Executing software

Patent metadata

Field	Value
Publication number	US-11615188-B2
Application number	US-201816604161-A
Country	US
Kind code	B2
Filing date	May 2, 2018
Priority date	May 2, 2018
Publication date	Mar 28, 2023
Grant date	Mar 28, 2023

Abstract

An example method is disclosed, for example a method of executing a software module in a computing system, the method comprising executing, in a first processing device of the computing system, a first software module to verify a second software module and to cause a second processing device of the computing system to execute the second software module, executing, in the second processing device, the second software module to execute, in the second processing device, a third software module and to provide a first key of a key pair to the third software module, and protecting, by the second processing device, a memory space associated with the third software module, wherein the memory space contains the first key of the key pair, wherein the first processing device contains a second key of the key pair.

First claim

The invention claimed is:

1. A method of executing a software module in a computing system, the method comprising:
executing, in a first processing device of the computing system, a first software module to verify a second software module and to cause a second processing device of the computing system to execute the second software module;
executing, in the second processing device, the second software module to execute, in the second processing device, a third software module and to provide a first key of a key pair to the third software module; and
protecting, by the second processing device, a memory space associated with the third software module, wherein the memory space contains the first key of the key pair;
wherein the first processing device contains a second key of the key pair.

2. The method of claim 1 , wherein the first processing device comprises a trusted processing device.

3. The method of claim 1 , wherein the second software module comprises a boot firmware of the computing system.

4. The method of claim 1 , comprising generating, by the third software module, the first and second keys of the key pair and providing the second key of the key pair to the first processing device.

5. The method of claim 1 , wherein the key pair comprises one of a symmetric key pair and an asymmetric key pair.

6. The method of claim 1 , comprising monitoring, by the third software module, an integrity of the computing system, securing an indication of the integrity of the computing system using the first key of the key pair and providing the secured indication to the first processing device.

7. The method of claim 1 , wherein the second key of the key pair is stored in a memory of the first processing device.

8. A processing apparatus comprising:
a memory;
a first processor to run a first code component during a boot process to authenticate a second code component, to load the second code component into the memory and to store a first key of a key pair; and
a second processor to run the second code component to load a third code component into the memory, to protect an area of the memory and to store a second key of the key pair in the area of the memory.

9. The processing apparatus of claim 8 , wherein the first code component comprises a firmware of the first processor and the second code component comprises a boot firmware of the processing apparatus.

10. The processing apparatus of claim 8 , wherein the second processor is to run the third code component to generate the first and second keys of the key pair and to provide the first key of the key pair to the first processor.

11. The processing apparatus of claim 8 , wherein the second processor is to run the third code component to determine a status of at least one operational characteristic of the processing apparatus and to provide a message secured by the second key to the first processor, wherein the message includes an indication of the status.

12. A computing device comprising:
a first processing apparatus to verify a boot firmware of the computing device; and
a second processing apparatus, wherein the first processing apparatus is to cause the second processing apparatus to execute the boot firmware;
wherein the boot firmware is to cause the second processing apparatus to load a software module into a memory of the computing device and to secure an area of the memory associated with the software module that contains a first key of a key pair; and
wherein the first processing apparatus is to store a second key of the key pair.

13. The computing device of claim 12 , wherein the first processing apparatus comprises a trusted processor.

14. The computing device of claim 12 , wherein the key pair comprises a symmetric key pair, or the key pair comprises an asymmetric key pair wherein the second key comprises a public key.

15. The computing device of claim 12 , wherein the second processing apparatus is to run the software module to generate the first and second keys of the key pair and to send the second key of the key pair to the first processing apparatus.

Assignees

• Hewlett Packard Development Co

Inventors

• Plaquin David
• Loutfi Ijlal

Classifications

• G06F21/572 Primary

  Secure firmware programming, e.g. of basic input output system [BIOS] · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/0819

  Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062) · CPC title

• G06F2221/2105

  Dual mode as a secondary aspect · CPC title

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title