Method for securing communications in a pre-boot environment

• US 6,327,660 B1
• Filed: 09/18/1998
• Issued: 12/04/2001
• Est. Priority Date: 09/18/1998
• Status: Expired due to Term

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Patel, Baiju V.
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/156,247
• Time in Patent Office: 1,173 Days
• Field of Search: 380/277, 380/44, 713/156, 713/158, 713/161, 713/168, 713/169, 713/171, 713/193
• US Class Current: 713/193
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices

Abstract

Briefly, one embodiment of the present invention relates to a method comprising the act of providing a communication link between a first electronic system and a second electronic system. Prior to booting of an operating system of the first electronic system, the communication link is secured to protect the integrity of data transferred over the communication link.

Claims

1. A method comprising:

providing a communication link between a first electronic system and a second electronic system; and

securing the communication link, during a pre-boot operational state prior to completion of booting of an operating system of the first electronic system, to protect integrity of data transferred over the communication link between the first electronic system and the second electronic system.

2. The method of claim 1, wherein the first electronic system comprises a computer including a processing unit and a non-volatile memory accessible by the processing unit.

3. The method of claim 1, wherein the securing of the communication link includes

determining whether a security association is pre-loaded into the non-volatile memory of the first electronic system; and

providing the security association to a selected Internet Protocol Security (IPSEC) module, loaded in the non-volatile memory, the IPSEC module, when executed, secures packets of data transferred over the communication link.

4. The method of claim 3, wherein prior to providing the security association, the method further comprises

determining whether a key management protocol is loaded in the non-volatile memory when the security associated is absent from the first electronic system;

and

negotiating the security association if the key management protocol is loaded in the non-volatile memory.

5. The method of claim 4, wherein the determining of the security association further includes

checking whether a keying material is loaded in the non-volatile memory when the key management protocol is absent from the non-volatile memory;

using the keying material to produce portions of the security association if the keying material is loaded in the non-volatile memory; and

obtaining the keying material from an input device to produce portions of the security association if the keying material is not loaded in the non-volatile memory.

6. The method of claim 5, wherein the keying material undergoes a hash function to produce a unique security parameter index, the security parameter index being a portion of the security association.

7. A layered machine readable medium having embodied thereon a computer program for processing by an electronic system including non-volatile memory, the computer program comprising:

a first software layer to establish communications with a remotely located electronic system;

a second software layer to ensure that the communications with the remotely located electronic system are secure; and

a third software layer to control access of information within the non-volatile memory.

8. The computer medium of claim 7, wherein the second software layer includes a security communication protocol which, when executed, produces a packet of information in accordance with Internet Protocol Secure Authentication Header (IPSEC) standards.

9. The computer medium of claim 8, wherein the packet of information includes an Internet Protocol (IP) header, a payload, and an authentication header including a security parameter index being a parameter of a security association.

10. The computer medium of claim 8, wherein the packet of information includes an Internet Protocol (IP) header, an initialization vector used by a Data Encryption Standard, a payload, and a security parameter index being a parameter of a security association.

11. The computer medium of claim 10, wherein the packet of information further includes padding.

12. The computer medium of claim 7, wherein the third software layer includes a key manager to control negotiations by the electronic system with the remotely located electronic system to obtain a security association.

13. A network comprising:

a communication link;

a first electronic system coupled to the communication link, the first electronic system to secure the communication link in a pre-boot environment in order to protect integrity of data transferred over the communication link, the pre-boot environment includes a state existing prior to completion of booting of an operating system of the first electronic system; and

a second electronic system coupled to the communication link to transfer data to the first electronic system over the secure communication link.

14. The network of claim 13, wherein the data includes an image of an operating system of the first electronic system.

15. The network of claim 13, wherein the first electronic system includes a computer comprises a processor, a storage device including a non-volatile memory including a communication application and a security communication protocol.

16. The network of claim 15, wherein the security communication protocol, when executed, produces a packet of information in accordance with Internet Protocol Secure Authentication Header (IPSEC AH) standards.

17. The network of claim 16, wherein the packet of information includes an Internet Protocol (IP) header, a payload, and an authentication header including a security parameter index being a parameter of a security association.

18. The network of claim 15, wherein the security communication protocol, when executed, produces a packet of information including an Internet Protocol (IP) header, an initialization vector used by a Data Encryption Standard, a payload, and a security parameter index being a parameter of a security association.

19. A network comprising:

a communication link;

a first electronic system coupled to the communication link, the first electronic system to secure the communication link in a pre-boot environment in order to protect integrity of data transferred over the communication link, the first electronic system includes a computer that comprises

a processor, and

a storage device including a non-volatile memory including a communication application and a security communication protocol, the security communication protocol, when executed, produces a packet of information including an Internet Protocol (IP) header, an initialization vector used by a Data Encryption Standard, a payload, a security parameter index being a parameter of a security association and a padding; and

a second electronic system coupled to the communication link to transfer data to the first electronic system over the secure communication link.