Method and apparatus for secure application launch using hash generation during packaging

Abstract

The method includes packaging files that are part of an application to form an application package. During the packaging process, having a hash calculator calculate a hash of the application package and having a signing module generate an application manifest that includes the hash of the application package. The method also includes adding the application manifest to the application package, having firmware executed by the processor verify a boot loader, and executing the boot loader to verify a kernel. The method also includes having the kernel verify a trust agent and having the trust agent process the application list to identify one or more files that are part of the application included in the application package and generate hashes of the one or more files included in the application package.

Description

[Technical Field]

[0001] The present disclosure relates to secure application launch using hash creation during packaging. [Background technology]

[0002] Booting is the process of loading system software into a computer system's main memory. The boot process begins with the execution of hardware / firmware that performs a power-on self-test, followed by the loading and execution of a boot loader. Some computer systems implement the Unified Extensible Firmware Interface (UEFI) standard. Computer systems that implement the UEFI standard can enable "secure" boot. Security measures for a secure boot cycle in UEFI often include ensuring that firmware and low-level boot components are verified with each boot cycle. Summary of the Invention [Means for solving the problem]

[0003] An aspect of the present disclosure relates to an apparatus for secure application launch using hash generation during packaging. The apparatus includes a processor and a memory storing instructions that, when executed by the processor, cause firmware executed by the processor to verify a boot loader. The apparatus also causes the boot loader to execute a kernel in response to verifying the boot loader. The apparatus also causes the kernel to execute a trust agent in response to verifying the kernel. The apparatus also causes the trust agent to process the application list to identify one or more files that are part of an application included in the application package and generate hashes of the one or more files included in the application package in response to verifying the trust agent. The apparatus also causes hashes of the one or more files included in the application package to be compared with a hash of the application package included in an application manifest file in secure storage. The hash for the application package included in the application manifest file is calculated by a hash calculator during a packaging process in which the application package is formed. The hash calculator adds the calculated hash of the application package to the application manifest file during the packaging process. The application manifest file is signed by a signing module, and the application manifest file including the hash for the application package is added to the application package. The device also executes one or more files that are part of the application in response to verifying a hash match between a hash of one or more files included in the application package and a hash of the application package included in the application manifest file.

[0004] Another aspect of the present specification relates to a method for secure application launch using hash generation during packaging. The method includes packaging one or more files that are part of an application to form an application package. The method also includes, during the packaging process in which the application package is formed, causing a hash calculator to calculate a hash of the application package and causing a signing module to generate an application manifest file that includes the hash of the application package. The method also includes adding the application manifest file to the application package. The method also includes causing firmware executed by the processor to verify a boot loader. In response to verifying the boot loader, the method also includes executing the boot loader to verify a kernel. In response to verifying the kernel, the method also includes executing the kernel to verify a trust agent. In response to verifying the trust agent, the method also includes having the trust agent process an application list to identify one or more files that are part of the application included in the application package and generate hashes of the one or more files included in the application package. The method also includes comparing hashes of the one or more files included in the application package with a hash of the application package included in the application manifest file. The method also includes executing one or more files that are part of the application in response to determining a hash match between hashes of one or more files included in the application package and hashes included in the manifest file.

[0005] Another aspect of the present disclosure relates to a non-transitory computer-readable medium for secure application launch using hash generation during packaging. The non-transitory computer-readable medium stores instructions that, when executed by a processor, cause an apparatus to cause firmware executed by the processor to verify a boot loader. In response to verifying the boot loader, the apparatus also causes the boot loader to execute to verify a kernel. In response to verifying the kernel, the apparatus also causes the kernel to execute to verify a trust agent. In response to verifying the trust agent, the apparatus also causes the trust agent to process the application list to identify one or more files that are part of an application included in the application package and generate hashes of the one or more files included in the application package. The apparatus also causes the hashes of the one or more files included in the application package to be compared with a hash of the application package included in an application manifest file in secure storage. The hash for the application package included in the application manifest file is calculated by a hash calculator during a packaging process in which the application package is formed. The hash calculator adds the hash of the application package calculated during the packaging process to the application manifest file. The application manifest file is signed by the signing module, and the application manifest file containing a hash for the application package is added to the application package. The device also causes execution of one or more files that are part of the application in response to verifying a hash match between the hash of one or more files included in the application package and the hash of the application package included in the application manifest file.

