Apparatus and method for secure application launch using hashing during secure download - Patent Application 20070122963

Abstract

The device executes firmware to verify the boot loader. The verified boot loader is executed to verify the kernel. In response to verifying the kernel, the kernel is executed to verify the trust agent. In response to verifying the trust agent, the trust agent processes the application list, identifies one or more files that are part of the application, and is caused to generate a hash for all of the one or more files combined or for each of the one or more files individually. The device also compares the hashes for all of the one or more files combined or for each of the one or more files individually with the hash included in the application manifest file, and in response to determining a hash match, causes the one or more files that are part of the application to be executed.

Description

[Technical Field]

[0001] The present disclosure relates to secure application launch using hashing during secure download. [Background technology]

[0002] Booting is the process of loading system software into a computer system's main memory. The boot process begins with the execution of hardware / firmware that performs a power-on self-test, followed by the loading and execution of a boot loader. Some computer systems implement the Unified Extensible Firmware Interface (UEFI) standard. In computer systems that implement the UEFI standard, a "secure" boot may be made available. Security measures for a secure boot cycle in UEFI often include ensuring that firmware and lower-level boot components are verified during every boot cycle. Summary of the Invention [Means for solving the problem]

[0003] One aspect of the present disclosure relates to an apparatus for secure application launch using hashing during secure download. The apparatus includes a processor and a memory storing instructions that, when executed by the processor, cause the apparatus to cause firmware executed by the processor to verify a boot loader. In response to verifying the boot loader, the apparatus also causes the boot loader to execute and verify a kernel. In response to verifying the kernel, the apparatus also causes the kernel to execute and verify a trust agent. In response to verifying the trust agent, the apparatus also causes the trust agent to process an application list to identify one or more files that are part of the application and generate a hash for all of the combined one or more files or for each of the one or more files individually. The apparatus is also configured to compare the hash for all of the combined one or more files or for each of the one or more files individually with a hash included in an application manifest file stored in secure storage. The device is also caused to execute one or more files that are part of the application in response to verifying a hash match between the hash for all of the one or more files combined, or for each of the one or more files individually, and the hash included in the application manifest file.

[0004] Another aspect of the present disclosure relates to a method for secure application launch using hashing during secure download. The method includes having firmware executed by a processor verify a boot loader. In response to verifying the boot loader, the method also includes having the boot loader executed to verify a kernel. In response to verifying the kernel, the method also includes having the kernel executed to verify a trust agent. In response to verifying the trust agent, the method also includes having the trust agent process an application list to identify one or more files that are part of the application and generate a hash for all of the combined one or more files or for each of the one or more files individually. The method also includes comparing the hash for all of the combined one or more files or for each of the one or more files individually with a hash included in an application manifest file stored in secure storage. In response to determining a hash match between the hash for all of the combined one or more files or for each of the one or more files individually and the hash included in the application manifest file, the method also includes executing the one or more files that are part of the application.

[0005] Another aspect of the present specification relates to a non-transitory computer-readable medium for secure application launch using hashing during secure download. The non-transitory computer-readable medium stores instructions that, when executed by a processor, cause a device to cause firmware executed by the processor to verify a boot loader. In response to verifying the boot loader, the device also causes the boot loader to execute and verify a kernel. In response to verifying the kernel, the device also causes the kernel to execute and verify a trust agent. In response to verifying the trust agent, the device also causes the trust agent to process an application list to identify one or more files that are part of the application and generate a hash for all of the combined one or more files or for each of the one or more files individually. The device is also configured to compare the hash for all of the combined one or more files or for each of the one or more files individually with a hash included in an application manifest file stored in secure storage. The device is also caused to execute one or more files that are part of the application in response to verifying a hash match between the hash for all of the one or more files combined, or for each of the one or more files individually, and the hash included in the application manifest file.

[0006] Aspects of the present disclosure are best understood from the following detailed description when read in conjunction with the accompanying drawings. It should be noted that, according to standard industry practice, various features have not been drawn to scale. In fact, dimensions of various features may be arbitrarily increased or decreased for clarity of illustration. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 is a diagram of a computer system for secure application launch with hashing during secure download, according to one or more embodiments.

[0008] [Figure 2] FIG. 1 is a diagram of a process for hash creation during secure download, according to one or more embodiments.

[0009] [Figure 3] 1 is a flowchart of a process for secure application launch with hashing during secure download, according to one or more embodiments.

[0010] [Figure 4] FIG. 1 is a functional block diagram of a computer or processor-based system in which one embodiment may be implemented. DETAILED DESCRIPTION OF THE INVENTION

[0011] The following disclosure provides many different embodiments or examples for implementing different features of the provided subject matter. To simplify the disclosure, specific example components and arrangements are described below. Of course, these are merely examples and are not intended to be limiting. For example, the formation or location of a first feature above or on a second feature in the following description may include embodiments in which the first and second features are formed or arranged in direct contact, and may also include embodiments in which an additional feature can be formed or arranged between the first and second features such that the first and second features are not in direct contact. In addition, the present disclosure may repeat reference numerals and / or letters in various examples. This repetition is for purposes of brevity and clarity and does not, in itself, dictate a relationship between the various embodiments and / or configurations discussed.

