Secure boot of remote servers

Patent metadata

Field	Value
Publication number	US-10963570-B2
Application number	US-201816216302-A
Country	US
Kind code	B2
Filing date	Dec 11, 2018
Priority date	Dec 11, 2018
Publication date	Mar 30, 2021
Grant date	Mar 30, 2021

Abstract

Systems and methods for diskless booting a remote server. The remote server includes a secure cryptoprocessor having a root key that is unique to the cryptoprocessor. Keying information can be fetched from an image server, which includes a certificate associated with the remote server and a private key of a key pair associated with the remote server. The key pair can be generated by the secure cryptoprocessor based on the root key. The client certificate can be created from a public key of the key pair. A mutually authenticated secure channel between the servers can be established by authenticating the servers based at least in part on the loaded keying information. Images of components of the remote server can be fetched from the image server via the secure channel, and then the remote server can be further booted accordingly.

First claim

What is claimed is:

1. A method for booting a remote server, comprising:
initiating, by a boot script at a remote server, a boot of the remote server that comprises a secure cryptoprocessor comprising a root key that is unique to the secure cryptoprocessor;
fetching, by the boot script and from an image database through an image server, keying information comprising a client certificate associated with the remote server and a private key of a key pair associated with the remote server, the key pair generated by the secure cryptoprocessor based on the root key of the secure cryptoprocessor and the client certificate created from a public key of the key pair;
loading, by the boot script, the keying information into the secure cryptoprocessor;
establishing a mutually authenticated secure channel between the remote server and the image server by authenticating the remote server and the image server via mutual authentication based at least in part on the loaded keying information;
fetching, via the mutually authenticated secure channel, images of components of the remote server from the image server; and
continuing the boot of the remote server with the fetched images of components of the remote server.

2. The method of claim 1 , wherein the secure cryptoprocessor is a trusted platform module (TPM), and wherein the root key is a storage root key (SRK) of the TPM.

3. The method of claim 2 , wherein the boot script is implemented by preboot execution environment client firmware and bootloader that supports HTTPS and TPM operations.

4. The method of claim 3 , further comprising: when the remote server is powered on, invoking a bootloader of the preboot execution environment that supports TPM operations, and loading, by the bootloader, the preboot execution environment.

5. The method of claim 4 , further comprising issuing, by the preboot execution environment, a DHCP request for a network address for the remote server and a network address of the boot script.

6. The method of claim 5 , further comprising fetching, by the boot script, the keying information according to the network address of the remote server.

7. The method of claim 6 , wherein the continuing the boot of the remote server with the fetched images of components of the remote server occurs in RAM of the remote server.

8. The method of claim 1 , further comprising: encrypting, by the TPM, the private key of the key pair based on the root key.

9. The method of claim 8 , further comprising sealing, by the TPM, the private key based on the root key and PCRs of the TPM.

10. The method of claim 1 , wherein the fetching of the images of components of the remote server from the image server is initiated by HTTPS requests from the boot script to the image server.

11. The method of claim 1 , wherein the fetched images comprise images selected from the group consisting of a kernel image, an operating system image, and intermediate images for booting into the operating system image.

12. A remote server, comprising:
a trusted platform module (TPM) that is embedded in the remote server before the remote server is distributed to a remote site, the TPM configured to:
generate a key pair based on a storage root key (SRK) of the TPM;
create a client certificate from a public key of the key pair; and
output the key pair and the client certificate for registration at an image database communicatively coupled to an image server, the image server comprising images of components of the remote server;

and instructions stored in memory of the remote server that are executable by a processor of the remote server to retrieve an image of a boot script, the boot script configured to fetch, from the image server, images of components of the remote server via a mutually authenticated secure channel between the remote server and the image server established at least in part on a private key of the key pair and the certificate fetched from the image server, the boot script further configured to cause the remote server to boot with the images of components of the remote server fetched from the image server.

13. The remote server of claim 12 , wherein the boot script is implemented by preboot execution environment client firmware and bootloader that supports HTTPS and TPM operations.

14. The remote server of claim 13 , wherein the preboot execution environment is configured to issue a DHCP request for a network address of the remote server and a network address of the boot script.

15. The remote server of claim 14 , wherein the preboot execution environment is configured to fetch the private key and the client certificate upon receiving the addresses of the remote server and the boot script.

16. The remote server of claim 15 , wherein when the image of the boot script is loaded in RAM of the remote server, the boot script is configured to load the fetched images from the image sever to RAM of the remote server.

17. A remote server, comprising:
a secure cryptoprocessor, comprising a root key that is unique to the secure cryptoprocessor, and configured to generate a key pair based on the root key; and
a boot script, configured to:
initiate a boot of the remote server;
fetch, from an image database through an image server, keying information comprising a client certificate associated with the remote server and a private key of the key pair associated with the remote server, the client certificate created from a public key of the key pair;
load the keying information into the secure cryptoprocessor;
establish a mutually authenticated secure channel with the image server by authenticating the image server via mutual authentication based at least in part on the loaded keying information;
fetch, via the mutually authenticated secure channel, images of components of the remote server from the image server; and
continue the boot of the remote server with the fetched images of components of the remote server.

18. The system of claim 17 , wherein the secure cryptoprocessor is a trusted platform module (TPM).

19. The system of claim 18 , wherein the root key is a storage root key (SRK) of the TPM.

20. The system of claim 17 , wherein the mutual authentication comprises transport layer security (TLS) mutual authentication.

Assignees

• Verizon Media Inc

Inventors

• Hinrichs Susan
• Bindiganavale Vinith
• Gashinsky Igor
• Palandzhyan Grigor

Classifications

• H04L9/3273 Primary

  for mutual authentication (network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869) · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• H04L9/3073

  involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F9/4416

  Network booting; Remote initial program loading [RIPL] · CPC title