[0006] Aspects of the present disclosure can be better understood from the following detailed description when read in conjunction with the accompanying drawings. It should be noted that, according to standard industry practice, various features have not been drawn to scale. In fact, the dimensions of various features may be arbitrarily increased or decreased for clarity of discussion. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 is a diagram of a computer system for secure application launch using hashing during packaging, according to one or more embodiments. [Figure 2] FIG. 1 is a diagram of a hash and package generation system for secure application launch with hash generation during packaging, according to one or more embodiments. [Figure 3] 1 is a flowchart of a process for secure application launch using hash generation during packaging, according to one or more embodiments. [Figure 4] FIG. 1 is a functional block diagram of a computer or processor-based system in which one embodiment may be implemented. DETAILED DESCRIPTION OF THE INVENTION

[0008] The following disclosure provides many different embodiments or examples for implementing different features of the provided subject matter. To simplify the disclosure, specific examples of components and arrangements are described below. Of course, these are merely examples and are not intended to be limiting. For example, the formation or location of a first feature above or on a second feature in the following description may include embodiments in which the first and second features are formed or arranged in direct contact with each other, and may also include embodiments in which an additional feature may be formed or arranged between the first and second features such that the first and second features are not in direct contact with each other. Additionally, the disclosure may repeat reference numerals and / or letters in various examples. This repetition is for the purposes of brevity and clarity and does not in itself dictate a relationship between the various embodiments and / or configurations described.

[0009] Additionally, spatially relative terms such as "beneath," "below," "lower," "above," and "upper" may be used herein for ease of describing the relationship of one element or feature to another element(s) or feature(s), as shown in the figures. Spatially relative terms are intended to encompass different orientations of a device or object in use or operation in addition to the orientation shown in the figures. A device may be oriented differently (rotated 90 degrees or at other orientations), and the spatially relative descriptors used herein may likewise be interpreted accordingly.

[0010] Booting is the process of loading system software into a computer's main memory. The boot process can be triggered, for example, by powering on the computer system or by a soft restart, which does not require a power cycle. The boot process begins with the execution of the hardware / firmware, which performs a power-on self-test, followed by the loading and execution of a boot loader.

[0011] Computer systems that implement the Unified Extensible Firmware Interface (UEFI) standard often enable "secure" booting, where the UEFI firmware checks that the boot loader is signed with a specified cryptographic key.

[0012] Security measures for a secure boot cycle in UEFI often include ensuring that firmware and low-level boot components are verified for each boot cycle. There are many ways to achieve secure boot, either by verifying all boot components before execution, or by taking measurements of each component before execution and verifying these measurements with an external entity.

[0013] In some systems, the hardware / firmware verifies the shim, passes control to the shim for execution, the shim verifies grub, passes control to grub for execution, and grub verifies and loads the operating system kernel. A boot loader, for example, comprises the shim and grub. The operating system kernel then verifies and loads the kernel modules.

[0014] Conventional systems only verify up to the boot components, including the operating system, but do not verify applications instantiated after a successful operating system boot.

[0015] 1 is a diagram of a computer system 100 for secure application launch using hash generation during packaging, according to one or more embodiments. The computer system 100 provides a mechanism for verifying components within the computer system during the boot cycle by facilitating secure application launch using hashes created during packaging.

[0016] Computer system 100 is configured to use a root of trust according to a UEFI secure boot mechanism to provide a trust anchor and generate a hash of an application package that is used to verify secure launch of the application at the root of trust. In some embodiments, computer system 100 simplifies secure boot of applications by leveraging the root of trust mechanism for secure boot according to UEFI, while improving system security by providing verification of all components in the system, including applications, at every boot cycle.

[0017] Computer system 100 includes hardware / firmware 101, boot loader 103, operating system kernel 105, kernel modules 107, trusted agent 109, and secure storage 111. Application images 113a-113n (collectively referred to as application images 113) are one or more files that are part of an application executed by computer system 100. In some embodiments, computer system 100 includes packaging / hash computation unit 115. In some embodiments, packaging / hash computation unit 115 is external to computer system 100.

[0018] In some embodiments, one or more of hardware / firmware 101, boot loader 103, operating system kernel 105, kernel module 107, trust agent 109, secure storage 111, application image 113, and packaging / hash calculation unit 115 include a set of computer-readable instructions that are stored in a memory, such as memory 405 (FIG. 4), and that, when executed by a processor, such as processor 403 (FIG. 4), cause computer system 100 to perform the processes described according to one or more embodiments.

[0019] In some embodiments, secure storage 111 is a memory, such as memory 405, that can query or store data according to one or more embodiments. In some embodiments, a processor executing one or more of hardware / firmware 101, boot loader 103, operating system kernel 105, kernel modules 107, trust agent 109, or application images 113 is embodied within a device that includes secure storage 111. In some embodiments, secure storage 111 is external to a device that includes a processor executing one or more of hardware / firmware 101, boot loader 103, operating system kernel 105, kernel modules 107, trust agent 109, or application images 113.

