Compatible trust in a computing device

• US 8,230,412 B2
• Filed: 08/31/2007
• Issued: 07/24/2012
• Est. Priority Date: 08/31/2007
• Status: Active Grant

• Current Assignee: Apple Computer Incorporated (Apple Inc.), Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: De Atley, Dallas Blake, de Cesare, Joshua, Smith, Michael, Hauck, Jerry, Bush, Jeffrey
• Primary Examiner(s): Dam, Tuan
• Assistant Examiner(s): Wei, Zheng
• Application Number:
  US11/897,655
• Publication Number:
  US 20090063108A1
• Time in Patent Office: 1,789 Days
• Field of Search: None
• US Class Current: 717/165
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

A method and apparatus for executing a first executable code image having a first version number into a memory of a device in an attempt to establish an operating environment of the device are described. The first executable code image retrieves a second version number from the second executable code image after successfully authenticating the second executable code image. If the first version number and the second version number do not satisfy a predetermined relationship, the second executable code image is prevented from being loaded by the first executable code image.

Claims

1. A computer implemented method for establishing an operating environment of a device, the method comprising:

executing a first executable code image in a memory of a device in an attempt to establish an operating environment of the device, the first executable code image being associated with a first version number;

the first executable code image, which when executed from the memory, authenticating a second executable code image, which when successful, to retrieve a second version number from the second executable code image; and

the first and second executable code images mutually verifying compatibility between the first and second code images, wherein the mutual verification is capable of preventing the second executable code image from being loaded by the first executable code image if the first version number and the second version number do not satisfy a predetermined relationship and wherein the mutual verification interrupts execution of the second executable code image if the first and second version numbers do not satisfy the predetermined relationship and the second executable code image is loaded by the first executable code image.

2. The method of claim 1, wherein the second version number of the second executable code image is revealed from the second executable code image when the second executable code image is successfully authenticated by the first executable code image.

3. The method of claim 1, further comprising the first executable code image loading the second executable code image only if the first version number and the second version number satisfy the predetermined relationship.

4. The method of claim 3, wherein the second code image is loaded for the execution to receive the first version number from the first executable code image, and wherein the mutual verification comprises:

verifying a compatibility with the first code image based on the first version number and the second version number; and

interrupting the executing the second executable code image if the compatibility is not verified.

5. The method of claim 4, wherein the compatibility is verified according to the predetermined relationship.

6. The method of claim 1, wherein the second executable code image is prevented from being loaded when the first version number is higher than the second version number.

7. The method of claim 1, wherein the predetermined relationship includes matching the first version number and the second version number.

8. The method of claim 6 further comprising restoring at least the second executable code image from a host communicatively coupled to the device if the first version number and the second version number satisfy the predetermined relationship, the restored second executable code image having a third version number higher than at least one of the first version number and the second version number.

9. The method of claim 1, wherein the first executable code image is executed by a boot code stored in a secure ROM (read-only memory) of the device, wherein the boot code is configured to authenticate the first executable code image using a hardware key embedded within the device.

10. The method of claim 1, wherein the device is a portable device.

11. A non-transitory computer-readable storage medium having instructions stored therein, which when executed by a machine, cause a machine to perform a method for establishing an operating environment of a device, the method comprising:

executing a first executable code image into in a memory of a device in an attempt to establish an operating environment of the device, the first executable code image being associated with a first version number;

the first executable code image, which when executed from the memory, authenticating a second executable code image, which when successful, to retrieve a second version number from the second executable code image; and

the first and second executable code images mutually verifying compatibility between the first and second code images, wherein the mutual verification is capable of preventing the second executable code image from being loaded by the first executable code image if the first version number and the second version number do not satisfy a predetermined relationship and wherein the mutual verification interrupts execution of the second executable code image if the first and second version numbers do not satisfy the predetermined relationship and the second executable code image is loaded by the first executable code image.

12. The computer-readable storage medium of claim 11, wherein the second version number of the second executable code image is revealed from the second executable code image when the second executable code image is successfully authenticated by the first executable code image.

13. The computer-readable storage medium of claim 11, wherein the method further comprises the first executable code image loading the second executable code image only if the first version number and the second version number satisfy the predetermined relationship.

14. The computer-readable storage medium of claim 13, wherein the second code image is loaded for the execution to receive the first version number from the first executable code image, and wherein the mutual verification comprises:

verifying a compatibility with the first code image based on the first version number and the second version number; and

interrupting the executing the second executable code image if the compatibility is not verified.

15. The computer-readable storage medium of claim 11, wherein the second executable code image is prevented from being loaded when the first version number is higher than the second version number.

16. The computer-readable storage medium of claim 11, wherein the second executable code image is prevented from being loaded if the second version number cannot be retrieved from the second executable code image.

17. The computer-readable storage medium of claim 15, wherein the method further comprises restoring at least the second executable code image from a host communicatively coupled to the device if the first version number and the second version number satisfy the predetermined relationship, the restored second executable code image having a third version number higher than at least one of the first version number and the second version number.

18. The computer-readable storage medium of claim 11, wherein the first executable code image is executed by a boot code stored in a secure ROM (read-only memory) of the device, wherein the boot code is configured to authenticate the first executable code image using a hardware key embedded within the device.

19. The computer-readable storage medium of claim 11, wherein the device is a portable device.

20. A computer-implemented method for establishing an operating environment of a device, the method comprising:

authenticating a first and second executable images to be loaded into a memory of the device in an attempt to establish an operating environment of the device;

in response to successfully authenticating the first and second executable code images, examining a first version number stored in the first executable code image and a second version number stored in the second executable code image for a compatibility between the first and second executable code images; and

mutually verifying the compatibility between the first and second code images based on the first and second version numbers, wherein the compatibility is verified if the first and second version numbers satisfy a predetermined condition, wherein the mutual verification is capable of preventing the second executable code image from being loaded if the compatibility is not verified and wherein the mutual verification interrupts execution of the second executable code image if the compatibility is not verified and the second code image is loaded in the memory.

21. The method of claim 20, wherein the second executable code image is executed only if the second executable code image is successfully authenticated and the first and second version numbers satisfy the predetermined condition.

22. A computer-implemented method, comprising:

receiving a plurality of executable code images to be loaded in sequence in order to establish an operating environment of a portable device; and

sequentially authenticating the plurality of executable code images, wherein a current executable code image is configured to authenticate a next executable code image in the sequence and upon successfully authenticating the next executable code image, to examine a first version of the next executable code image, wherein the next executable code image is configured to examine a second version of the current executable code image, wherein the first and second executable code images are configured to mutually verify a compatibility between the current and next executable code images based on whether the first and second versions satisfy a predetermined relationship, wherein the mutual verification is capable of preventing the next executable code image from being loaded if the compatibility is not verified and wherein the mutual verification interrupts execution of the next executable code image if the compatibility is not verified and the next executable code image is loaded.