Secure Booting A Computing Device

• US 20080165952A1
• Filed: 01/07/2007
• Published: 07/10/2008
• Est. Priority Date: 01/07/2007
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Smith, Michael, de Cesare, Joshua, De Atley, Dallas Blake, Wright, John Andrew
• Granted Patent: US 8,254,568 B2
• Time in Patent Office: Days
• US Class Current: 380/28
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user

Abstract

A method and an apparatus for executing codes embedded inside a device to verify a code image loaded in a memory of the device are described. A code image may be executed after being verified as a trusted code image. The embedded codes may be stored in a secure ROM (read only memory) chip of the device. In one embodiment, the verification of the code image is based on a key stored within the secure ROM chip. The key may be unique to each device. Access to the key may be controlled by the associated secure ROM chip. The device may complete establishing an operating environment subsequent to executing the verified code image.

Claims

1. A computer implemented method, comprising:

executing codes embedded from a ROM (read only memory) of a device to verify a first code image using a key stored within the ROM; and

in response to successfully verifying the first code image, executing the verified first code image in a main memory of the device.

2. The method of claim 1, further comprising:

deriving a hash value from the first code image; and

determining a match between the hash value and a first header value from the first code image based on the key, the first header value digitally signing the first code image.

3. The method of claim 2, wherein the executing the verified first code image comprises:

deriving a second hash value from a second code image having a second header value, the second header value digitally signing the second code image; and

determining a match between the second hash value and the second header value based on the key.

4. The method of claim 3, wherein the determining comprises:

encrypting the second hash value into a signature value associated with the key; and

comparing the signature value and the second header value, wherein the signature value is based on a seed string associated with the device.

5. The method of claim 1, wherein the key is configured to uniquely identify the device.

6. The method of claim 1, wherein the device is a portable device.

7. The method of claim 1, wherein the first code image is configured to establish an operating environment for the device.

8. The method of claim 1, wherein the first code image represents a component of a kernel of an operating system (OS), wherein the method further comprises, for each component of the kernel of the OS, repeating verifying and executing code image of each component until all components of the kernel have been verified and executed.

9. A machine-readable medium having instructions, which when executed by a machine, cause a machine to perform a method, the method comprising:

executing codes embedded from a ROM (read only memory) of a device to verify a first code image using a key stored within the ROM; and

in response to successfully verifying the first code image, executing the verified first code image in a main memory of the device to establish an operating environment for the device.

10. The machine-readable medium of claim 9, wherein the method further comprises:

deriving a hash value from the first code image; and

determining a match between the hash value and a first header value from the first code image based on the key, the first header value digitally signing the first code image.

11. The machine-readable medium of claim 10, wherein executing the verified first code image comprises:

deriving a second hash value from a second code image having a second header value, the second header value digitally signing the second code image; and

determining a match between the second hash value and the second header value based on the key.

12. The machine-readable medium of claim 11, wherein the determining comprises:

encrypting the second hash value into a signature value associated with the key; and

comparing the signature value and the second header value, wherein the signature value is based on a seed string associated with the device.

13. The machine-readable medium of claim 9, wherein the key is configured to uniquely identify the device.

14. The machine-readable medium of claim 9, wherein the device is a portable device.

15. The machinereadable medium of claim 9, wherein the first code image is configured to establish an operating environment for the device.

16. The machine-readable medium of claim 9, wherein the first code image represents a component of a kernel of an operating system (OS), wherein the method further comprises, for each component of the kernel of the OS, repeating verifying and executing code image of each component until all components of the kernel have been verified and executed.

17. An apparatus comprising:

means for executing codes embedded from a ROM (read only memory) of a device to verify a first code image using a key stored within the ROM; and

means for executing, in response to successfully verifying the first code image, the verified first code image in a main memory of the device to establish an operating environment for the device.

18. An electronic device, comprising:

a ROM (read only memory) to store codes embedded therein and a key identifying the electronic device;

a mass storage to store a first code image;

a main memory; and

a processor coupled to the ROM, the mass storage, and the main memory, wherein the processor is configured to execute the code embedded from the ROM to verify the first code image from the mass storage and upon successfully verifying the first code image, to execute the verified first code image in the main memory to establish an operating environment of the electronic device.