[0020] In the secure boot process implemented by computer system 100, hardware / firmware 101 executes to verify boot loader 103. In response to verifying boot loader 103, boot loader 103 executes to verify operating system kernel 105. In response to verifying kernel 105, kernel 105 executes to verify trusted agent 109.

[0021] The trust agent 109 processes the application list to identify one or more files that are part of the applications included in the application package and generates hashes of the one or more files included in the application package. In some embodiments, the trust agent 109 generates hashes for all of the combined one or more files or for each of the one or more files individually. In some embodiments, in response to being verified, the trust agent 109 processes the application list to identify one or more files that are part of the applications included in the application package and generates hashes of the one or more files included in the application package. In some embodiments, the application list is stored in secure storage 111. In some embodiments, the application list is stored in a different memory associated with the computer system 100, such as the storage location of one or more application images 113, the storage location of an application package that includes one or more application images 113, or some other suitable location.

[0022] The packaging / hash calculation unit 115 is configured to form an application package that includes one or more files that are part of the application through a packaging process. During the packaging process, the packaging / hash calculation unit 115 calculates a hash of the application package, and the signing module generates an application manifest file that includes the hash of the application package. The packaging / hash calculation unit 115 then adds the application manifest file that includes the hash of the application package to the application package. In some embodiments, the packaging / hash calculation unit 115 causes the application manifest file that includes the hash of the application package to be stored in the secure storage 111. In some embodiments, the packaging / hash calculation unit 115 is a component of the computer system 100 that is executed by a processor, such as the processor 403 or some other processor associated with the computer system 100. In some embodiments, the packaging / hash calculation unit 115 is external to the computer system 100, and the packaging / hash calculation unit 115 calculates a hash of the application package and causes the computer system 100 to download the application manifest file along with the application package. The application manifest file is stored in the secure storage 111. In some embodiments, the application manifest file is generated before the hardware / firmware 101 executes. In some embodiments, the application manifest file is generated after the hardware / firmware 101 executes and before the trust agent 109 executes.

[0023] The trust agent 109 compares the hashes of all of the combined file(s), each of the individual file(s), and / or the application package with the hashes contained in the application manifest file stored in the secure storage 111.

[0024] In response to verifying a hash match between the hashes of all of the combined file(s), each of the one or more files, and / or the hashes included in the application package and the application manifest file, computer system 100 executes one or more files that are part of the application.

[0025] In some embodiments, the trust agent 109 is a kernel module 107 among one or more other kernel modules 107 that the operating system kernel 105 verifies and executes. In some embodiments, the boot loader 103 includes a shim and a grab. The hardware / firmware 101 verifies the shim to verify the boot loader 103 and executes the shim to verify the grab. Then, in response to the grab's verification, the grab verifies the operating system kernel 105, just as the boot loader 103 verifies the operating system kernel 105.

[0026] In some embodiments, the trust agent 109 calculates hashes for all of the one or more files combined, and the hash of the application package is applicable to all of the one or more files. In some embodiments, the trust agent 109 calculates a hash for each of the one or more files individually, and the hash of the application package is applicable to all of the one or more files.

[0027] In some embodiments, the packaging / hash computation unit 115 individually computes a hash of each of one or more files included in the application package for inclusion in the application manifest file as a hash of the application package, and the trust agent 109 individually computes a hash of each of the one or more files, and a hash match is determined based on a one-to-one match between the corresponding file hash of each of the one or more files included in the application package computed by the packaging / hash computation unit 115 in the application manifest file and the corresponding file hash of each of the one or more files included in the application package computed by the trust agent 109.

[0028] In some embodiments, the application manifest file generated by the packaging / hash calculation unit 115 for inclusion in the application package is signed by the signing module, so that the application manifest file is protected in the application package and can be verified as being associated with a trusted source.

[0029] In some embodiments, in response to verifying that the application manifest file is associated with a trusted source, the application manifest file is stored in secure storage 111. In some embodiments, the application manifest file is stored in secure storage 111 during the unpackaging process.

[0030] According to various embodiments, computer system 100 validates boot components, including the operating system and applications instantiated after successful operating system boot. Computer system 100 provides a mechanism for validating components within the computer system during the boot cycle by facilitating secure application launch using hash creation during packaging. Computer system 100 uses a root of trust in accordance with the UEFI secure boot mechanism to provide a trust anchor and generates a hash in the application that is used to validate with the root of trust to securely launch the application. Computer system 100 simplifies secure boot of applications by leveraging the root of trust mechanism for secure boot in accordance with UEFI, while improving system security by providing validation of all components in the system, including applications, at every boot cycle.

