System and Method for Authenticating an Operating System to a Central Processing Unit, Providing the CPU/OS with Secure Storage, and Authenticating the CPU/OS to a Third Party

• US 20070118738A1
• Filed: 12/22/2006
• Published: 05/24/2007
• Est. Priority Date: 10/26/1998
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: England, Paul, DeTreville, John, Lampson, Butler
• Granted Patent: US 7,457,412 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: G06F 21/1011 to devices
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06F 9/4406 Loading of operating system
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

In accordance with certain aspects, a computer system has a central processing unit (CPU) and an operating system (OS), the CPU having a pair of private and public keys and a software identity register that holds an identity of the operating system. An OS certificate is created including the identity from the software identity register, information describing the operating system, and the CPU public key. The created OS certificate is signed using the CPU private key.

Claims

1. In a computer system having a central processing unit (CPU) and an operating system (OS), the CPU having a pair of private and public keys and a software identity register that holds an identity of the operating system, a method comprising:

creating an OS certificate including the identity from the software identity register, information describing the operating system, and the CPU public key; and

signing the OS certificate using the CPU private key.

2. The method as recited in claim 1, further comprising submitting the signed OS certificate over a network to a third party to prove an identity of the operating system to the third party.

3. The method as recited in claim 1, wherein creating an identity of the OS comprises forming the OS certificate with one or more items from a boot log containing identities of software components that are executing on the CPU.

4. The method as recited in claim 1, the computer system further maintaining a boot log that holds identities of software components that are currently executing, the method further comprising:

forming a generator seed from a CPU-specific secret, a user-supplied seed, and OS-specific data from the boot log; and

generating a storage key based on a function of the generator seed.

5. In a computer system having a central processing unit (CPU) and an operating system (OS), the CPU having a pair of private and public keys and a software identity register that holds an identity of the operating system, the computer system further maintaining a boot log that holds identities of software components that are currently executing, a method comprising:

forming a generator seed from a CPU-specific secret, a user-supplied seed, and OS-specific data from the boot log; and

generating a storage key based on a function of the generator seed.

6. The method as recited in claim 5, wherein forming a generator key and generating a storage key comprises creating a storage key SK as follows:

SK=SHA(CPU-specific secret, OS-specific data, seed).

7. The method as recited in claim 5, further comprising encrypting data using the storage key.

8. For execution on a computer system having a central processing unit (CPU) and an operating system (OS), the CPU having a pair of private and public keys and a software identity register that holds an identity of the operating system, a computer program stored on one or more computer-readable storage media of the computer system, the program comprising:

forming an OS certificate containing the identity from the software identity register, information describing the operating system, and the CPU public key; and

signing the OS certificate using the CPU private key.