Securely recovering a computing device

• US 9,680,648 B2
• Filed: 03/22/2016
• Issued: 06/13/2017
• Est. Priority Date: 01/07/2007
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: De Atley, Dallas Blake, Smith, Michael, Sen, Shantonu, De Cesare, Joshua, Wright, John Andrew, Reda, Matthew
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Anderson, Michael D
• Application Number:
  US15/077,794
• Publication Number:
  US 20160277186A1
• Time in Patent Office: 448 Days
• CPC Class Codes: G06F 11/1417 Boot up procedures
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/302 involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3249 using RSA or related signature schemes, e.g. Rabin scheme

Abstract

A method and an apparatus for establishing an operating environment by certifying a code image received from a host over a communication link are described. The code image may be digitally signed through a central authority server. Certification of the code image may be determined by a fingerprint embedded within a secure storage area such as a read only memory (ROM) of the portable device based on a public key certification process. A certified code image may be assigned a hash signature to be stored in a storage of the portable device. An operating environment of the portable device may be established after executing the certified code.

Claims

1. A method carried out at a computing device, the method comprising:

loading, into a storage of the computing device, a code image that is digitally signed by a signature;

determining whether the code image is certified by verifying the signature using a fingerprint embedded within a read only memory (ROM) of the computing device;

when the code image is certified;

executing the code image to establish an operating environment of the computing device; and

when the code image is not certified;

removing the code image from the storage of the computing device, and

entering a Device Firmware Upgrade (DFU) mode to perform system management tasks for the computing device.

2. The method of claim 1, wherein the fingerprint is associated with a unique identifier (UID) specific to the computing device.

3. The method of claim 1, wherein executing the code image comprises:

determining whether the code image matches the signature based on a public key compatible with X.509 standard; and

determining whether the fingerprint matches the public key, wherein the fingerprint is based on a first hash value of the public key.

4. The method of claim 3, further comprising:

deriving a second hash value based on the code image; and

encrypting the second hash value into a header value based on a key stored in the ROM of the computing device.

5. The method of claim 1, further comprising, when the code image is certified:

verifying that an operating system component is trusted before executing the operating system component in the storage.

6. The method of claim 1, wherein the code image is received from an entity that is communication with the computing device.

7. The method of claim 1, further comprising:

resetting the computing device.

8. A non-transitory computer readable storage medium configured to store instructions that, when executed by a processor included in a computing device, cause the computing device to carry out steps that include:

loading, into a storage of the computing device, a code image that is digitally signed by a signature;

determining whether the code image is certified by verifying the signature using a fingerprint embedded within a read only memory (ROM) of the computing device;

when the code image is certified;

executing the code image to establish an operating environment of the computing device; and

when the code image is not certified;

removing the code image from the storage of the computing device, and

entering a Device Firmware Upgrade (DFU) mode to perform system management tasks for the computing device.

9. The non-transitory computer readable storage medium of claim 8, wherein the fingerprint is associated with a unique identifier (UID) specific to the computing device.

10. The non-transitory computer readable storage medium of claim 8, wherein executing the code image comprises:

determining whether the code image matches the signature based on a public key compatible with X.509 standard; and

determining whether the fingerprint matches the public key, wherein the fingerprint is based on a first hash value of the public key.

11. The non-transitory computer readable storage medium of claim 10, wherein the steps further include:

deriving a second hash value based on the code image; and

encrypting the second hash value into a header value based on a key stored in the ROM of the computing device.

12. The non-transitory computer readable storage medium of claim 8, wherein the steps further include, when the code image is certified:

verifying that an operating system component is trusted before executing the operating system component in the storage.

13. The non-transitory computer readable storage medium of claim 8, wherein the code image is received from an entity that is communication with the computing device.

14. The non-transitory computer readable storage medium of claim 8, wherein the steps further include:

resetting the computing device.

15. A computing device comprising a processor configured to cause the computing device to carry out steps that include:

loading, into a storage of the computing device, a code image that is digitally signed by a signature;

determining whether the code image is certified by verifying the signature using a fingerprint embedded within a read only memory (ROM) of the computing device;

when the code image is certified;

executing the code image to establish an operating environment of the computing device; and

when the code image is not certified;

removing the code image from the storage of the computing device, and

entering a Device Firmware Upgrade (DFU) mode to perform system management tasks for the computing device.

16. The computing device of claim 15, wherein the fingerprint is associated with a unique identifier (UID) specific to the computing device.

17. The computing device of claim 15, wherein executing the code image comprises:

determining whether the code image matches the signature based on a public key compatible with X.509 standard; and

determining whether the fingerprint matches the public key, wherein the fingerprint is based on a first hash value of the public key.

18. The computing device of claim 17, wherein the steps further include:

deriving a second hash value based on the code image; and

encrypting the second hash value into a header value based on a key stored in the ROM of the computing device.

19. The computing device of claim 15, wherein the steps further include, when the code image is certified:

verifying that an operating system component is trusted before executing the operating system component in the storage.

20. The computing device of claim 15, wherein the code image is received from an entity that is communication with the computing device.