[0031] 2 is a hash and package generation system 200 for secure application launch using hash generation during packaging, according to one or more embodiments. In some embodiments, hash and package generation system 200 can be used as packaging / hash computation unit 115 (FIG. 1).

[0032] Hash and package generation system 200 causes one or more files that are part of an application to be packaged to form an application package. In some embodiments, hash and package generation system 200 is a component of computer system 100 (FIG. 1). In some embodiments, hash and package generation system 200 is external to computer system 100 and communicates with one or more of computer system 100 (FIG. 1) or secure storage 111 (FIG. 1).

[0033] Hash and package generation system 200 processes application images 201a-201n, which are files included in applications executed by computer system 100 at boot time, to form application package 203. During the packaging process in which application package 203 is formed, hash calculator 205 included in hash and package generation system 200 calculates a hash of application package 203, and signing module 205 included in hash and package generation system 200 generates an application manifest file that includes the hash of application package 203. The application manifest file is then added to application package 203 for delivery to computer system 100 and / or storage in secure storage 111. In some embodiments, the application manifest file is generated before hardware / firmware 101 (FIG. 1) is executed. In some embodiments, the application manifest file is generated after hardware / firmware 101 is executed but before trust agent 109 (FIG. 1) is executed.

[0034] In some embodiments, hash calculator 205 individually calculates a hash of each of one or more application images 201a-201n included in application package 203 for inclusion in the application manifest file as a hash of application package 203, and trust agent 109 calculates the hash of each of one or more application images 201a-201n, and a hash match is determined based on a one-to-one match between the hash of each corresponding application image of one or more application images 201a-201n included in application package 203 calculated by hash calculator 205 in the application manifest file and the hash of each corresponding application image of one or more application images 201a-201n included in application package 203 calculated by trust agent 109.

[0035] In some embodiments, the application manifest file included in the application package 203 is signed by the signing module 207, so that the application manifest file is protected by the application package 203 and can be verified as being associated with a trusted source.

[0036] In some embodiments, in response to verifying that the application manifest file is associated with a trusted source, the application manifest file is stored in secure storage 111.

[0037] 3 is a flowchart of a process 300 for secure application launch using hash generation during packaging, according to one or more embodiments. In some embodiments, process 300 is performed by computer system 100 (FIG. 1) including packaging / hash computation unit 115 (FIG. 1). In some embodiments, process 300 is performed by computer system 100 in combination with packaging / hash computation unit 115 that is external to and in communication with computer system 100.

[0038] In step 301, one or more files that are part of an application are packaged to form an application package.

[0039] In step 303, during the packaging process in which the application package is formed, the hash calculator of the packaging / hash calculation unit 115 is caused to calculate a hash of the application package and the signing module is caused to generate an application manifest file that includes the hash of the application package.

[0040] In step 305, an application manifest file is added to the application package. In some embodiments, the application manifest file added to the application package is signed by a signing module such that the application manifest file is protected by the application package and such that the application manifest file can be verified as being associated with a trusted source. In some embodiments, in response to verifying that the application manifest file is associated with a trusted source, the application manifest file is caused to be stored in secure storage.

[0041] In step 307, the firmware is executed by the processor to verify the boot loader. In some embodiments, the boot loader comprises a shim and a grub, and the firmware verifies the shim to verify the boot loader, executes the shim to verify the grub, and in response to the verification of the grub, the grub verifies the operating system kernel, just as the boot loader verifies the operating system kernel.

[0042] In step 309, in response to verifying the boot loader, the boot loader is executed to verify the operating system kernel.

[0043] In response to validating the kernel, the kernel is executed to validate the trust agent in step 311. In some embodiments, the trust agent is a kernel module.

[0044] In step 313, in response to the trust agent's verification, the trust agent processes the application list to identify one or more files that are part of the application included in the application package and generate hashes of the one or more files included in the application package. In some embodiments, the trust agent calculates hashes for all of the one or more files combined, where the hash of the application package is applicable to all of the one or more files. In some embodiments, the trust agent calculates hashes for each of the one or more files individually, where the hash of the application package is applicable to all of the one or more files.

[0045] In step 315, the hashes of one or more files contained in the application package are compared to the hashes contained in the application manifest file.

[0046] In step 317, in response to determining a hash match between the hashes of one or more files included in the application package, one or more files that are part of the application are executed.

[0047] In some embodiments, the hash calculator causes a hash of each of one or more files included in the application package to be individually calculated for inclusion in the application manifest file as a hash of the application package, and the trust agent causes a hash of each of the one or more files to be individually calculated, and a hash match is determined based on a one-to-one match between the hash of each corresponding file of the one or more files included in the application package calculated by the hash calculator included in the application manifest file and the hash of each corresponding file of the one or more files included in the application package calculated by the trust agent.