[0012] Additionally, spatially relative terms such as "bottom," "lower," "bottom," "upper," "top," and the like may be used herein for ease of description to describe the relationship of one element or feature to another element(s) or feature(s), as shown in the figures. Spatially relative terms are intended to encompass different orientations of a device or object during use or operation in addition to the orientation shown in the figures. A device may be oriented differently (rotated 90 degrees or to other orientations), and the spatially relative descriptors used herein may likewise be interpreted accordingly.

[0013] Booting is the process of loading system software into a computer's main memory. The boot process can be triggered, for example, by powering on the computer system or by a soft restart, which does not require a power cycle of the computer system. The boot process begins with the execution of the hardware / firmware, which performs a power-on self-test, followed by the loading and execution of a boot loader.

[0014] Computer systems that implement the Unified Extensible Firmware Interface (UEFI) standard often enable a "secure" boot, where the UEFI firmware checks that the boot loader is signed with a specified cryptographic key.

[0015] Security measures for a secure boot cycle in UEFI often include ensuring that firmware and lower level boot components are verified during every boot cycle. There are many ways to achieve a secure boot, either by verifying all boot components before execution, or by taking measurements of each component before execution and having these measurements attested to by an external entity.

[0016] In some systems, the hardware / firmware verifies the shim, hands control to the shim, and executes it. The shim verifies grub, hands control to grub, and executes it. Grub verifies the operating system kernel and loads it. A boot loader, for example, comprises the shim and grub. The operating system kernel then verifies the kernel module and loads it.

[0017] Conventional systems only verify boot components up to the operating system, but do not verify applications instantiated after the operating system has successfully booted.

[0018] 1 is a diagram of a computer system 100 for secure application launch using hashing during secure download, in accordance with one or more embodiments. Computer system 100 provides a mechanism for verifying components within a computer system during the boot cycle by facilitating secure application launch using hashing during secure download.

[0019] Computer system 100 is configured to provide a trust anchor using a root of trust in accordance with the UEFI secure boot mechanism. In some embodiments, computer system 100 simplifies the secure boot of applications by leveraging the root of trust mechanism for secure boot in accordance with UEFI, while improving system security by providing validation of all components in the system, including applications, at every boot cycle.

[0020] Computer system 100 includes hardware / firmware 101, boot loader 103, operating system kernel 105, kernel modules 107, trust agent 109, and secure storage 111. Application images 113a-113n (collectively referred to as application images 113) are one or more files that are part of an application executed by computer system 100. In some embodiments, computer system 100 includes hash calculator 115. In some embodiments, hash calculator 115 is external to computer system 100.

[0021] In some embodiments, one or more of hardware / firmware 101, boot loader 103, operating system kernel 105, kernel module 107, trust agent 109, secure storage 111, application image 113, and hash calculator 115 include a set of computer-readable instructions stored in a memory, such as memory 405 (FIG. 4), that, when executed by a processor, such as processor 403 (FIG. 4), causes computer system 100 to perform the described processes according to one or more embodiments.

[0022] In some embodiments, secure storage 111 is a memory, such as memory 405, that can be queried or caused to store data according to one or more embodiments.

[0023] The secure boot process implemented by computer system 100 involves executing hardware / firmware 101 to verify boot loader 103. In response to verifying boot loader 103, boot loader 103 is run to verify operating system kernel 105. In response to verifying operating system kernel 105, operating system kernel 105 is run to verify trust agent 109.

[0024] The trust agent 109 processes the application list to identify one or more files that are part of the application and generates a hash for all of the one or more files combined or for each of the one or more files individually. In some embodiments, in response to being verified, the trust agent 109 processes the application list to identify one or more files that are part of the application included in the application package and generates a hash for the one or more files included in the application package. In some embodiments, the application list is stored in secure storage 111. In some embodiments, the application list is stored in a different memory associated with the computer system 100, such as the storage location of one or more application images 113, the storage location of an application package that includes one or more application images 113, or some other suitable location.

[0025] During secure download of one or more files that are part of an application to computer 100, in response to receiving an application package that includes one or more files that are part of the application, hash calculator 115 is adapted to calculate a hash of the application package and generate an application manifest file that includes the hash of the application package. In some embodiments, hash calculator 115 is a component of computer system 100 executed by a processor, such as processor 403 or some other processor associated with computer system 100. In some embodiments, hash calculator 115 is external to computer system 100, and hash calculator 115 calculates the hash of the application package and downloads the application manifest file along with the application package for secure download to computer 100. The application manifest file is stored in secure storage 111. In some embodiments, the application manifest file is generated before hardware / firmware 101 executes. In some embodiments, the application manifest file is generated after hardware / firmware 101 executes and before trust agent 109 executes.

