SYSTEMS AND METHODS FOR FACILITATING ACTIVATION OF OPERATING SYSTEMS

• US 20130031541A1
• Filed: 07/29/2011
• Published: 01/31/2013
• Est. Priority Date: 07/29/2011
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Wilks, Andrew W., Sang, MyPhuong N., Kim, Keung S.
• Granted Patent: US 8,949,813 B2
• Time in Patent Office: Days
• US Class Current: 717/176
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 8/654 using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57

Abstract

Systems and methods are disclosed that may be implemented to install and use a replacement BIOS code stored in non-volatile memory of the system BIOS to facilitate activation of a new or replacement OS on an information handling system. The replacement BIOS code may include an activation certificate of authority information to activate a different version operating system for use on an information handling system that has been previously configured with a different operating system version along with a previous BIOS code that did not include the updated OEM activation string.

Claims

1. A method of preparing a replacement operating system (OS) on an information handling system for activation on the information handling system using certificate of authority information, comprising:

providing an information handling system comprising;

non-volatile memory including memory space that is locked from editing with a private security key, the locked memory space being configured to unlock to allow editing only upon presentation of the private security key,

at least one processing device, the processing device being coupled to access the non-volatile memory, and

a first BIOS code and first operating system (OS) code that are each activated and executing on the at least one processing device, neither of the first BIOS code or first OS being capable of supplying the private security key to unlock the locked memory space of the non-volatile memory;

providing a replacement BIOS code to replace the first BIOS code, the replacement BIOS code being different than the first BIOS code and being configured with the private security key and the correct certificate of authority information corresponding to the replacement OS;

providing BIOS updater code, the BIOS updater code being either separate from the replacement BIOS code or part of the replacement BIOS code;

installing the BIOS updater code and installing the replacement BIOS code on the information handling system to replace the first BIOS code;

executing the BIOS updater code on the processing device to provide the private security key from the BIOS updater code to cause unlocking of the locked memory space in the non-volatile memory and activating of the correct certificate of authority information in the unlocked memory space in the non-volatile memory; and

executing the BIOS updater code on the processing device to cause locking of the unlocked memory space in the non-volatile memory after activation of the correct certificate of authority information in the unlocked memory space in the non-volatile memory.

2. The method of claim 1, further comprising:

installing a replacement OS code to replace the first OS code, the replacement OS code being different than the first OS code and requiring the presence of the correct certificate of authority information contained in the locked space of the non-volatile memory to activate the replacement OS code on the information handling system; and

activating the replacement OS on the information handling system by accessing the installed correct certificate of authority information in the locked memory space of the non-volatile memory.

3. The method of claim 1, where the first OS code is not configured to access or employ certificate of authority information in the locked memory space of the non-volatile memory for the previous activation of the first OS code on the information handling system.

4. The method of claim 1, further comprising activating the replacement OS on the information handling system without communicating across a network with a network source to complete the authorization process.

5. The method of claim 1, where the locked memory space in the non-volatile memory comprises a software license information SLIC table.

6. The method of claim 1, further comprising providing a system management interface application programming interface (SMI API), and where the method further comprises using the SMI API to perform the following sequence of steps in response to system calls issued by the BIOS updater code only a single time immediately after the step of installing the replacement BIOS code to replace the first BIOS code, and immediately prior to preventing the SMI API from ever performing the sequence of following steps any additional times:

providing the private security key to unlock the locked memory space in the non-volatile memory;

activating the correct certificate of authority information in the unlocked memory space in the non-volatile memory; and

locking the unlocked memory space in the non-volatile memory after activation of the correct certificate of authority information in the unlocked memory space in the non-volatile memory.

7. The method of claim 1, further comprising providing a system management interface application programming interface (SMI API) and a separate BIOS updater utility that implements the BIOS updater code, where the SMI API is configured to only provide service to the updater utility for installing the replacement BIOS code, and where the updater utility is configured to implement performance of the following steps by passing corresponding system calls to the SMI API:

providing the private security key to unlock the locked memory space in the non-volatile memory;

activating the correct certificate of authority information in the unlocked memory space in the non-volatile memory; and

locking the unlocked memory space in the non-volatile memory after activation of the correct certificate of authority information in the unlocked memory space in the non-volatile memory.