[0048] FIG. 4 is a functional block diagram of a computer or processor-based system 400 in which embodiments are or may be implemented.

[0049] The processor-based system 400 is programmed to facilitate secure application launch using hashing during packaging as described herein and includes, for example, bus 401, processor 403, and memory 405 components.

[0050] In some embodiments, the processor-based system is implemented as a single "system on a chip." The processor-based system 400, or portions thereof, constitutes a mechanism for performing one or more steps of secure application launch using hashing during packaging.

[0051] In some embodiments, processor-based system 400 includes a communication mechanism, such as bus 401, for transferring and / or receiving information and / or instructions between components of processor-based system 400. Processor 403 is connected to bus 401 to retrieve instructions for execution and process information stored, for example, in memory 405. In some embodiments, processor 403 also includes one or more specialized components for performing specific processing functions and tasks, such as one or more digital signal processors (DSPs) or one or more application-specific integrated circuits (ASICs). DSPs are typically configured to process real-world signals (e.g., sound) in real time, independently of processor 403. Similarly, ASICs can be configured to perform specialized functions not easily performed by more general-purpose processors. Other specialized components that assist in performing the functions described herein optionally include one or more field-programmable gate arrays (FPGAs), one or more controllers, or one or more other specialized computer chips.

[0052] In one or more embodiments, processor(s) 403 performs a series of operations on information specified by a set of instructions stored in memory 405 related to secure application launch using hash generation during packaging. Execution of the instructions causes the processor to perform the specified function.

[0053] The processor 403 and associated components are connected to memory 405 via bus 401. Memory 405 includes one or more of dynamic memory (e.g., RAM, magnetic disk, writable optical disk, etc.) and static memory (e.g., ROM, CD-ROM, etc.) for storing executable instructions that, when executed, perform the steps described herein to facilitate secure application launch using hash generation during packaging. Memory 405 also stores data associated with or generated by the execution of the steps.

[0054] In one or more embodiments, memory 405, such as random access memory (RAM) or any other dynamic storage device, stores information including processor instructions for secure application launch using hash generation during packaging. Dynamic memory allows stored information to be modified. RAM allows a unit of information stored at a location, called a memory address, to be stored and retrieved independently of information at adjacent addresses. Memory 405 is also used by processor 403 to store temporary values ​​while the processor is executing instructions. In various embodiments, memory 405 is read-only memory (ROM) or any other static storage device coupled to bus 401 for storing static information, including instructions, that cannot be modified by processor 403. Some memory consists of volatile storage, which loses stored information when power is lost. In some embodiments, memory 405 is a non-volatile (persistent) storage device, such as a magnetic disk, optical disk, or flash card, for storing information, including instructions, that persists even when system 400 is turned off or otherwise loses power.

[0055] As used herein, the term "computer-readable medium" refers to any medium that participates in providing information to the processor 403, including instructions for execution. Such media take many forms, including, but not limited to, computer-readable storage media (e.g., non-volatile media, volatile media). Non-volatile media include, for example, optical or magnetic disks. Volatile media include, for example, dynamic memory. Common forms of computer-readable media include, for example, floppy disks, flexible disks, hard disks, magnetic tape, other magnetic media, CD-ROMs, CDRWs, DVDs, other optical media, punch cards, paper tape, optical mark sheets, other physical media having a pattern of holes or other optically recognizable indicia, RAM, PROM, EPROM, FLASH-EPROM, EEPROM, flash memory, other memory chips or cartridges, or other media from which a computer can read. The term computer-readable storage medium is used herein to refer to computer-readable media.

[0056] An aspect of the present disclosure relates to an apparatus for secure application launch using hash generation during packaging. The apparatus includes a processor and a memory storing instructions that, when executed by the processor, cause firmware executed by the processor to verify a boot loader. The apparatus also causes the boot loader to execute a kernel in response to verifying the boot loader. The apparatus also causes the kernel to execute a trust agent in response to verifying the kernel. The apparatus also causes the trust agent to process the application list to identify one or more files that are part of an application included in the application package and generate hashes of the one or more files included in the application package in response to verifying the trust agent. The apparatus also causes hashes of the one or more files included in the application package to be compared with a hash of the application package included in an application manifest file in secure storage. The hash for the application package included in the application manifest file is calculated by a hash calculator during a packaging process in which the application package is formed. The hash calculator adds the calculated hash of the application package to the application manifest file during the packaging process. The application manifest file is signed by a signing module, and the application manifest file including the hash for the application package is added to the application package. The device also executes one or more files that are part of the application in response to verifying a hash match between a hash of one or more files included in the application package and a hash of the application package included in the application manifest file.

