Loading patent…
AssigneeInternational Business Machines Corporation
InventorThomas Gschwind
Estimating the term…
In an approach to allowing a computer to boot from a user trusted device (UTD), the computer comprises a data storage device storing operating system (OS) services, and a version of an OS loader. The UTD is connectable to the computer and stores a boot loader, detectable by a firmware executing at the computer, and an OS loader, and wherein the UTD prevents an unauthenticated user to modify the boot loader and the OS loader stored thereon. The computer then, upon connection, lets the boot loader be detected by the firmware for execution of the boot loader at least partly at the computer, to cause to transfer the OS loader from the UTD to the computer, and executes the transferred OS loader at least partly from the computer, to execute at least one crypto driver for the OS, to start the OS services and complete booting of the computer.
A method for allowing a computer to boot from a user trusted device, wherein:
A computer system for allowing a computer to boot from a user trusted device, the computer system comprising:
A computer program product for allowing a computer to boot from a user trusted device, the computer program product comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions executable by the computer to cause the computer to perform a method comprising:
Dependencies are inferred from the claim text.
Drawings are temporarily unavailable. Open the PDF at USPTO
From the US filing history. Foreign family members aren’t listed.
Loading of operating system: multiboot arrangements, i.e. selecting an operating system to be loaded
Loading of operating system: boot device selection
Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates…:…
Computing and data processing
About 9 years of term left · ends 22 Oct 2035 (estimated)
The invention relates in general to the field of methods for securely booting computers, and in particular to methods for booting a computer from a user trusted device, such as a light, protected memory device.
Today, more and more computer users encrypt their hard disks (or more generally their long-term data storage device) to ensure that, in case of loss of the hard disk, the “finder” does not gain access to the user's data. Full disk encryption works fine to prevent such a finder to access the data. However, the usual disk encryption solutions do not prevent somebody who has access to the computer to spy out the legitimate user's password.
Systems that use encrypted disks need to be able to boot the computer from the hard disk, which can be accomplished by using an operating system (“OS”) loader that is unencrypted, where the OS loader typically includes a boot loader. The BIOS (or the initializing firmware) would otherwise not be able to decrypt it and hence start it. This boot loader then prompts the user for a passphrase that is used to unlock the encryption key. With this key, the encrypted contents of the hard disk can be decrypted and the operating system can subsequently be started.
FIG. 1 schematically represents a general purpose computerized system according to embodiments of the invention; this system is specifically designed for implementing method steps involved in embodiments of the invention;
FIG. 2 schematically represents a user trusted device, according to embodiments of the invention; this device is specifically designed for implementing method steps involved in embodiments of the invention;
FIG. 3 is a flowchart illustrating high-level steps of a method for allowing a computer to boot from a user trusted device, according to embodiments;
The following description is structured as follows. First, general embodiments and high-level variants are described (sect. 1). The next section (sect. 2) addresses more specific embodiments and technical implementation details.
Referring more particularly to FIGS. 3-4, an aspect of the invention is first described, which concerns methods for allowing a computer 10 to boot from a user trusted device 20. Some of the numeral references below refer to FIGS. 1 and 2, which respectively depict a computerized system (basically comprising a computer and a user trusted device connectable thereto) and such a user trusted device.
The context is the following. Basically, the computer comprises a long-term data storage device 11, which stores operating system services (hereafter called OS services), as well as a version of an operating system loader 24 (hereafter OS loader). Beyond the OS loader 24 and the OS services, the PC may further store other components of the OS itself, e.g., the OS kernel, system libraries, the crypto driver(s), and device drivers for the OS; the PC may further store application programs of the OS, although such components may also be stored elsewhere but such as to be available to the PC, as needed for booting. The long-term data storage device typically is a hard-disk drive (or HDD) or a solid-state memory or any other suitable mass storage device. Note that, in accordance with their usual meaning, the OS services are, here, not considered to include the OS kernel.