System and method for programming an isolated computing environment

• US 20060112384A1
• Filed: 04/19/2005
• Published: 05/25/2006
• Est. Priority Date: 11/15/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Frank, Alexander, Phillps, Thomas G.
• Granted Patent: US 7,562,220 B2
• Time in Patent Office: Days
• US Class Current: 717/168
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A computer is provided with an isolated computing environment. The isolated computing environment is adapted to allow initial programming for use in manufacturing, distribution and sales. The isolated computing environment further allows an authenticated source or authenticated code to update the isolated computing environment with code and configuration data for use in the end-user environment. To encourage final updating, the computer may be placed in a limited-function mode until authorized code is installed and operational. A method and apparatus are disclosed for the sanctioning and secure update of the isolated computing environment.

Claims

1. An isolated computing environment for use in a computer, the isolated computing environment executing computer-executable instructions comprising:

a core service;

an interface for receiving a message, the message comprising at least one of an update code and configuration information;

a cryptographic service for accessing a first key and verifying a digital signature of the message using the first key; and

an update service, wherein the update service updates the core service responsive to the message after verification of the message using the first key.

2. The isolated computing environment of claim 1, further comprising a configuration table, wherein the update service updates the configuration table, responsive to the message comprising the configuration information.

3. The isolated computing environment of claim 1, further comprising a sanction service for limiting a function of the computer

4. The isolated computing environment of claim 3, wherein the sanction service limits the function of the computer prior to the update of the core service responsive to the message verified by the first key.

5. The isolated computing environment of claim 1, further comprising a hosted application, wherein the message comprises at least one of a core service update data and a hosted application update data.

6. The isolated computing environment of claim 1, wherein a characteristic of the core service is digitally verified.

7. The isolated computing environment of claim 1, further comprising an application program interface, the application program interface providing a standard interface between the computer and the isolated computing environment facilitating one of instantiating an application hosted on the isolated computing environment, configuring an application hosted on the isolated computing environment, and updating the isolated computing environment.

8. A computer adapted to operate using an isolated computing environment, the computer comprising:

a processor;

a memory coupled to the processor for storing processor-executable instructions; and

an isolated computing environment responsive to signals sent via the application program interface, the isolated computing environment comprising;

a cryptographic circuit;

a processing circuit;

a secure memory for storing an application program interface, a first executable code, and a first configuration; and

a sanction circuit for impeding a function of the computer;

wherein the sanction circuit impedes a function of the computer at least until one of the first executable code and the first configuration are replaced using the application program interface.

9. The computer of claim 8, further comprising a port for bidirectional data transfer, wherein data received via the port includes at least one of a second executable code and a second configuration.

10. The computer of claim 8, wherein the application program interface comprises a first routine for updating one of the first executable code and the first configuration

11. The computer of claim 8, wherein the application program interface comprises support for a secure data transfer connection to the isolated computing environment.

12. The computer of claim 8, further comprising a trigger mechanism coupled between the computer and the sanction circuit, whereby the function of the computer is impeded when the sanction circuit is triggered.

13. The computer of claim 12, wherein the trigger mechanism is tamper-resistant.

14. The computer of claim 8, wherein impeding the function of computer comprises one of a persistent reset and reducing the functionality of the processor.

15. A method of programming an isolated computing environment in a computer, the computer having an operating system, the method comprising:

providing the computer including an isolated computing environment;

programming provisional functionality into the isolated computing environment;

receiving executable instructions from operating system;

authenticating the executable instructions;

reprogramming the isolated computing environment with updated functionality over the provisional functionality.

16. The method of claim 15, further comprising limiting a function of the computer when the authenticating the executable instructions fails.

17. The method of claim 15, wherein programming the provisional functionality into the isolated computing environment comprises programming an interim cryptographic key and at least a download function.

18. The method of claim 17, wherein reprogramming the isolated computing environment with updated functionality comprises authenticating the updated functionality using the interim cryptographic key.

19. The method of claim 17, wherein reprogramming the isolated computing environment with updated functionality comprises authenticating the source of the updated functionality using the interim cryptographic key.

20. The method of claim 15, further comprising limiting an operation of the computer, wherein limiting the operation of the computer comprises at least one of reducing functionality of a processor and resetting the computer.