[0057] In some embodiments, the trust agent is a kernel module.

[0058] In some embodiments, the boot loader comprises a shim and a grub, the firmware verifies the shim to verify the boot loader and executes the shim to verify the grub, and in response to the grub's verification, the grub verifies the kernel just as the boot loader verifies the kernel.

[0059] In some embodiments, the trusted agent computes a hash for all of the one or more files combined, and the hash of the application package is applicable to all of the one or more files.

[0060] In some embodiments, the trusted agent has a hash calculated for each of the one or more files individually, and the hash of the application package is applicable to all of the one or more files.

[0061] In some embodiments, the hash calculator causes a hash of each of one or more files included in the application package to be individually calculated for inclusion in the application manifest file as a hash of the application package, and the trust agent causes a hash of each of the one or more files to be individually calculated, and a hash match is determined based on a one-to-one match between the hash of each corresponding file of the one or more files included in the application package calculated by the hash calculator included in the application manifest file and the hash of each corresponding file of the one or more files included in the application package calculated by the trust agent.

[0062] In some embodiments, the application manifest file added to the application package is signed by a signing module to ensure that the application manifest file is protected by the application package and that the application manifest file is associated with a trusted source.

[0063] In some embodiments, the device also causes the application manifest file to be stored in secure storage in response to verifying that the application manifest file is associated with a trusted source.

[0064] Another aspect of the present specification relates to a method for secure application launch using hash generation during packaging. The method includes packaging one or more files that are part of an application to form an application package. The method also includes, during the packaging process in which the application package is formed, causing a hash calculator to calculate a hash of the application package and causing a signing module to generate an application manifest file that includes the hash of the application package. The method also includes adding the application manifest file to the application package. The method also includes causing firmware executed by the processor to verify a boot loader. In response to verifying the boot loader, the method also includes executing the boot loader to verify a kernel. In response to verifying the kernel, the method also includes executing the kernel to verify a trust agent. In response to verifying the trust agent, the method also includes having the trust agent process an application list to identify one or more files that are part of the application included in the application package and generate hashes of the one or more files included in the application package. The method also includes comparing hashes of the one or more files included in the application package with a hash of the application package included in the application manifest file. The method also includes executing one or more files that are part of the application in response to determining a hash match between hashes of one or more files included in the application package and hashes included in the manifest file.

[0065] In some embodiments, the trust agent is a kernel module.

[0066] In some embodiments, the boot loader comprises a shim and a grub, the firmware verifies the shim to verify the boot loader and executes the shim to verify the grub, and in response to the grub's verification, the grub verifies the kernel just as the boot loader verifies the kernel.

[0067] In some embodiments, the trusted agent computes a hash for all of the one or more files combined, and the hash of the application package is applicable to all of the one or more files.

[0068] In some embodiments, the trusted agent has a hash calculated for each of the one or more files individually, and the hash of the application package is applicable to all of the one or more files.

[0069] In some embodiments, the hash calculator causes a hash of each of one or more files included in the application package to be individually calculated for inclusion in the application manifest file as a hash of the application package, and the trust agent causes a hash of each of the one or more files to be individually calculated, and a hash match is determined based on a one-to-one match between the hash of each corresponding file of the one or more files included in the application package calculated by the hash calculator included in the application manifest file and the hash of each corresponding file of the one or more files included in the application package calculated by the trust agent.

[0070] In some embodiments, the application manifest file added to the application package is signed by a signing module to ensure that the application manifest file is protected by the application package and that the application manifest file is associated with a trusted source.

[0071] In some embodiments, the method also includes causing the application manifest file to be stored in secure storage in response to verifying that the application manifest file is associated with a trusted source.

[0072] Another aspect of the present disclosure relates to a non-transitory computer-readable medium for secure application launch using hash generation during packaging. The non-transitory computer-readable medium stores instructions that, when executed by a processor, cause an apparatus to cause firmware executed by the processor to verify a boot loader. In response to verifying the boot loader, the apparatus also causes the boot loader to execute to verify a kernel. In response to verifying the kernel, the apparatus also causes the kernel to execute to verify a trust agent. In response to verifying the trust agent, the apparatus also causes the trust agent to process the application list to identify one or more files that are part of an application included in the application package and generate hashes of the one or more files included in the application package. The apparatus also causes the hashes of the one or more files included in the application package to be compared with a hash of the application package included in an application manifest file in secure storage. The hash for the application package included in the application manifest file is calculated by a hash calculator during a packaging process in which the application package is formed. The hash calculator adds the hash of the application package calculated during the packaging process to the application manifest file. The application manifest file is signed by the signing module, and the application manifest file containing a hash for the application package is added to the application package. The device also causes execution of one or more files that are part of the application in response to verifying a hash match between the hash of one or more files included in the application package and the hash of the application package included in the application manifest file.

