Attesting a component of a system during a boot process

• US 8,869,264 B2
• Filed: 09/23/2011
• Issued: 10/21/2014
• Est. Priority Date: 10/01/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Mackintosh, David N., Walker, James W., Perez, Jose J. P.
• Primary Examiner(s): Gee, Jason K.
• Assistant Examiner(s): LWIN, MAUNG T
• Application Number:
  US13/241,835
• Publication Number:
  US 20120084549A1
• Time in Patent Office: 1,124 Days
• Field of Search: None
• US Class Current: 726/17
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A method, apparatus and program product for attesting a component of a system during a boot process. The method comprises the steps of: verifying that the system is in a trusted state; in response to verifying that the system is in a trusted state, requesting an enrollment of the system wherein the requesting step further comprises the step of: retrieving enrollment data associated with the system; retrieving current input data associated with the component of the system; comparing the current input data against the enrollment data in order to determine whether the system can retain its trusted state; wherein in response to the comparing step, if the current input data matches the enrollment data, the system retains its trusted state; and accepting the trusted state until receipt of a notification, from the system having a retained trusted state, of an update to the system.

Claims

1. An apparatus for attesting a component of a system during a boot process, comprising a processor coupled to a memory that contains instructions that are executable by the processor to perform steps of:

verifying that the system is in a trusted state;

in response to verifying that the system is in a trusted state, requesting an enrollment of the system, wherein the requesting step further comprises retrieving enrollment data associated with the system;

retrieving current input data associated with the component of the system;

comparing the current input data against the enrollment data in order to determine whether the system can retain its trusted state;

if the current input data matches the enrollment data in response to the comparing step, the system retains its trusted state; and

accepting the trusted state until receipt of a notification, from the system having a retained trusted state, of an update to the system.

2. The apparatus of claim 1 wherein the memory contains further instructions that are executable by the processor to cause the apparatus to perform steps of:

receiving the notification from the system that the component of the system has been updated;

retrieving updated current input data associated with the component in response to the notification being received; and

storing the updated current input data.

3. The apparatus of claim 2, wherein the memory contains further instructions that are executable by the processor to cause the apparatus to perform steps of:

retrieving further current input data associated with the component of the system; and

comparing the further current input data against the updated current input data in order to determine whether the system can retain its trusted state.

4. The apparatus of claim 3, wherein if the further current input data matches the updated current input data in response to the comparing of the further current input data, the system retains its trusted state.

5. The apparatus of claim 4, wherein the enrollment data is replaced with the updated current input data if the further current input data matches the updated current input data in response to the comparing of the further current input data, wherein the enrollment data that is replaced was retrieved when requesting the enrollment of the system by the apparatus in response to verifying that the system is in a trusted state, and the updated current input data that replaces the enrollment data was retrieved by the apparatus in response to the notification being received by the apparatus.

6. The apparatus of claim 1, wherein the enrollment data that was retrieved when requesting the enrollment of the system by the apparatus comprises a measurement value of the component;

an event log identifier and a public key of the system.

7. The apparatus of claim 6, wherein the event log identifier identifies an event log that comprises the current input data and an identifier of the component.

8. The apparatus of claim 2, wherein the updated current input data retrieved by the apparatus comprises an updated measurement value of the component;

an updated event log identifier and a public key of the system.

9. The apparatus of claim 1, wherein the verifying step comprises at least one of:

inspecting the system and asserting a trusted state assumption associated with a period between initial installation of the system and the current input data being generated.

10. An apparatus for attesting a component of a system during a boot process, comprising a processor coupled to a memory that contains instructions that are executable by the processor to perform steps of:

verifying that the system is in a trusted state;

in response to verifying that the system is in a trusted state, requesting an enrollment of the system, wherein the requesting step further comprises retrieving enrollment data associated with the system;

retrieving current input data associated with the component of the system;

comparing the current input data against the enrollment data in order to determine whether the system can retain its trusted state;

if the current input data matches the enrollment data in response to the comparing step, the system retains its trusted state;

accepting the trusted state until receipt of a notification, from the system having a retained trusted state, of an update to the system;

receiving the notification from the system that the component of the system has been updated;

retrieving updated current input data associated with the component in response to the notification being received;

storing the updated current input data;

retrieving further current input data associated with the component of the system;

comparing the further current input data against the updated current input data in order to determine whether the system can retain its trusted state; and

setting values associated with the updated current input data to null if the further current input data matches the updated current input data in response to the comparing of the further current input data.