8. The method of claim 1, further comprising performing the following steps after the information handling system has been field-deployed from a manufacturer or supplier of the information handling system to an end user:

providing the replacement BIOS code to replace the first BIOS code;

providing the BIOS updater code;

installing the BIOS updater code and installing the replacement BIOS code to replace the first BIOS code, the replacement BIOS code being different than the first BIOS code and being configured with the private security key and the correct certificate of authority information corresponding to the replacement OS;

executing the BIOS updater code on the processing device to provide the private security key from the BIOS updater code to cause unlocking of the locked memory space in the non-volatile memory;

executing the BIOS updater code on the processing device to cause activation of the correct certificate of authority information in the unlocked memory space in the non-volatile memory; and

executing the BIOS updater code on the processing device to cause locking of the unlocked memory space in the non-volatile memory after activation of the correct certificate of authority information in the unlocked memory space in the non-volatile memory.

9. The method of claim 8, where the end user is a corporate customer of the manufacturer or supplier of the information handling system;

and wherein the method further comprises performing the method to prepare a replacement operating system (OS) for activation on a plurality of the information handling systems.

10. The method of claim 1, where the information handling system comprises at least one of a desktop computer, laptop computer, or server.

11. An information handling system comprising:

non-volatile memory including memory space that is locked from editing with a private security key, the locked memory space being configured to unlock to allow editing only upon presentation of the private security key;

at least one processing device, the processing device being coupled to access the non-volatile memory;

a replacement BIOS code configured to replace a first BIOS code that has previously been activated and executed on the at least one processing device, the first BIOS code being incapable of supplying the private security key to unlock the locked memory space of the non-volatile memory, and the replacement BIOS code being different than the first BIOS code and being configured with the private security key and the correct certificate of authority information corresponding to a replacement OS configured to replace a first OS code that has been previously activated for execution on the at least one processing device; and

a BIOS updater code, the BIOS updater code being either separate from the replacement BIOS code or part of the replacement BIOS code;

where the BIOS updater code is configured for executing on the processing device to cause performance of the following steps;

providing the private security key to unlock the locked memory space in the non-volatile memory,

activating the correct certificate of authority information in the unlocked memory space in the non-volatile memory, and

locking the unlocked memory space in the non-volatile memory after activation of the correct certificate of authority information in the unlocked memory space in the non-volatile memory.

12. The system of claim 11, further comprising a replacement operating system (OS) code configured to replace a first OS code that has been previously activated for execution on the at least one processing device, the first OS code being incapable of supplying the private security key to unlock the locked memory space of the non-volatile memory, and the replacement OS code being being different than the first OS code and configured to require the presence of the correct certificate of authority information contained in the locked space of the non-volatile memory to activate the replacement OS code on the information handling system

13. The system of claim 11, where the replacement OS is configured to be activated on the information handling system without communicating across a network with a network source to complete the authorization process.

14. The system of claim 11, where the locked memory space in the non-volatile memory comprises a software license information SLIC table.

15. The system of claim 11, further comprising a system management interface application programming interface (SMI API) configured to execute on the processing device to access the non-volatile memory and perform the following steps in response to system calls issued by the BIOS updater code only a single time immediately after installation of the replacement BIOS code to replace the first BIOS code, and immediately prior to being disabled from ever performing the sequence of following steps any additional times:

provide the private security key to unlock the locked memory space in the non-volatile memory;

activate the correct certificate of authority information in the unlocked memory space in the non-volatile memory; and

lock the unlocked memory space in the non-volatile memory after activation of the correct certificate of authority information in the unlocked memory space in the non-volatile memory.

16. The system of claim 11, further comprising a system management interface application programming interface (SMI API) and a separate BIOS updater utility that implements the BIOS updater code, where the SMI API is configured to execute on the processing device to only provide service to the updater utility for installing the replacement BIOS code, and where the updater utility is configured to implement performance of the following steps by passing corresponding system calls to the SMI API:

provide the private security key to unlock the locked memory space in the non-volatile memory;

activate the correct certificate of authority information in the unlocked memory space in the non-volatile memory; and

lock the unlocked memory space in the non-volatile memory after activation of the correct certificate of authority information in the unlocked memory space in the non-volatile memory.

17. The system of claim 11, where the replacement BIOS code and BIOS updater code is configured to install and execute on the processing device to cause performance of the following steps after the information handling system has been field-deployed from a manufacturer or supplier to an end user:

provide the private security key to unlock the locked memory space in the non-volatile memory;

activate the correct certificate of authority information in the unlocked memory space in the non-volatile memory; and

lock the unlocked memory space in the non-volatile memory after activation of the correct certificate of authority information in the unlocked memory space in the non-volatile memory.

18. The system of claim 17, where the end user is a corporate customer of the manufacturer or supplier of the information handling system.

19. The system of claim 11, where the information handling system comprises at least one of a desktop computer, laptop computer, or server.