[0073] In some embodiments, the trust agent is a kernel module.

[0074] In some embodiments, the boot loader comprises a shim and a grub, the firmware verifies the shim to verify the boot loader and executes the shim to verify the grub, and in response to the grub's verification, the grub verifies the kernel just as the boot loader verifies the kernel.

[0075] In some embodiments, the trusted agent computes a hash for all of the one or more files combined, and the hash of the application package is applicable to all of the one or more files.

[0076] In some embodiments, the trusted agent has a hash calculated for each of the one or more files individually, and the hash of the application package is applicable to all of the one or more files.

[0077] In some embodiments, the hash calculator causes a hash of each of one or more files included in the application package to be individually calculated for inclusion in the application manifest file as a hash of the application package, and the trust agent causes a hash of each of the one or more files to be individually calculated, and a hash match is determined based on a one-to-one match between the hash of each corresponding file of the one or more files included in the application package calculated by the hash calculator included in the application manifest file and the hash of each corresponding file of the one or more files included in the application package calculated by the trust agent.

[0078] In some embodiments, the application manifest file added to the application package is signed by a signing module to ensure that the application manifest file is protected by the application package and that the application manifest file is associated with a trusted source.

[0079] In some embodiments, the device also causes the application manifest file to be stored in secure storage in response to verifying that the application manifest file is associated with a trusted source.

[0080] The above outlines features of several embodiments to enable those skilled in the art to better understand aspects of the present disclosure. The present disclosure includes features that enable validation of boot components up to and including the operating system, as well as applications instantiated after successful operating system startup. The present disclosure provides a mechanism for validating components in a computer system during the boot cycle by facilitating secure application launch using hash creation during packaging. The features discussed in this disclosure provide a trust anchor using a root of trust in accordance with the UEFI secure boot mechanism and generate a hash in the application that is used to validate with the root of trust to securely launch the application. The features discussed in this disclosure improve the security of a computer system by providing validation of all components in the system, including applications, at every boot cycle, while simplifying secure boot of applications by leveraging the root of trust mechanism for secure boot in accordance with UEFI.

[0081] Those skilled in the art will readily appreciate that they may use this disclosure as a basis for designing or modifying other processes and structures to carry out the same purposes and / or achieve the same advantages of the embodiments introduced herein. Those skilled in the art will also recognize that such equivalent constructions do not depart from the spirit and scope of the disclosure, and that various changes, substitutions, and alterations can be made herein without departing from the spirit and scope of the disclosure.

Claims

1. 1. An apparatus comprising: a processor; a memory having instructions stored thereon, the instructions, when executed by the processor, causing the apparatus to: causing firmware executed by the processor to verify the boot loader; in response to verifying the boot loader, causing the boot loader to execute to verify a kernel; In response to verifying the kernel, causing the kernel to execute a trusted agent to verify; in response to verifying the trusted agent, causing the trusted agent to process the application list to identify one or more files that are part of an application included in an application package and generate hashes of the one or more files included in the application package; comparing the hashes for the one or more files included in the application package with a hash for the application package included in an application manifest file in secure storage, wherein the hash for the application package included in the application manifest file is calculated by a hash calculator during a packaging process in which the application package is formed, the hash calculator adds the hash for the application package calculated during the packaging process to the application manifest file, the application manifest file is signed by a signing module, and the application manifest file including the hash for the application package is added to the application package; In response to determining a hash match between the hash for the one or more files included in the application package and the hash for the application package included in the application manifest file, executing the one or more files that are part of the application; A device that performs the following.

2. The apparatus of claim 1 , wherein the trusted agent is a kernel module.

3. the boot loader comprises a shim and a grub; the firmware verifies the shim to verify the boot loader and executes the shim to verify the grub; the grab verifies the kernel such that the boot loader verifies the kernel in response to the grab verifying; 10. The apparatus of claim 1.

4. 2. The apparatus of claim 1, wherein the trusted agent computes the hash for all of the one or more files combined, and the hash of the application package is applicable to all of the one or more files.

5. 2. The apparatus of claim 1, wherein the trusted agent computes the hash of each of the one or more files individually, and the hash of the application package is applicable to all of the one or more files.

