Secure management of configuration parameters in a computing platform

• US 20040025011A1
• Filed: 07/14/2003
• Published: 02/05/2004
• Est. Priority Date: 07/30/2002
• Status: Active Grant

• Current Assignee: Texas Instruments, Inc.
• Original Assignee: Texas Instruments, Inc.
• Inventors: Azema, Jerome, Chateau, Alain, Balard, Eric
• Granted Patent: US 8,122,244 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A computing platform (10) protects system firmware (30) using a manufacturer certificate (36). The manufacturer certificate binds the system firmware (30) to the particular computing platform (10). The manufacturer certificate also stores configuration parameters and device identification numbers. A secure run-time platform data checker (200) and a secure run-time checker (202) check the system firmware during operation of the computing platform (10) to ensure that the system firmware (30) or information in the manufacturer certificate (36) has not been altered. Application software files (32) and data files (34) are bound to the particular computing device (10) by a platform certificate (38). Configuration parameters may be stored in a data file (34) with an associated platform certificate (38).

Claims

1. A method of configuring a processing device, comprising the steps of:

accessing a certificate bound to the processing device;

authenticating the certificate;

reading configuration parameters from the certificate, if properly authenticated;

configuring the processing device responsive to the configuration parameters.

2. The method of claim 1 wherein the steps of accessing the certificate, authenticating the certificate, and reading configuration parameters from the certificate are performed whenever the processing device is initially powered.

3. The method of claim 2 wherein the steps of accessing the certificate, authenticating the certificate, and reading configuration parameters from the certificate are repeated upon a system reset/boot.

4. The method of claim 1 wherein the configuring step includes the step of configuring hardware in the processing device responsive to the configuration parameters.

5. The method of claim 1 wherein the configuring step includes the step of configuring software in the processing device responsive to the configuration parameters.

6. A processing device comprising:

processing circuitry;

a memory coupled to the processing circuitry;

wherein the processing circuitry;

accesses a certificate bound to the processing device and stored in the memory;

authenticates the certificate;

reads configuration parameters from the certificate, if properly authenticated;

configures the processing device responsive to the configuration parameters.

7. The processing device of claim 6 wherein the processing circuitry accesses the certificate, authenticates the certificate, and reads configuration parameters from the certificate whenever the processing device is initially powered.

8. The processing device of claim 7 wherein the processing circuitry accesses the certificate, authenticates the certificate, and reads configuration parameters from the certificate upon a system reset/boot.

9. The processing device of claim 6 wherein the processing circuitry configures hardware in the processing device responsive to the configuration parameters.

10. The processing device of claim 6 wherein the processing circuitry configures software in the processing device responsive to the configuration parameters.

11. The processing device of claim 6 wherein the certificate can be created and modified only by the manufacturer of the processing device.

12. A method of configuring a processing device, comprising the steps of:

accessing a certificate bound to the processing device;

authenticating the certificate;

reading configuration parameters from a data file associated with the certificate, if the certificate is properly authenticated;

configuring the processing device responsive to the configuration parameters.

13. The method of claim 12 wherein the steps of accessing the certificate, authenticating the certificate, and reading configuration parameters are performed whenever the processing device is initially powered.

14. The method of claim 13 wherein the steps of accessing the certificate, authenticating the certificate, and reading configuration parameters are repeated upon a system reset/boot.

15. The method of claim 12 wherein the configuring step includes the step of configuring hardware in the processing device responsive to the configuration parameters.

16. The method of claim 12 wherein the configuring step includes the step of configuring software in the processing device responsive to the configuration parameters.

17. A processing device comprising:

processing circuitry;

a memory coupled to the processing circuitry;

wherein the processing circuitry;

accesses a certificate bound to the processing device and stored in the memory;

authenticates the certificate;

reads configuration parameters from a data file associated with the certificate, if the certificate is properly authenticated;

configures the processing device responsive to the configuration parameters.

18. The processing device of claim 17 wherein the processing circuitry accesses the certificate, authenticates the certificate, and reads configuration parameters whenever the processing device is initially powered.

19. The processing device of claim 18 wherein the processing circuitry accesses the certificate, authenticates the certificate, and reads configuration parameters upon a system reset/boot.

20. The processing device of claim 17 wherein the processing circuitry configures hardware in the processing device responsive to the configuration parameters.

21. The processing device of claim 17 wherein the processing circuitry configures software in the processing device responsive to the configuration parameters.

22. The processing device of claim 17 wherein the certificate can be created and modified only by the manufacturer of the processing device.