Self-service terminal (SST) secure boot

• US 10,133,869 B2
• Filed: 03/09/2017
• Issued: 11/20/2018
• Est. Priority Date: 04/30/2014
• Status: Active Grant

• Current Assignee: NCR Corporation
• Original Assignee: NCR Corporation
• Inventors: Chisholm, Gordon, Horgan, Kevin, Benn, Campbell
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Gundry, Stephen T
• Application Number:
  US15/454,246
• Publication Number:
  US 20170177876A1
• Time in Patent Office: 621 Days
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 9/441 Multiboot arrangements, i.e. selecting an operating system to be loaded
• CPC Class Codes: G06F 9/4415 Self describing peripheral devices
• CPC Class Codes: G06F 9/442 Shutdown

Abstract

A Basic Input/Output System (BIOS) of a device is modified to: obtain a first value from a medium interfaced to the device, produce a second value from boot data resident on the medium, compare the first value to the second value, and boot from the boot data of the medium when the first value is equal to the second value.

Claims

1. A method, comprising:

configuring a boot process to generate a hash value from boot data residing on a portable non-transitory computer readable storage medium;

modifying a Basic Input/Output System (BIOS) to obtain a second hash value from header information residing on the portable non-transitory computer readable storage medium;

modifying the BIOS to process the hash process;

modifying the BIOS to compare the hash value against the second hash value;

modifying the BIOS to boot a device associated with the BIOS from the boot data when the hash value equals the second hash value, and wherein modifying the BIOS to boot further includes modifying the BIOS to;

activate a camera associated with the device to take an image of an individual that inserted the portable non-transitory computer readable storage medium into the device, record the image, and boot the device from existing boot data resident on the device when the hash value does not equal the second hash value;

certifying the modified BIOS for installation on the device; and

processing the modified BIOS on the device as boot processing for the device.

2. The method of claim 1, wherein configuring further includes configuring the hash process to use Logical Volume Integrity Descriptor (LVID) data obtained from the boot data to generate the hash value.