6. 2. The apparatus of claim 1, further comprising: causing the hash calculator to individually calculate the hash of each of the one or more files included in the application package for inclusion in the application manifest file as the hash of the application package; and causing the trust agent to individually calculate the hash of each of the one or more files; and wherein the hash match is determined based on a one-to-one match between the hash of each corresponding file of the one or more files included in the application package calculated by the hash calculator included in the application manifest file and the hash of each corresponding file of the one or more files included in the application package calculated by the trust agent.

7. 2. The apparatus of claim 1, wherein the application manifest file added to the application package is signed by the signing module so as to verify that the application manifest file is protected with the application package and associated with a trusted source.

8. The device comprises: The apparatus of claim 7 , wherein in response to verifying that the application manifest file is associated with the trusted source, the apparatus causes the application manifest file to be stored in the secure storage.

9. packaging one or more files that are part of the application to form an application package; During a packaging process in which the application package is formed, causing a hash calculator to calculate a hash of the application package and causing a signing module to generate an application manifest file that includes the hash of the application package; adding the application manifest file to the application package; causing firmware executed by the processor to verify the boot loader; in response to verifying the boot loader, causing the boot loader to verify a kernel; In response to verifying the kernel, causing the kernel to execute a trusted agent to verify; in response to verifying the trusted agent, causing the trusted agent to process the application list to identify the one or more files included in the application package that are part of the application and to generate hashes of the one or more files included in the application package; comparing the hash for the one or more files included in the application package with the hash for the application package included in the application manifest file; responsive to determining a hash match between the hash for the one or more files included in the application package and the hash included in the manifest file, executing the one or more files that are part of the application; A method comprising:

10. The method of claim 9 , wherein the trusted agent is a kernel module.

11. the boot loader comprises a shim and a grub; the firmware verifies the shim to verify the boot loader and executes the shim to verify the grub; in response to the grub verifying, the grub verifies the kernel in the same manner as the boot loader verifies the kernel; 10. The method of claim 9.

12. 10. The method of claim 9, wherein the trusted agent computes the hash for all of the one or more files combined, and the hash of the application package is applicable to all of the one or more files.

13. 10. The method of claim 9, wherein the trusted agent computes the hash for each of the one or more files individually, and the hash of the application package is applicable to all of the one or more files.

14. 10. The method of claim 9, further comprising: causing the hash calculator to individually calculate the hash of each of the one or more files included in the application package for inclusion in the application manifest file as the hash of the application package; and causing the trust agent to individually calculate the hash of each of the one or more files; and determining the hash match based on a one-to-one match between the hash of each corresponding file of the one or more files included in the application package calculated by the hash calculator included in the application manifest file and the hash of each corresponding file of the one or more files included in the application package calculated by the trust agent.

15. 10. The method of claim 9, wherein the application manifest file added to the application package is signed by the signing module to verify that the application manifest file is protected by the application package and that the application manifest file is associated with a trusted source.

16. storing the application manifest file in the secure storage in response to verifying that the application manifest file is associated with the trusted source; 16. The method of claim 15, further comprising:

17. A non-transitory computer-readable medium having instructions stored thereon, comprising: The instructions, when executed by a processor, causing firmware executed by the processor to verify the boot loader; in response to verifying the boot loader, causing the boot loader to execute to verify a kernel; In response to verifying the kernel, causing the kernel to execute a trusted agent to verify; in response to verifying the trusted agent, causing the trusted agent to process the application list to identify one or more files that are part of an application included in an application package and generate hashes of the one or more files included in the application package; comparing the hashes for the one or more files included in the application package with a hash for the application package included in an application manifest file in secure storage, wherein the hash for the application package included in the application manifest file is calculated by a hash calculator during a packaging process in which the application package is formed, the hash calculator adding the hash for the application package calculated during the packaging process to the application manifest file, the application manifest file being signed by a signing module, and the application manifest file including the hash for the application package being added to the application package; In response to determining a hash match between the hash for the one or more files included in the application package and the hash for the application package included in the application manifest file, executing the one or more files that are part of the application; A non-transitory computer-readable medium that causes an apparatus to perform the steps of:

18. 20. The non-transitory computer-readable medium of claim 17, wherein the trusted agent computes the hash for all of the one or more files combined, and the hash for the application package is applicable to all of the one or more files.

19. 20. The non-transitory computer-readable medium of claim 17, wherein the trusted agent computes the hash for each of the one or more files individually, and the hash for the application package is applicable to all of the one or more files.

20. 20. The non-transitory computer-readable medium of claim 17, wherein the application manifest file added to the application package is signed by the signing module to verify that the application manifest file is protected with the application package and that the application manifest file is associated with a trusted source.

Images