System and method for safe booting electronic devices

• US 20060075216A1
• Filed: 10/01/2004
• Published: 04/06/2006
• Est. Priority Date: 10/01/2004
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Paatero, Lauri, Vaha-Sipila, Antti, Parnanen, Matti
• Granted Patent: US 7,702,907 B2
• Time in Patent Office: Days
• US Class Current: 713/2
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 12/06 Authentication

Abstract

An improved system and method for safe booting an electronic device. In situations such as where a virus is infecting various devices within a network, the present invention provides an authentication centre with the ability to instruct a device on the network to safe boot. During the safe boot, it can be arranged such that no third party applications are run, only backup, restoration, or uninstallation of programs are possible, and/or only programs in the device'"'"'s read-only memory are loaded. The present invention also provides a user with the ability to go through the boot process in a step-by-step manner.

Claims

1. A method of safe booting at least one electronic device within a network, comprising the steps of:

having at least one first authentication request sent from a remote terminal to the at least one electronic device; and

at least partly in response to receiving the at least one first authentication request, initiating a safe boot procedure on the at least one electronic device.

2. The method of claim 1, wherein the initiation of the safe boot procedure includes the steps of:

setting at least one internal flag on the at least one electronic device, the at least one internal flag at least partly indicating that the at least one electronic device should boot in a safe mode;

transmitting to the remote terminal at least one response authentication signal to the at least one first authentication request;

having the remote terminal fail to authenticate the at least one response authentication signal; and

at least partly in response to the remote terminal failing to authenticate the at least one response authentication signal, initiating safe boot procedures on the at least one electronic device.

3. The method of claim 2, wherein the at least one response authentication signal comprises at least a 32-bit signed response.

4. The method of claim 1, wherein the at least one electronic device comprises a mobile telephone.

5. The method of claim 1, wherein the at least one first authentication request comprises safe-boot-specific RAND.

6. The method of claim 1, further comprising the steps of:

having at least one second authentication request transmitted to the at least one electronic device from the remote terminal;

transmitting at least one second authentication response to the remote terminal; and

safe booting the at least one electronic device.

7. The method of claim 6, wherein the at least one second authentication request comprises a generic RAND.

8. The method of claim 1, further comprising the steps of:

if the at least one electronic device is a non-compliant electronic device, transmitting at least one error message to a user; and

at least partly in response to the least one error message, restarting the non-compliant electronic device.

9. The method of claim 1, further comprising the step of, before initiating the safe boot procedure, querying the user of the at least one electronic device about the upcoming safe boot procedure.

10. A computer program product of safe booting an electronic device within a network, comprising:

computer code for receiving at least one first authentication request sent from a remote terminal to the electronic device; and

computer code for, at least partly in response to receiving the at least one first authentication request, initiating a safe boot procedure on the electronic device.

11. The computer program product of claim 10, further comprising:

computer code for setting at least one internal flag on the electronic device in response to receiving the at least one first authentication request, the at least one internal flag indicating that the electronic device should boot in a safe mode;

computer code for transmitting to the remote terminal a first authentication response to the at least one first authentication request;

computer code for, at least partly in response to the remote terminal failing to authenticate the first authentication response, initiating safe boot procedures on the electronic device.

12. The computer program product of claim 10, further comprising:

computer code for receiving at least one second authentication request from the remote terminal;

computer code for transmitting at least one second authentication response to the remote terminal; and

computer code for safe booting the electronic device.

13. The computer program product of claim 10, further comprising:

computer code for, if the electronic device is a non-compliant electronic device, transmitting at least one error message to a user; and

computer code for, at least partly in response to the least one error message, restarting the non-compliant electronic device.

14. The computer program product of claim 10, further comprising computer code for at least partly initiating a safe boot operation in response to actuation of a predesignated key combination by the user.

15. The computer program product of claim 10, further comprising computer code for at least partly initiating a safe boot operation in response to a detection of a fatal system failure.

16. The computer program product of claim 15, wherein the fatal system failure is detected by a device selected from the group consisting of a base boot manager and a system boot manager.

17. The computer program product of claim 10, further comprising computer code for, before initiating the safe boot procedure, querying a user of the electronic device about the upcoming safe boot procedure.

18. A system for initiating a safe boot operation, comprising:

an electronic device; and

a remote terminal configured to communicate with the electronic device, the remote terminal including a computer code for transmitting at least one first authentication request to the electronic device,

wherein when the remote terminal transmits the at least one first authentication request, the electronic device initiates a safe boot procedure.

19. The system of claim 18, wherein in response to the transmission of the at least one first authentication request, the electronic device sets at least one internal flag on the electronic device indicating that the electronic device should boot in a safe mode, and wherein the remote terminal is configured to fail to authenticate at least one response authentication signal from the electronic device, causing the electronic device to at least partly initiate a safe boot procedure on the electronic device.