[0026] The trust agent 109 compares the hashes for all of the combined one or more files, for each of the one or more files individually, and / or for the application package with the hashes contained in the application manifest file stored in secure storage 111.

[0027] In response to verifying a hash match between the hashes for all of the combined one or more files, the hashes for each of the one or more files individually, and / or the hash for the application package and the hash included in the application manifest file, computer system 100 executes one or more files that are part of the application.

[0028] In some embodiments, trust agent 109 is a kernel module 107 among one or more other kernel modules 107 that operating system kernel 105 verifies and executes. In some embodiments, boot loader 103 comprises a shim and grub. Hardware / firmware 101 verifies the shim to verify boot loader 103 and runs the shim to verify grub. Then, in response to verifying grub, grub verifies the operating system kernel 105, just as boot loader 103 verifies operating system kernel 105.

[0029] In some embodiments, the trust agent 109 calculates a hash for all of the one or more files combined, and the hash for the application package is applicable to all of the one or more files. In some embodiments, the trust agent 109 calculates a hash for each of the one or more files individually, and the hash for the application package is applicable to all of the one or more files.

[0030] In some embodiments, the hash calculator 115 is caused to calculate a hash of each of the one or more files included in the application package individually for inclusion in the application manifest file as a hash of the application package, and the trust agent 109 is caused to calculate a hash of each of the one or more files individually, and a hash match is determined based on a one-to-one match between the hash of each corresponding file of the one or more files included in the application package calculated by the hash calculator 115 included in the application manifest file and the hash of each corresponding file of the one or more files included in the application package calculated by the trust agent 109.

[0031] In some embodiments, the application manifest file generated by hash calculator 115 for inclusion in the application package is signed by a signing module to ensure that the application manifest file is protected in the application package and that the application manifest file is associated with a trusted source.

[0032] In some embodiments, in response to verifying that the application manifest file is associated with a trusted source, the application manifest file is stored in secure storage 111.

[0033] According to various embodiments, computer system 100 verifies boot components up to the operating system and applications instantiated after successful boot of the operating system. Computer system 100 provides a mechanism for verifying components within the computer system during the boot cycle by facilitating secure application launch using hash creation during secure download. Computer system 100 uses a root of trust in accordance with the UEFI secure boot mechanism to provide a trust anchor and generate hashes using applications used to verify at the root of trust to securely launch applications. By leveraging the root of trust mechanism for secure boot in accordance with UEFI, computer system 100 simplifies secure boot of applications while improving system security by providing verification of all components within the system, including applications, with every boot cycle.

[0034] 2 is a block diagram of a process 200 for hash creation during secure downloading, according to one or more embodiments. In some embodiments, process 200 is performed by hash calculator 115 (FIG. 1) included in computer system 100 (FIG. 1). In some embodiments, process 200 is performed by hash calculator 115 that is external to and in communication with computer system 100.

[0035] In step 201, one or more files that are part of an application are downloaded from a source as an application package.

[0036] In step 203, hash calculator 115 calculates a hash of the application package and generates an application manifest file that includes the hash of the application package. In some embodiments, the application manifest file is added to the application package. In some embodiments, the application manifest file is generated before hardware / firmware 101 (FIG. 1) executes. In some embodiments, the application manifest file is generated after hardware / firmware 101 executes and before trust agent 109 executes.

[0037] In some embodiments, hash calculator 115 individually calculates a hash of each of one or more application images included in the application package for inclusion in the application manifest file as a hash of the application package, trust agent 109 (FIG. 1) calculates a hash of each of the one or more application images included in the application package, and a hash match is determined based on a one-to-one match between the hash of each corresponding application image of the one or more application images included in the application package calculated by hash calculator 115 and the hash of each corresponding application image of the one or more application images included in the application package calculated by trust agent 109, which is included in the application manifest file.

[0038] In some embodiments, the application manifest file included in the application package is signed by a signing module so that the application manifest file is protected by the application package and can be verified as being associated with a trusted source.

[0039] In step 205, the application manifest file is stored in secure storage 111 (FIG. 1). In some embodiments, the application manifest file is stored in secure storage 111 in response to verifying that the application manifest file is associated with a trusted source.

[0040] 3 is a flowchart of a process 300 for secure application launch using hashing during secure download, according to one or more embodiments. In some embodiments, process 300 is performed by computer system 100 (FIG. 1), which includes hash calculator 115 (FIG. 1). In some embodiments, process 300 is performed by computer system 100 in combination with hash calculator 115 that is external to and in communication with computer system 100.

