Self-Service Terminal (SST) Secure Boot

• US 20170177876A1
• Filed: 03/09/2017
• Published: 06/22/2017
• Est. Priority Date: 04/30/2014
• Status: Active Grant

• Current Assignee: NCR Corporation
• Original Assignee: NCR Corporation
• Inventors: Horgan, Kevin, Benn, Campbell, Chisholm, Gordon
• Granted Patent: US 10,133,869 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 9/441 Multiboot arrangements, i.e. selecting an operating system to be loaded
• CPC Class Codes: G06F 9/4415 Self describing peripheral devices
• CPC Class Codes: G06F 9/442 Shutdown

Abstract

A Basic Input/Output System (BIOS) of a device is modified to: obtain a first value from a medium interfaced to the device, produce a second value from boot data resident on the medium, compare the first value to the second value, and boot from the boot data of the medium when the first value is equal to the second value.

Claims

1. A method, comprising:

obtaining header information from a portable non-transitory computer-readable storage medium;

removing a value from the header information; and

comparing the value against a generated value produced by processing data on the portable non-transitory computer-readable storage medium.

2. The method of claim 1 further comprising, rejecting the portable non-transitory computer readable storage medium when the value does not equal the generated value.

3. The method of claim 1 further comprising, booting a device from the data resident on the portable non-transitory computer readable storage medium when the value equals the generated value.

4. The method of claim 3, wherein booting further includes replacing boot data on the device with the data from the portable non-transitory computer readable storage medium.

5. The method of claim 4, wherein the device executes the processing of the method, and the method is part of a Basic Input/Output System (BIOS) resident on the device.

6. The method of claim 5, wherein the device is a Self-Service Terminal (SST).

7. The method of claim 1, wherein obtaining further includes identifying the header information as being in a Universal Disk Format (UDF) for a Compact Disk (CD) that is the portable non-transitory computer-readable storage medium.

8. The method of claim 7, wherein removing further includes obtaining the value from a predefined field of the header information.

9. The method of claim 8, wherein obtaining further includes identifying the value as a hash value of the Logical Volume Integrity Descriptor (LVID) data resident on the portable non-transitory computer-readable storage medium.

10. The method of claim 9, wherein comparing further includes producing the generated value as a second hash value of the LVID data obtained from the portable non-transitory computer-readable storage medium.

11. A method, comprising:

configuring a hash process to generate a hash value from boot data residing on a portable non-transitory computer readable storage medium;

modifying a Basic Input/Output System (BIOS) to obtain a second hash value from header information residing on the portable non-transitory computer readable storage medium;

modifying the BIOS to process the hash process;

modifying the BIOS to compare the hash value against the second hash value;

modifying the BOIS to boot a device associated with the BIOS from the boot data when the hash value equals the second hash value; and

certifying the modified BIOS for installation on the device.

12. The method of claim 11, wherein configuring further includes configuring the hash process to use Logical Volume Integrity Descriptor (LVID) data obtained from the boot data to generate the hash value.

13. The method of claim 11, wherein modifying the BIOS to boot further includes modifying the BIOS to boot the device from existing boot data resident on the device when the hash value does not equal the second hash value.

14. The method of claim 11, wherein modifying the BIOS to boot further includes modifying the BIOS to shut the device down when the hash value does not equal the second hash value.

15. The method of claim 11, wherein modifying the BIOS to boot further includes modifying the BIOS to:

activate a camera associated with the device to take an image of an individual that inserted the portable non-transitory computer readable storage medium into the device, record the image, and shut the device down when the hash value does not equal the second hash value.

16. The method of claim 11, wherein modifying the BIOS to boot further includes modifying the BIOS to:

activate a camera associated with the device to take an image of an individual that inserted the portable non-transitory computer readable storage medium into the device, record the image, and boot the device from existing boot data resident on the device when the hash value does not equal the second hash value.

17. A Self-Service Terminal (SST), comprising:

a device port;

a Basic Input/Output System (BIOS) adapted and configured to;

i) obtain a first hash value from a non-transitory computer readable storage medium interfaced to the device port, ii) generate a second hash value from boot data resident on the non-transitory computer readable storage medium, and iii) boot the SST from the boot data when the first hash value equals the second hash value.

18. The SST of claim 17, wherein the BIOS is further adapted and configured to (iv) boot the SST from existing boot data resident on the SST when the first hash value does not equal the second hash value.

19. The SST of claim 17, wherein the BIOS is further adapted and configured to (iv) shut down the SST when the first hash value does not equal the second hash value.

20. The SST of claim 17, wherein SST is an Automated Teller Machine (ATM), the device port is a Compact Disk (CD) bay, and the non-transitory computer readable storage medium is a CD.