19. A computer implemented method, comprising;

executing codes embedded from a secure ROM (read-only memory) of a portable device to verify a first executable image representing a kernel of an operating system (OS) that provides an operating environment of the portable device, the first executable image being verified using a key stored within the secure ROM and the key uniquely identifying the portable device, wherein the first executable image is stored in a mass storage of the portable device; and

upon successfully verifying the first code image, executing the first executable image in a main memory of the portable device to set up the kernel of the OS in order to establish the operating environment of the portable device.

20. The method of claim 19, further comprising upon successfully executing the first executable image, the kernel configuring and loading a second executable image from the mass storage to establish a remainder of the OS, the second executable image representing at least one of user applications, user data, and libraries.

21. The method of claim 20, wherein the embedded codes and the key are embedded in the secure ROM prior to releasing the portable device from a manufacturer, and wherein the first executable image is digitally signed by data representing the key.

22. A machine-readable medium having instructions stored therein, which when executed by a machine, cause a machine to perform a method, the method comprising:

executing codes embedded from a secure ROM (read-only memory) of a portable device to verify a first executable image representing a kernel of an operating system (OS) that provides an operating environment of the portable device, the first executable image being verified using a key stored within the secure ROM and the key uniquely identifying the portable device, wherein the first executable image is stored in a mass storage of the portable device; and

upon successfully verifying the first code image, executing the first executable image in a main memory of the portable device to set up the kernel of the OS in order to establish the operating environment of the portable device.

23. The machine-readable medium of claim 22, wherein the method further comprises upon successfully executing the first executable image, the kernel configuring and loading a second executable image from the mass storage to establish a remainder of the OS, the second executable image representing at least one of user applications, user data, and libraries.

24. The machine-readable medium of claim 23, wherein the embedded codes and the key are embedded in the secure ROM prior to releasing the portable device from a manufacturer, and wherein the first executable image is digitally signed by data representing the ke

25. A computer implemented method, comprising:

executing a first executable image embedded from a secure ROM (read-only memory) of a device to initialize a mass storage device associated with the device to enable the mass storage device to be accessed, the secure ROM having stored therein a unique identifier (ID) uniquely identifying the device;

upon successfully initializing the mass storage device, locating and verifying a second executable image stored within the mass storage device using the unique identifier (ID) embedded within the secure ROM;

upon successfully verifying the second executable image, executing the second executable image to perform low level hardware initialization on the device;

the second executable image, when successfully executed, locating and executing a third executable image, the third executable image to verify and load a kernel image of an operating system (OS) for the device, wherein the kernel image, when successfully loaded, initializes and configures a remainder of the OS for the device.

26. The method of claim 25, wherein when verification of any of the first, second, and third executable images fails, the method further comprises performing a recovery process to recover the respective executable image immediately without continuing executing a subsequent executable image.

27. The method of claim 25, wherein the device is a portable device.

29. The machine-readable medium of claim 27, wherein when verification of any of the first, second, and third executable images fails, the method further comprises performing a recovery process to recover the respective executable image immediately without continuing executing a subsequent executable image.

30. The machine-readable medium of claim 27, wherein the device is a portable device.

28. A machine-readable medium having instructions stored therein, which when executed by a machine, cause a machine to perform a method, the method comprising:

executing a first executable image embedded from a secure ROM (read-only memory) of a device to initialize a mass storage device associated with the device to enable the mass storage device to be accessed, the secure ROM having stored therein a unique identifier (ID) uniquely identifying the device;

upon successfully initializing the mass storage device, locating and verifying a second executable image stored within the mass storage device using the unique identifier (ID) embedded within the secure ROM;

upon successfully verifying the second executable image, executing the second executable image to perform low level hardware initialization on the device;

the second executable image, when successfully executed, locating and executing a third executable image, the third executable image to verify and load a kernel image of an operating system (OS) for the device, wherein the kernel image, when successfully loaded, initializes and configures a remainder of the OS for the device.