Systems and methods for boot recovery in a secure boot process on a computer with a hardware security module

• US 7,506,380 B2
• Filed: 01/14/2005
• Issued: 03/17/2009
• Est. Priority Date: 01/14/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Schwartz, Jonathan, England, Paul, Ray, Kenneth D., Thom, Stefan, Hunter, Jamie, Schwartz, James Anthony Jr., Humphries, Russell
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US11/035,715
• Publication Number:
  US 20060161769A1
• Time in Patent Office: 1,523 Days
• Field of Search: None
• US Class Current: 726/26
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

Systems and methods are provided for maintaining and updating a secure boot process on a computer with a trusted platform module (TPM). A boot process may be maintained by inspecting a log of TPM activity, determining data that prevented a secret to unseal, and returning the data to an original state. In situations where this type of recovery is not workable, techniques for authenticating a user may be used, allowing the authenticated user to bypass the security features of the boot process and reseal the boot secrets to platform configuration register (PCR) values that may have changed. Finally, a secure boot process may be upgraded by migrating TPM sealed secrets to a temporary storage location, updating one or more aspects of a secure boot process, and resealing the secrets to the resulting new platform configuration. Other advantages and features of the invention are described below.

Claims

1. A computer readable storage medium bearing instructions for a computer, said computer comprising a Hardware Security Module (HSM) that contains recorded values comprising data involved in a boot process, compares submitted values to the recorded values, and releases a secret if the submitted values are correct, said computer readable storage medium comprising:

instructions for measuring data involved in a boot process;

instructions for submitting a measurement of said data to the HSM, wherein the submitted value comprises the measuring data;

instructions for requesting a first secret from the HSM;

instructions for obtaining a second secret from a source other than the HSM in response to a denial by the HSM of a request for the first secret; and

wherein the instructions for obtaining a second secret from a source other than the HSM comprise instructions for electronically contacting a remote computer.

2. The computer readable storage medium of claim 1 wherein the HSM is a Trusted Platform Module (TPM).

3. The computer readable storage medium of claim 1 wherein the data is a component used in a boot process.

4. The computer readable storage medium of claim 1 wherein the instructions for obtaining a second secret from a source other than the HSM comprise instructions for prompting a user to enter authentication information sufficient to compose the second secret.

5. The computer readable storage medium of claim 1 wherein the instructions for obtaining a second secret from a source other than the HSM comprise instructions for prompting a user to contact an external third party to obtain the secret.

6. The computer readable storage medium of claim 1 wherein the instructions for obtaining a second secret from a source other than the HSM comprise instructions for triggering operation of custom third-party software to compose the second secret.

7. A method for recovering from failure of a secure computer boot process on a computer comprising a Hardware Security Module (HSM) that contains recorded values comprising data involved in a boot process, compares submitted values to the recorded values, and releases a secret if the submitted values are correct, said method comprising:

measuring data involved in a boot process;

submitting a measurement of said data to the HSM, wherein the submitted value comprises the measuring data;

requesting a first secret from the HSM;

obtaining a second secret from a source other than the HSM in response to a denial by the HSM of a request for the first secret; and

wherein the obtaining a second secret from a source other than the HSM comprises electronically contacting a remote computer.

8. The method of claim 7 wherein the HSM is a Trusted Platform Module (TPM).

9. The method of claim 7 wherein the data is a component used in a boot process.

10. The method of claim 7 wherein obtaining a second secret from a source other than the HSM comprises prompting a user to enter authentication information sufficient to compose the second secret.

11. The method of claim 7 wherein obtaining a second secret from a source other than the HSM comprises prompting a user to contact an external third party to obtain the secret.

12. The method of claim 7 wherein obtaining a second secret from a source other than the HSM comprises triggering operation of custom third-party software to compose the second secret.

13. A computer processor comprising a Hardware Security Module (HSM) that contains recorded values comprising data involved in a boot process, compares submitted values to the recorded values, and releases a secret if the submitted values are correct, said computer comprising:

means for measuring data involved in a boot process;

means for submitting a measurement of said data to the HSM, wherein the submitted value comprises the measuring data;

means for requesting a first secret from the HSM;

means for obtaining a second secret from a source other than the HSM in response to a denial by the HSM of a request for the first secret; and

wherein the means for obtaining a second secret from a source other than the HSM comprises means for electronically contacting a remote computer.

14. The computer processor of claim 13 wherein the HSM is a Trusted Platform Module (TPM).

15. The computer processor of claim 13 wherein the data is a component used in a boot process.

16. The computer processor of claim 13 wherein the means for obtaining a second secret from a source other than the HSM comprise means for prompting a user to enter authentication information sufficient to compose the second secret.

17. The computer processor of claim 13 wherein the means for obtaining a second secret from a source other than the HSM comprise means for triggering operation of custom third-party software to compose the second secret.