable medium having instructions stored therein, the instructions when executed on a computing platform, cause the computing platform to: during boot of a host processor on the computing platform, determine whether the host processor is provisioned to boot from a local integrated development environment (IDE) storage device utilizing manageability engine firmware, the manageability engine firmware to execute on a second processor coupled to the computing platform; intercept IDE access commands sent by the host processor during boot to access the IDE storage device, by the manageability engine firmware; emulate, via an emulator, the IDE access commands by the manageability engine firmware, wherein the emulator configured to emulate access protocols sent by the host firmware during host processor boot to transparently retrieve host processor boot information from the protected portion of the non-volatile memory; and return boot information from a protected third party data store coupled to the computing platform, by the manageability engine firmware, wherein the protected third party data store is not directly accessible by the host processor, and wherein the emulator is further configured to locally emulate a remote IDE-Redirect server to communicate with a third-party data store (3PDS) flash memory to retrieve an international standard organization (ISO) boot image to serve as a local copy of the ISO boot image, wherein the emulator is further to read/write blocks from/to the local copy of the ISO boot image, wherein the host processor boot information includes the ISO boot image, and wherein the non-volatile memory includes the 3PDS flash memory. ### Claim 12 (depends on 11) The medium as recited in claim 11, further comprising instructions to: boot the host processor using the ISO image, wherein access to the ISO image by the host processor is via the manageability engine firmware. ### Claim 13 (depends on 11) The medium as recited in claim 11, wherein the boot information comprises boot strap code corresponding to a master boot record (MBR) in a storage device. ### Claim 14 (depends on 13) The medium as recited in claim 13, further comprising instructions to: boot the host processor from the MBR in the storage device, wherein access to the storage device by the host processor is via an interface between the manageability engine firmware and the storage device. ### Claim 15 (depends on 13) The medium as recited in claim 13, wherein the MBR corresponds to a non-Sector 0 location on the storage device.