20. The system of claim 18, wherein the at least one response authentication signal comprises a 32-bit signed response.

21. The system of claim 18, wherein the electronic device comprises a mobile telephone.

22. The system of claim 18, wherein the remote terminal comprises a cellular network authentication center within the network.

23. The system of claim 18, wherein if the electronic device is a non-compliant electronic device, the electronic device transmits at least one error message to a user in response to receiving the at least one first authentication request.

24. The system of claim 18, wherein, before the safe boot procedure is initiated, the remote terminal queries a user of the remote terminal about the upcoming safe boot procedure.

25. An electronic device, comprising:

a processor; and

a memory unit operatively connected to the processor, the memory unit including;

computer code for receiving at least one first authentication request from a remote terminal, and

computer code for, at least partly in response to receiving the at least one first authentication request, initiating a safe boot procedure.

26. The electronic device of claim 25, wherein the memory unit includes:

computer code for setting at least one internal flag indicating that the electronic device should boot in a safe mode at least partly in response to the at least one first authentication request,

computer code for transmitting to the remote terminal at least one response authentication signal to the at least one first authentication request, and

computer code for, at least partly in response to the remote terminal failing to authenticate the at least one response authentication signal, initiating the safe boot procedure.

27. The electronic device of claim 25, wherein the memory unit comprises a read-only memory.

28. The electronic device of claim 25, wherein the at least one first authentication request comprises safe-boot-specific RAND.

29. The device of claim 25, wherein the at least one response authentication signal comprises a 32-bit signed response.

30. The electronic device of claim 25, wherein if the electronic device is a non-compliant electronic device, the electronic device transmits at least one error message to a user in response to receiving the at least one first authentication request.

31. The electronic device of claim 25, wherein the memory unit includes computer code for, before the initiation of the safe boot procedure, querying a user of the electronic device about the upcoming safe boot procedure.

33. The module of claim 31, wherein the memory unit includes:

computer code for setting at least one internal flag indicating that the electronic device should boot in a safe mode at least partly in response to the at least one first authentication request,

computer code for transmitting to the remote terminal at least one response authentication signal to the at least one first authentication request, and

computer code for, at least partly in response to the remote terminal failing to authenticate the at least one response authentication signal, initiating the safe boot procedure.

35. The device of claim 33, wherein the at least one authentication request comprises a safe-boot-specific RAND.

36. The device of claim 33, wherein the at least one response authentication signal comprises a 32-bit signed response.

37. The electronic device of claim 33, wherein the remote terminal comprises a GSM network authentication centre.

38. The electronic device of claim 33, wherein the remote terminal comprises a Serving GPRS Support Node.

39. The electronic device of claim 33, wherein the remote terminal comprises a RFID device.

40. The electronic device of claim 33, wherein the at least one first authentication request is sent over WLAN connection.

42. The computer program product of claim 40, wherein the authentication request comprises a safe-boot-specific RAND.

43. The computer program product of claim 40, wherein the at least one response authentication signal comprises a 32-bit signed response.

32. A module for use in an electronic device, comprising:

a processor;

a data communication link for communicating with a remote terminal; and

a memory unit including;

computer code for receiving at least one first authentication request from the remote terminal, and

computer code for, at least partly in response to receiving the at least one first authentication request, initiating a safe boot procedure.

34. An electronic device for transmitting a safe boot instruction to at least one electronic device on a network, comprising:

a processor;

a data communication link for communicating with the electronic device; and

a memory unit including;

computer code for transmitting at least one authentication request to the at least one electronic device;

computer code for receiving from the electronic device at least one response authentication signal in response to the at least one authentication request;

computer code for rejecting the at least one response authentication signal,

wherein the electronic device initiates a safe boot procedure at least partly in response to the at least one authentication request.

41. A computer program product for transmitting a safe boot instruction to at least one electronic device on a network, comprising:

computer code for transmitting at least one authentication request to the electronic device;

computer code for receiving from the at least one electronic device at least one response authentication signal in response to the at least one authentication request; and

computer code for rejecting the at least one response authentication signal,

wherein the electronic device initiates a safe boot procedure at least partly in response to the at least one authentication request.

44. A module for transmitting at least one safe boot instruction to at least one electronic device on a network, comprising:

a data communication link for communicating with the at least one electronic device; and

a memory unit including;

computer code for transmitting at least one authentication request to the at least one electronic device,

computer code for receiving from the at least one electronic device at least one response authentication signal in response to the at least one authentication request, and

computer code for rejecting the at least one response authentication signal,

wherein the at least one electronic device initiates a safe boot procedure at least partly in response to the authentication request.