Secure booting and provisioning

• US 20050149924A1
• Filed: 12/24/2003
• Published: 07/07/2005
• Est. Priority Date: 12/24/2003
• Status: Active Grant

• Current Assignee: Micron Technology, Inc.
• Original Assignee: Intel Corporation
• Inventors: Zimmer, Vincent J., Komarla, Eshwari P.
• Granted Patent: US 7,207,039 B2
• Time in Patent Office: Days
• US Class Current: 717/176
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 9/4416 Network booting; Remote initial program loading [RIPL]
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

Provided are techniques for booting and provisioning a platform connected to a boot and provisioning server including a server boot and provisioning system. The server boot and provisioning system receives a platform identifier, selects a platform specific boot image based on the platform identifier in response to determining that the platform identifier is valid, and selects a platform specific configuration policy based on the platform identifier in response to determining that the platform identifier is valid. Also provided are techniques for booting and provisioning a platform connected to a boot and provisioning server, wherein the platform includes a platform boot and provisioning system. A platform boot and provisioning system issues a request with option tags in response to determining that the platform is enabled to interact with a boot and provisioning server, issues a download request to obtain a boot image, and executes the boot image in response to determining that a signature of the boot image is valid.

Claims

1. A method for booting and provisioning a platform connected to a boot and provisioning server including a server boot and provisioning system, comprising:

receiving, with the server boot and provisioning system, a platform identifier;

selecting, with the server boot and provisioning system, a platform specific boot image based on the platform identifier in response to determining that the platform identifier is valid; and

selecting, with the server boot and provisioning system, a platform specific configuration policy based on the platform identifier in response to determining that the platform identifier is valid.

2. The method of claim 1, further comprising:

selecting a generic boot image in response to determining that the platform identifier is not valid.

3. The method of claim 2, further comprising:

obtaining a class of storage devices attached to the platform; and

selecting the configuration profile based on the class of the storage devices.

4. The method of claim 1, further comprising:

signing, with the server boot and provisioning system, at least a portion of the boot image or an associated tag with a private key.

5. The method of claim 1, further comprising:

signing, with the server boot and provisioning system, at least a portion of credentials.

6. The method of claim 1, receiving, with the server boot and provisioning system, a request with option tags.

7. A method for booting and provisioning a platform connected to a boot and provisioning server, wherein the platform includes a platform boot and provisioning system, comprising:

issuing, with the platform boot and provisioning system, a request with option tags in response to determining that the platform is enabled to interact with a boot and provisioning server;

issuing, with the platform boot and provisioning system, a download request to obtain a boot image; and

executing, with the platform boot and provisioning system, the boot image in response to determining that a signature of the boot image is valid.

8. The method of claim 7, further comprising:

requesting, with the platform boot and provisioning system, a configuration profile;

receiving, with the platform boot and provisioning system, the configuration profile; and

configuring, with the platform boot and provisioning system, storage devices connected to the platform using the configuration profile.

9. The method of claim 7, further comprising:

discovering, with the platform boot and provisioning system, a local boot image in response to determining that a local operating system is available.

10. A system in communication with data storage, comprising:

a platform including an Input/Output (I/O) processor;

a storage controller managing Input/Output (I/O) access to the data storage;

a boot and provisioning server including a server boot and provisioning system connected to the platform, wherein the server boot and provisioning system is capable of receiving a platform identifier, selecting a platform specific boot image based on the platform identifier in response to determining that the platform identifier is valid, and selecting a platform specific configuration policy based on the platform identifier in response to determining that the platform identifier is valid.

11. The system of claim 10, wherein the server boot and provisioning system is capable of selecting a generic boot image in response to determining that the platform identifier is not valid.

12. The system of claim 11, wherein the server boot and provisioning system is capable of obtaining a class of storage devices attached to the platform and selecting the configuration profile based on the class of the storage devices.

13. The system of claim 10, wherein the server boot and provisioning system is capable of signing at least a portion of the boot image or an associated tag with a private key.

14. The system of claim 10, wherein the server boot and provisioning system is capable of signing at least a portion of credentials.

15. The system of claim 10, wherein the server boot and provisioning system is capable of receiving a request with option tags.

16. A system coupled to a network and data storage, comprising:

a platform including an Input/Output (I/O) processor;

a storage controller managing Input/Output (I/O) access to the data storage;

a platform boot and provisioning system at the platform, wherein the platform boot and provisioning system is capable of issuing a request with option tags in response to determining that the platform is enabled to interact with a boot and provisioning server, issuing a download request to obtain a boot image, and executing the boot image in response to determining that a signature of the boot image is valid.

17. The system of claim 16, wherein the platform boot and provisioning system is capable of requesting a configuration profile, receiving the configuration profile, and configuring storage devices connected to the platform using the configuration profile.

18. The system of claim 16, wherein the platform boot and provisioning system is capable of discovering a local boot image in response to determining that a local operating system is available.

19. An article of manufacture comprising a storage medium having stored therein instructions that when executed by a computing device results in the following:

issuing a request with option tags in response to determining that the platform is enabled to interact with a boot and provisioning server;

issuing a download request to obtain a boot image; and

executing the boot image in response to determining that a signature of the boot image is valid.

20. The article of manufacture of claim 19, wherein the instructions when executed further result in the following:

selecting a generic boot image in response to determining that the platform identifier is not valid.

21. The article of manufacture of claim 19, wherein the instructions when executed further result in the following:

obtaining a class of storage devices attached to the platform; and

selecting the configuration profile based on the class of the storage devices.

22. The article of manufacture of claim 19, wherein the instructions when executed further result in the following:

signing at least a portion of the boot image or an associated tag with a private key.

23. The article of manufacture of claim 19, wherein the instructions when executed further result in the following:

signing at least a portion of credentials.

24. The article of manufacture of claim 19, wherein the instructions when executed further result in the following:

receiving a request with option tags.

25. An article of manufacture comprising a storage medium having stored therein instructions that when executed by a computing device results in the following:

issuing a request with option tags in response to determining that the platform is enabled to interact with a boot and provisioning server;

issuing a download request to obtain a boot image; and

executing the boot image in response to determining that a signature of the boot image is valid.

26. The article of manufacture of claim 25, wherein the instructions when executed further result in the following:

requesting a configuration profile;

receiving the configuration profile; and

configuring storage devices connected to the platform using the configuration profile.

27. The article of manufacture of claim 25, wherein the instructions when executed further result in the following:

discovering a local boot image in response to determining that a local operating system is available.