NETWORK UPDATABLE USER TRUSTED DEVICE

• US 20150248283A1
• Filed: 03/03/2014
• Published: 09/03/2015
• Est. Priority Date: 03/03/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Gschwind, Thomas, Hoering, Frank, Kuyper-Hammond, Michael P
• Granted Patent: US 9,256,442 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 8/654 using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories
• CPC Class Codes: G06F 9/4416 Network booting; Remote initial program loading [RIPL]

Abstract

A user trusted device and a software update method for updating the device. The device includes: a connection interface enabling connection with a host computer; a persistent memory storing a boot enabling data structure and a network updater, wherein: the network updater is configured to interact with firmware of the host computer to initiate communication over a network; and the boot enabling data structure: is detectable by the firmware upon connection of the user trusted device with the host computer; is such that host computer can boot from the user trusted device, as per the data structure of the boot enabling data structure; and includes instructions for the firmware to initiate a transfer of the network updater on the host computer for subsequent execution, upon the host computer booting from the user trusted device.

Claims

1. A user trusted device comprising:

a connection interface enabling connection with a host computer;

a persistent memory storing a boot enabling data structure and a network updater;

wherein the network updater is configured to interact, upon execution at the host computer, with a firmware of the host computer to initiate a communication over a network to which the host computer is connectable; and

wherein the boot enabling data structure;

is detectable by the firmware upon connection of the user trusted device with said host computer;

is such that the host computer can boot from the user trusted device, as per a data structure of the boot enabling data structure; and

includes instructions for the firmware to initiate a transfer of said network updater on the host computer for subsequent execution at the host computer, upon the host computer booting from the user trusted device.

2. The user trusted device of claim 1, wherein said network updater is configured to interact, upon execution at said host computer, with said firmware of the host computer to subsequently interact with a network card of the host computer, in order to initiate said communication over the network as enabled by said network card.

3. The user trusted device of claim 1, wherein the network updater comprises a reference to a server to be contacted upon initiating said communication over the network.

4. The user trusted device of claim 1, wherein said user trusted device comprises no network card.

5. The user trusted device of claim 1, wherein said persistent memory comprises:

a secure memory, onto which is stored a first part of the network updater; and

a non-secure memory, onto which is stored a second part of the network updater.

6. The user trusted device of claim 5, wherein the second part of the network updater resides encrypted on the non-secure memory, a corresponding encryption key being stored on the secure memory.

7. The user trusted device of claim 5, wherein the second part of the network updater occupies less than half a size of the secure memory, said memory size is less than or equal to 256 ko.

8. The user trusted device of claim 1, wherein said network updater is configured to interact, upon execution at a host computer, with a firmware of the host computer to initiate said communication, said firmware being one of the following:

a BIOS, with a PXE BIOS;

an Extensible Firmware Interface (EFI) BIOS;

or

a Unified Extensible Firmware Interface (UEFI) BIOS.

9. The user trusted device of claim 1, wherein said connection interface is of one of the following:

a Universal Serial Bus or USB;

an External Small Computer System Interface or SCSI;

an External Serial Advanced Technology Attachment or SATA;

a Firewire;

or

a Thunderbolt.

10. A system comprising:

a server to be contacted upon initiating communication over a network;

a host computer; and

a user trusted device comprising;

a connection interface enabling connection with the host computer;

a persistent memory storing a boot enabling data structure and a network updater;

wherein the network updater includes a reference to said server, and is configured to interact, upon execution at the host computer, with a firmware of the host computer to initiate a communication over a network to which the host computer is connectable; and

wherein the boot enabling data structure;

is detectable by the firmware upon connection of the user trusted device with said host computer;

is such that the host computer can boot from the user trusted device, as per a data structure of the boot enabling data structure; and

includes instructions for the firmware to initiate a transfer of said network updater on the host computer for subsequent execution at the host computer, upon the host computer booting from the user trusted device.

11. A method of initiating communication between a user trusted device and a network, the user trusted device connectable to a host computer, said host computer connectable to said network, the method comprising:

allowing a boot enabling data structure of the user trusted device be detected by a firmware of the host computer;

booting the host computer from the user trusted device; and

transferring a network updater to the host computer, so that the network updater executes at the host computer and interacts with the firmware to initiate a communication over said network.

12. The method of claim 11, further comprising:

causing said network updater to;

interact with said firmware of the host computer;

interact with a network card of the host computer; and

initiate said communication over the network as enabled by said network card.

13. The method of claim 11, further comprising contacting a server referenced by the network updater, upon initiating said communication over the network.

14. The method of claim 13, further comprising:

transferring data from the server to the user trusted device, wherein the data is a user trusted device firmware update;

storing said transferred data on a memory of the user trusted device, wherein the memory is a persistent memory; and

updating software of the user trusted device according to the transferred data as stored on the memory of the user trusted device.

16. A computer program product for initiating communication between a user trusted device and a network, the computer program product comprising a computer readable storage medium having program code embodied therewith, the program code readable/executable by a device to perform a method according to claim 11.

17. A system for initiating communication between a user trusted device and a network, the system comprising:

a memory;

a processor communicatively coupled to the memory; and

a module communicatively coupled to the memory and the processor, wherein the module is configured to perform the steps of the method according to claim 11.

15. A computer program product for initiating communication between a user trusted device and a network, the computer program product comprising a computer-readable storage medium having program code embodied therewith, program code readable/executable by a device to:

enable a connection interface and a host computer to connect;

store a boot enabling data structure and a network updater in a persistent memory;

wherein the network updater is configured to interact, upon execution at a host computer, with a firmware of the host computer to initiate a communication over a network to which the host computer is connectable; and

wherein the boot enabling data structure;

is detectable by the firmware upon connection of the user trusted device with said host computer;

is such that host computer can boot from the user trusted device, as per the data structure of the boot enabling data structure; and

includes instructions for the firmware to initiate a transfer of said network updater on the host computer for subsequent execution at the host computer, upon the host computer booting from the user trusted device.