Secure booting a computing device

• US 8,688,967 B2
• Filed: 07/25/2012
• Issued: 04/01/2014
• Est. Priority Date: 01/07/2007
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Smith, Michael, de Cesare, Joshua, De Atley, Dallas Blake, Wright, John Andrew
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Anderson, Michael D
• Application Number:
  US13/558,249
• Publication Number:
  US 20130024677A1
• Time in Patent Office: 615 Days
• Field of Search: 713/1, 713/2, 713/201
• US Class Current: 713/2
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user

Abstract

A method and an apparatus for executing codes embedded inside a device to verify a code image loaded in a memory of the device are described. A code image may be executed after being verified as a trusted code image. The embedded codes may be stored in a secure ROM (read only memory) chip of the device. In one embodiment, the verification of the code image is based on a key stored within the secure ROM chip. The key may be unique to each device. Access to the key may be controlled by the associated secure ROM chip. The device may complete establishing an operating environment subsequent to executing the verified code image.

Claims

1. A computer implemented method, comprising:

executing computer program codes embedded in a secure ROM (read-only memory) of a portable device to verify a first executable code image representing a kernel of an operating system (OS) that provides an operating environment of the portable device, the first executable image being verified by;

extracting a first signature value signed over the first executable image according to a key through hashing and encryption algorithms, the key stored within the secure ROM and uniquely identifying the portable device,

determining a second signature value based on the first executable image according to the key through the hashing and encryption algorithms,

comparing the first signature value to the second signature value, and

determining that the first executable image is successfully verified when the first signature value matches the second signature value,

wherein the first executable image is stored in a mass storage of the portable device; and

upon successfully verifying the first code image, executing the first executable image in a main memory of the portable device to set up the kernel of the OS in order to establish the operating environment of the portable device.

2. The method of claim 1, further comprising upon successfully executing the first executable image, the kernel configuring and loading a second executable image from the mass storage to establish a remainder of the OS, the second executable image representing at least one of user applications, user data, and libraries.

3. The method of claim 2, wherein the embedded codes and the key are embedded in the secure ROM prior to releasing the portable device from a manufacturer, and wherein the first executable image is digitally signed by data representing the key.

4. A machine-readable medium having instructions stored therein, which when executed by a machine, cause a machine to perform a method, the method comprising:

executing computer program codes embedded in a secure ROM (read-only memory) of a portable device to verify a first executable code image representing a digital rights management system that controls access to user data of operating system (OS) components, wherein the operating system provides an operating environment of the portable device, the first executable image being verified by;

extracting a first signature value signed over the first executable image according to a key through hashing and encryption algorithms, the key stored within the secure ROM and uniquely identifying the portable device, wherein the first executable image is stored in a mass storage of the portable device,

determining a second signature value based on the first executable image according to the key through the hashing and encryption algorithms,

comparing the first signature value to the second signature value, and

determining that the first executable image is successfully verified when the first signature value matches the second signature value; and

upon successfully verifying the first code image, executing the first executable image in a main memory of the portable device to control access to user data of the operating system components based upon the key.

5. The machine-readable medium of claim 4, wherein the method further comprises enabling the digital rights management system to access the key upon successfully verifying the first code image.

6. The machine-readable medium of claim 4, wherein the embedded codes and the key are embedded in the secure ROM prior to releasing the portable device from a manufacturer, and wherein the first executable image is digitally signed by data representing the key.

7. A computer implemented method, comprising:

executing a first executable code image embedded in a secure ROM (read-only memory) of a device to initialize a mass storage device associated with the device to enable the mass storage device to be accessed, the secure ROM having stored therein a unique identifier (ID) uniquely identifying the device;

upon successfully initializing the mass storage device, locating and verifying a second executable image stored within the mass storage device using the unique identifier (ID) embedded within the secure ROM, the second executable image being verified by;

extracting a first signature value signed over the second executable image according to the unique identifier through hashing and encryption algorithms,

determining a second signature value based on the second executable image according to the unique identifier through the hashing and encryption algorithms,

comparing the first signature value to the second signature value, and

determining that the second executable image is successfully verified when the first signature value matches the second signature value;

upon successfully verifying the second executable image, executing the second executable image to perform low level hardware initialization on the device, wherein, when the second executable image is successfully executed, a third executable image is located and executed, and is configured to verify and load a kernel image of an operating system (OS) for the device, wherein the kernel image, when successfully loaded, initializes and configures a remainder of the OS for the device.

8. The method of claim 7, wherein when verification of any of the first, second, and third executable images fails, the method further comprises performing a recovery process to recover the respective executable image immediately without continuing executing a subsequent executable image.

9. The method of claim 7, wherein the device is a portable device.