Method and Apparatus for a Secure Network Install

• US 20080256221A1
• Filed: 05/28/2008
• Published: 10/16/2008
• Est. Priority Date: 07/21/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Vallabhaneni, Vasu, Sharma, Rakesh
• Granted Patent: US 7,941,509 B2
• Time in Patent Office: Days
• US Class Current: 709/222
• CPC Class Codes: G06F 9/4416 Network booting; Remote initial program loading [RIPL]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

A method, an apparatus, and computer instructions are provided for a secure network install. One aspect of the present invention provides a proxy server within the same subnet of the client for performing a lookup of the boot image file and downloading the boot image file from a boot file server in a secure manner. The client in turn downloads the file from the proxy TFTP server. Another aspect of the present invention modifies the client remote boot code to include a secure boot file download discovery (SBDD) mode. The client starts the SBDD mode by sending a request for a boot image file to a subnet broadcast address and port, which is listened by a proxy TFTP server. The proxy TFTP server receives the client request and downloads the boot image file. The client in turn downloads the boot image file from the proxy TFTP server.

Claims

1. A computer implemented method in a proxy server for a secure network install, the computer implemented method comprising:

receiving a request for a boot image file from a client at the proxy server to form a received request, wherein the proxy server and the client are on a same subnet;

locating a boot image file server from a list of servers and corresponding boot image files for the boot image file to form a located boot image file;

retrieving the located boot image file from the boot image file server using a secure file transfer protocol to form a retrieved boot image file; and

sending the retrieved boot image file to the client.

2. The computer implemented method of claim 1, wherein the proxy server is a trivial file transfer protocol server.

3. The computer implemented method of claim 1, wherein the client receives a client Internet Protocol address, a location of the boot image file, and an Internet Protocol address of the proxy server from a dynamic host configuration protocol server.

4. The computer implemented method of claim 3, wherein the request for a boot image file includes the location of the boot image file and the client Internet Protocol address.

5. The computer implemented method of claim 1, wherein the locating step comprises:

performing a lookup of the boot image file in a mapping file, wherein the mapping file includes the list of servers and corresponding boot image files; and

identifying an Internet Protocol address of the boot image file server for the boot image file.

6. The computer implemented method of claim 1, wherein the secure file transfer protocol includes at least one of file encryption and checksum verification.

7. A computer implemented method in a proxy server for a secure network install, the computer implemented method comprising:

detecting a broadcast of a boot image file request initiated by a client at a subnet broadcast address and port used by the proxy server to form a detected request;

retrieving the boot image file from a boot image file server to the proxy server using a secure file transfer protocol based on the detected request to form a retrieved boot image file; and

sending the retrieved boot image file to the client.

9. The computer implemented method of claim 7, wherein the proxy server is a trivial file transfer protocol server and wherein the proxy server and the client are on a same subnet.

11. The computer implemented method of claim 7, wherein the client receives a client Internet Protocol address, a location of the boot image file, and an Internet Protocol address of the boot image file server from a dynamic host configuration protocol server.

12. The computer implemented method of claim 11, wherein the boot image file request includes the location of the boot image file and the Internet Protocol address of the boot image file server.

13. The computer implemented method of claim 7, wherein the subnet broadcast address and port is listened by all devices that belong to a same subnet.

14. The computer implemented method of claim 7, wherein the secure file transfer protocol includes at least one of file encryption and checksum verification.

8. A computer implemented method in a client for a secure network install, the computer implemented method comprising:

detecting a modification of a remote boot code of the client to include a secure boot image file download discovery mode;

initiating the secure boot image file download discovery mode to send a request for a boot image file to a subnet broadcast address and port; and

receiving the boot image file from a proxy server, wherein the proxy server and the client are on a same subnet.

10. The computer implemented method of claim 8, wherein the remote boot code is a set of instructions embedded within firmware of the client for locating and downloading the boot image file.

15. A computer program product comprising:

a computer usable medium having computer usable program code for a secure network install, the computer program product including;

computer usable program code for receiving a request for a boot image file from a client at a proxy server to form a received request, wherein the proxy server and the client are on a same subnet;

computer usable program code for locating a boot image file server from a list of servers and corresponding boot image files for the boot image file to form a located boot image file;

computer usable program code for retrieving the located boot image file from the boot image file server using a secure file transfer protocol to form a retrieved boot image file; and

computer usable program code for sending the retrieved boot image file to the client.

16. The computer program product of claim 15, wherein the proxy server is a trivial file transfer protocol server.

17. The computer program product of claim 15, wherein the client receives a client Internet Protocol address, a location of the boot image file, and an Internet Protocol address of the proxy server from a dynamic host configuration protocol server.

18. The computer program product of claim 15, wherein the boot image file request includes the location of the boot image file and the client Internet Protocol address.

19. The computer program product of claim 15, wherein the computer usable program code for locating the boot image file server from the list of servers and corresponding boot image files for the boot image file to form a located boot image file comprises:

computer usable program code for performing a lookup of the boot image file in a mapping file, wherein the mapping file includes the list of servers and corresponding boot image files; and

computer usable program code for identifying an Internet Protocol address of the boot image file server for the boot image file.

20. The computer program product of claim 15, wherein the secure file transfer protocol includes at least one of file encryption and checksum verification.

21. The computer program product of claim 15, wherein the computer usable program code is executed in a data processing system comprising:

a bus,

a storage device, wherein the storage device contains the computer usable program code;

a communications unit connected to the bus; and

a processing unit connected to the bus that executes the computer usable program code.

22. A computer program product comprising:

a computer usable medium having computer usable program code for a secure network install, the computer program product including;

computer usable program code for detecting a broadcast of a boot image file request initiated by a client at a subnet broadcast address and port used by a proxy server to form a detected request;

computer usable program code for retrieving the boot image file from a boot image file server using a secure file transfer protocol based on the detected request to form a retrieved boot image file; and

computer usable program code for sending the retrieved boot image file to the client.

23. The computer program product of claim 22, wherein the computer program product further comprises:

computer usable program code for detecting a modification of a remote boot code of the client to include a secure boot image file download discovery mode;

computer usable program code for initiating the secure boot image file download discovery mode to send a request for a boot image file to a subnet broadcast address and port; and

computer usable program code for receiving the boot image file from the proxy server, wherein the proxy server and the client are on a same subnet.

24. The computer program product of claim 22, wherein the proxy server is a trivial file transfer protocol server.

25. The computer program product of claim 23, wherein the remote boot code is a set of instructions embedded within firmware of the client for locating and downloading the boot image file.

26. The computer program product of claim 22, wherein the client receives a client Internet Protocol address, a location of the boot image file, and an Internet Protocol address of the boot image file server from a dynamic host configuration protocol server.

27. The computer program product of claim 22, wherein the boot image file request includes the location of the boot image file and the Internet Protocol address of the boot image file server.

28. The computer program product of claim 22, wherein the subnet broadcast address and port is listened by all devices that belong to a same subnet.

29. The computer program product of claim 22, wherein the secure file transfer protocol includes at least one of file encryption and checksum verification.

30. The computer program product of claim 23, wherein the computer usable program code is executed in a data processing system comprising:

a bus,

a storage device, wherein the storage device contains the computer usable program code;

a communications unit connected to the bus; and

a processing unit connected to the bus that executes the computer usable program code.