Method and System for Secure Booting Unified Extensible Firmware Interface Executables

• US 20100083002A1
• Filed: 09/30/2008
• Published: 04/01/2010
• Est. Priority Date: 09/30/2008
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: LONG, Qin, Yao, Jiewen, Zimmer, Vincent J., Cui, Liang
• Application Number:
  US12/242,655
• Publication Number:
  US 20100083002A1
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/575 Secure boot

Abstract

A method and computing device for secure booting of unified extensible firmware interface executables includes generating a platform private key, signing a third party credential, storing the signed third party credential in a database located in a trusted platform module, and executing a unified extensible firmware interface executable only if an associated signed third party credential is stored in the trusted platform module.

Claims

1. A method comprising:

generating a platform private key on a computing device, the platform private key identifying the computing device;

receiving a third party credential, the third party credential identifying the third party;

signing the third party credential using the platform private key;

storing the signed third party credential in a database located in a trusted platform module; and

executing a unified extensible firmware interface executable only if a signed third party credential associated with the unified extensible firmware interface executable is stored in the database.

2. The method of claim 1, wherein receiving a third party credential comprises receiving a third party public key.

3. The method of claim 1, wherein receiving a third party credential comprises receiving a third party digital signature certificate.

4. The method of claim 3, wherein the third party digital signature certificate comprises a third party public key and third party data that has been encrypted with a third party private key.

5. The method of claim 4, further comprising authenticating the third party digital signature by decrypting the third party data using the third party public key.

6. The method of claim 1, wherein signing the third party credential comprises encrypting the third party credential using the private key.

7. The method of claim 6, further comprising:

(i) generating a platform public key;

(ii) retrieving the signed third party credential from the database; and

(iii) decrypting the third party credential using the platform public key.

8. The method of claim 1, wherein executing a unified extensible firmware interface executable comprises searching the database for a signed third party credential that authenticates the unified extensible firmware interface executable.

9. The method of claim 1, further comprising storing the platform private key in a trusted platform module of the computing device.

10. The method of claim 1, further comprising authenticating the third party credential using a third party public key associated with the third party credential.

11. A machine readable medium comprising a plurality of instructions, that in response to being executed, result in a computing device:

verifying the physical presence of a platform administrator of a computing device;

prompting for the entering of a password if the physical presence of the platform administrator is verified;

clearing a platform public key and a platform private key of the computing device if the password is correct, the platform private key identifying the computing device;

generating a new platform public key and a new platform private key; and

storing the new platform public key and the new platform private key in a trusted platform module of the computing device.

12. The machine readable medium of claim 11, wherein the plurality of instructions further result in the computing device signing a third party credential using the new platform private key.

13. The machine readable medium of claim 12, wherein the plurality of instructions further result in the computing device signing the third party credential comprises retrieving the new platform private key from the trusted platform module.

14. The machine readable medium of claim 12, wherein the plurality of instructions further result in the computing device storing the signed third party credential in a database stored in the trusted platform.

15. The machine readable medium of claim 14, wherein the plurality of instructions further result in the computing device:

(i) receiving a request for execution of a unified extensible firmware interface executable;

(ii) accessing the database to determine whether a signed third party credential associated with the unified extensible firmware interface executable is stored therein; and

(iii) executing the unified extensible firmware interface executable only if the signed third party credential associated with the unified extensible firmware interface executable is located in the database.

16. The machine readable medium of claim 15, wherein the plurality of instructions further result in the computing device executing the unified extensible firmware interface executable comprises retrieving the signed third party credential associated with the unified extensible firmware interface executable from the database.

17. The machine readable medium of claim 16, wherein the plurality of instructions further result in the computing device executing the unified extensible firmware interface executable comprises decryption the signed third party credential using the platform public key.

18. A computing device comprising:

a processor;

a trusted platform module; and

a memory device having stored therein a plurality of instructions, which when executed by the processor, cause the processor to;

generate a platform private key on a computing device, the private key identifying the computing device;

sign a third party credential using the platform private key;

store the signed third party credential in a database located in a trusted platform module; and

execute a unified extensible firmware interface executable only if a signed third party credential associated with the unified extensible firmware interface executable is located in the database.

19. The computing device of claim 18, wherein the plurality of instructions, when executed by the processor, further cause the processor to retrieve the signed third party credential associated with the unified extensible firmware interface from the database and decrypt the signed third party credential using a platform public key associated with the computing device.

20. The computing device of claim 20, wherein the third party credential comprises a third party digital signature certificate including a third party public key and third party data that has been encrypted with a third party private key.