11. A computer program product comprising computer program code stored on a non-transitory computer readable storage medium to, when loaded into a computer system and executed thereon, cause said computer system to perform the steps of:

verifying that the system is in a trusted state;

in response to verifying that the system is in a trusted state, requesting an enrollment of the system, wherein the requesting step further comprises retrieving enrollment data associated with the system;

retrieving current input data associated with the component of the system;

comparing the current input data against the enrollment data in order to determine whether the system can retain its trusted state;

if the current input data matches the enrollment data in response to the comparing step, the system retains its trusted state; and

accepting the trusted state until receipt of a notification, from the system having a retained trusted state, of an update to the system.

12. The computer program product of claim 11 further comprising:

receiving the notification from the system that the component of the system has been updated;

retrieving updated current input data associated with the component in response to the notification being received; and

storing the updated current input data.

13. The computer program product of claim 12, further comprising:

retrieving further current input data associated with the component of the system; and

comparing the further current input data against the updated current input data in order to determine whether the system can retain its trusted state.

14. The computer program product of claim 13, wherein if the further current input data matches the updated current input data in response to the comparing of the further current input data, the system retains its trusted state.

15. The computer program product of claim 14, wherein the enrollment data is replaced with the updated current input data if the further current input data matches the updated current input data in response to the comparing of the further current input data, wherein the enrollment data that is replaced was retrieved when requesting the enrollment of the system by the apparatus in response to verifying that the system is in a trusted state, and the updated current input data that replaces the enrollment data was retrieved by the apparatus in response to the notification being received by the apparatus.

16. The computer program product of claim 11, wherein the enrollment data that was retrieved when requesting the enrollment of the system by the apparatus comprises a measurement value of the component;

an event log identifier and a public key of the system.

17. The computer program product of claim 16, wherein the event log identifier identifies an event log that comprises the current input data and an identifier of the component.

18. The computer program product of claim 12, wherein the updated current input data retrieved by the apparatus comprises an updated measurement value of the component;

an updated event log identifier and a public key of the system.

19. The computer program product of claim 11, wherein the verifying step comprises at least one of:

inspecting the system and asserting a trusted state assumption associated with a period between initial installation of the system and the current input data being generated.

20. A computer program product comprising computer program code stored on a non-transitory computer readable storage medium to, when loaded into a computer system and executed thereon, cause said computer system to perform the steps of:

verifying that the system is in a trusted state;

in response to verifying that the system is in a trusted state, requesting an enrollment of the system, wherein the requesting step further comprises retrieving enrollment data associated with the system;

retrieving current input data associated with the component of the system;

comparing the current input data against the enrollment data in order to determine whether the system can retain its trusted state;

if the current input data matches the enrollment data in response to the comparing step, the system retains its trusted state;

accepting the trusted state until receipt of a notification, from the system having a retained trusted state, of an update to the system;

receiving the notification from the system that the component of the system has been updated;

retrieving updated current input data associated with the component in response to the notification being received;

storing the updated current input data;

retrieving further current input data associated with the component of the system;

comparing the further current input data against the updated current input data in order to determine whether the system can retain its trusted state; and

setting values associated with the updated current input data to null if the further current input data matches the updated current input data in response to the comparing of the further current input data.

21. An apparatus for attesting a component of a system during a boot process, comprising a processor coupled to a memory that contains instructions that are executable by the processor to perform steps of:

verifying that the system is in a trusted state during the boot process;

in response to verifying that the system is in a trusted state, requesting an enrollment of the system with the apparatus, wherein the requesting step further comprises receiving enrollment data associated with the system;

responsive to re-booting the system, verifying that the system is in a trusted state during the re-booting process using the enrollment data, wherein the enrollment data was received when requesting the enrollment of the system with the apparatus, in lieu of trusted values provided by a trusted source.

22. The apparatus of claim 21, wherein the enrollment data that was retrieved when requesting the enrollment of the system by the apparatus comprises a measurement value of the component;

an event log identifier of an event log where the enrollment data is maintained, and a public key of the system.

23. The apparatus of claim 21, wherein the apparatus further comprises a trusted platform module (TPM) emulator that is configured to verify that the system is in the trusted state.