System and method for signing and interlocking a boot information file to a host computing system

Patent metadata

Field	Value
Publication number	US-11907375-B2
Application number	US-202117228917-A
Country	US
Kind code	B2
Filing date	Apr 13, 2021
Priority date	Apr 13, 2021
Publication date	Feb 20, 2024
Grant date	Feb 20, 2024

Abstract

Example implementations relate to system and method of signing a boot information file by a manageability controller, and interlocking host computing system to signed boot information file. The boot information file may include a boot loader file and/or an OS kernel file of the host computing system. The manageability controller receives the boot information file from a processor of a computing device. Further, the manageability controller signs the boot information file with a hashed data of a unique identifier, to generate and communicate the signed boot information file to the processor. Later, the manageability controller updates a boot database stored in non-volatile random-access memory of a firmware engine of the host computing system with a thumbprint data of the signed boot information file to interlock the host computing system to the signed boot information file, in response to successful download of the signed boot information file by the processor.

First claim

What is claimed is:

1. A method comprising:
receiving, by a manageability controller of a host computing system, a boot information file of the host computing system from a processor of a computing device;
signing, by the manageability controller, the boot information file with a hashed data of a unique identifier, to generate a signed boot information file;
communicating, by the manageability controller, the signed boot information file to the processor;
in response to successful download of the signed boot information file by the processor, updating, by the manageability controller, a boot database stored in a non-volatile random-access memory of a firmware engine of the host computing system with a thumbprint data of the signed boot information file for interlocking the host computing system to the signed boot information file; and
appending, by the manageability controller, the boot information file stored in a non-volatile storage drive of the host computing system, by using the hashed data of the unique identifier to generate an appended boot information file, wherein the appended boot information file and the signed boot information file are similar files.

2. The method of claim 1 , further comprising, repeating the steps of signing the boot information file, communicating the signed boot information file, updating the boot database in the firmware engine, and appending the boot information file stored in the non-volatile storage drive, by the manageability controller, upon receiving an updated boot information file from the processor.

3. The method of claim 1 , further comprising upon subsequent booting of the host computing system:
accessing, by the firmware engine, the appended boot information file stored in the non-volatile storage drive of the host computing system based on the thumbprint data stored in the boot database;
validating, by the firmware engine, the hashed data of the unique identifier in the appended boot information file by using a public key of the manageability controller; and
in response to successful validation, allowing, by the firmware engine, the processor to use the boot information file for loading an operating system of the host computing system.

4. The method of claim 1 , wherein receiving the boot information file comprises:
establishing, by the processor, a secure connection with the manageability controller;
posting, by the processor, a pre-determined link to a non-volatile storage drive of the host computing system for sharing the boot information file with the manageability controller; and
accessing, by the manageability controller, the pre-determined link to receive the boot information file from the non-volatile storage drive of the host computing system.

5. The method of claim 1 , wherein receiving the boot information file comprises:
establishing, by the processor, a connection with the manageability controller;
posting, by the processor, a pre-determined link to a non-volatile storage drive of the host computing system for sharing the boot information file with the manageability controller; and
accessing, by the manageability controller, the pre-determined link to validate a customer signature in the boot information file, and receive the boot information file from the non-volatile storage drive of the host computing system upon successful validation of the customer signature in the boot information file.

6. The method of claim 1 , wherein the boot information file is a customized boot information file having a plurality of parameters configured for running one or more workloads in the host computing system.

7. The method of claim 1 , wherein the boot information file comprises at least one of a boot loader file or an operating system (OS) kernel file of the host computing system.

8. The method of claim 1 , wherein the unique identifier is a private key corresponding to the manageability controller that is stored in a trusted platform module of the manageability controller.

9. The method of claim 1 , further comprising in response to successful download of the signed boot information file by the processor, purging, by the manageability controller, pre-existing boot data in the boot database into a purged boot database stored in the non-volatile random-access memory of the firmware engine before updating the boot database with the thumbprint data of the signed boot information file.

10. A manageability controller of a host computing system, comprising:
a machine readable medium that stores program instructions; and
a processing resource operably coupled to the machine readable medium, wherein the processing resource executes the program instructions to:
receive a boot information file of the host computing system from a processor of a computing device;
sign the boot information file with a hashed data of a unique identifier, to generate a signed boot information file;
communicate the signed boot information file to the processor;
in response to successful download of the signed boot information file by the processor, update a boot database stored in a non-volatile random-access memory of a firmware engine of the host computing system with a thumbprint data of the signed boot information file for interlocking the host computing system to the signed boot information file; and
append the boot information file stored in a non-volatile storage drive of the host computing system, by using the hashed data of the unique identifier to generate an appended boot information file, wherein the appended boot information file and the signed boot information file are similar files.

11. The manageability controller of claim 10 , wherein the processing resource further executes the program instructions to repeat the steps of signing the boot information file, communicating the signed boot information file, updating the boot database in the firmware engine, and appending the boot information file stored in the non-volatile storage drive, by the manageability controller, upon receiving an updated boot information file from the processor.

12. The manageability controller of claim 10 , wherein the boot information file is a customized boot information file having a plurality of parameters configured for running one or more workloads in the host computing system.

13. The manageability controller of claim 10 , wherein the boot information file comprises at least one of a boot loader file or an operating system (OS) kernel file of the host computing system.

14. The manageability controller of claim 10 , wherein the unique identifier is a private key corresponding to the manageability controller that is stored in a trusted platform module of the manageability controller.

15. The manageability controller of claim 10 , further comprising in response to successful download of the signed boot information file by the processor, purging, by the manageability controller, pre-existing boot data in the boot database into a purged boot database stored in the non-volatile random-access memory of the firmware engine before updating the boot database with the thumbprint data of the signed boot information file.

16. A non-transitory machine readable medium that stores instructions executable by a manageability controller of a host computing system, wherein instructions comprising:
a first instruction to receive a boot information file of the host computing system from a processor of a computing device, wherein the processor is separate from the manageability controller;
a second instruction to sign the boot information file with a hashed data of a unique identifier, to g

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Preimesberger Lee A
• Kasheshian Vartan Yosef
• Cisneros Jorge

Classifications

• G06F21/575 Primary

  Secure boot · CPC title

• G06F9/4406

  Loading of operating system · CPC title

• G06F16/2379

  Updates performed during online database operations; commit processing · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title