[0041] During secure download of one or more files that are part of an application from a source, step 301 causes hash calculator 115 to calculate a hash of an application package that includes one or more files that are part of the application. In some embodiments, in response to receiving one or more files that are part of the application by secure download from a source, the one or more files that are part of the application are packaged to create an application package, and the hash calculator is caused to calculate a hash of the application package.

[0042] In step 303, an application manifest file is generated that contains the calculated hash for the application package.

[0043] In step 305, the application manifest file is stored in secure storage.

[0044] In step 307, the hardware / firmware is executed to verify the boot loader. In some embodiments, the boot loader includes a shim and grub, and the hardware / firmware verifies the shim to verify the boot loader, executes the shim to verify grub, and in response to verifying grub, grub verifies the operating system kernel just as the boot loader verifies the operating system kernel.

[0045] In some embodiments, the application manifest file is generated before the hardware / firmware executes in step 307. In some embodiments, the application manifest file is generated after the hardware / firmware executes in step 307.

[0046] In step 309, in response to verifying the boot loader, the boot loader is executed to verify the operating system kernel.

[0047] In step 311, in response to verifying the operating system kernel, the operating system kernel is executed to verify the trust agent. In some embodiments, the trust agent is a kernel module. In some embodiments, an application manifest file is generated after the hardware / firmware is executed in step 307 and before the trust agent is executed in step 311.

[0048] In step 313, in response to verifying the trust agent, the trust agent is caused to process the application list, identify one or more files that are part of the application, and generate a hash for all of the one or more files combined, or for each of the one or more files individually. In some embodiments, the trust agent is caused to calculate a hash for all of the one or more files combined, where the hash for the application package is applicable to all of the one or more files. In some embodiments, the trust agent is caused to calculate a hash for each of the one or more files individually, where the hash for the application package is applicable to all of the one or more files.

[0049] In step 315, the hashes for all of the combined one or more files, or the hash for each of the one or more files individually, are compared to the hashes contained in the application manifest file.

[0050] In step 317, in response to determining a hash match between the hashes for all of the one or more files combined, or the hash for each of the one or more files individually, and the hash included in the application manifest file, one or more files that are part of the application are executed.

[0051] FIG. 4 is a functional block diagram of a computer or processor-based system 400 in which one embodiment is implemented.

[0052] The processor-based system 400 is programmed to facilitate secure application launch using hashing during secure download as described herein and includes, for example, components of a bus 401, a processor 403, and a memory 405.

[0053] In some embodiments, the processor-based system is implemented as a single "system on a chip." Processor-based system 400, or portions thereof, constitutes a mechanism for performing one or more steps of secure application launch using hashing during secure download.

[0054] In some embodiments, processor-based system 400 includes a communication mechanism, such as bus 401, for transferring and / or receiving information and / or instructions between components of processor-based system 400. Processor 403 is connected to bus 401 to retrieve instructions for execution, for example, to process information stored in memory 405. In some embodiments, processor 403 also includes one or more specialized components for performing specific processing functions and tasks, such as one or more digital signal processors (DSPs) or one or more application-specific integrated circuits (ASICs). DSPs are typically configured to process real-world signals (e.g., sound) in real time independently of processor 403. Similarly, ASICs can be configured to perform specialized functions not easily performed by more general-purpose processors. Other dedicated components to help perform the functions described herein optionally include one or more field-programmable gate arrays (FPGAs), one or more controllers, or one or more other dedicated computer chips.

[0055] In one or more embodiments, processor(s) 403 performs a set of operations on the information as specified by a set of instructions stored in memory 405 related to secure application launch using hashing during secure download. Execution of the instructions causes the processor to perform the specified function.

[0056] The processor 403 and associated components are connected to memory 405 via bus 401. Memory 405 includes one or more of dynamic memory (e.g., RAM, magnetic disk, writable optical disk, etc.) and static memory (e.g., ROM, CD-ROM, etc.) for storing executable instructions that, when executed, perform the steps described herein to facilitate secure application launch using hashing during secure download. Memory 405 also stores data related to or generated by the execution of the steps.

[0057] In one or more embodiments, memory 405, such as random access memory (RAM) or any other dynamic storage device, stores information including processor instructions for secure application launch using hashing during secure download. Dynamic memory allows the information stored therein to be changed. RAM allows units of information stored at locations called memory addresses to be stored and retrieved independently of information at adjacent addresses. Memory 405 is also used by processor 403 to store temporary values ​​during execution of processor instructions. In various embodiments, memory 405 is read-only memory (ROM) or any other static storage device coupled to bus 401 for storing static information, including instructions, that cannot be changed by processor 403. Some memories consist of volatile storage, which loses information stored thereon when power is lost. In some embodiments, memory 405 is a non-volatile (persistent) storage device, such as a magnetic disk, optical disk, or flash card, for storing information, including instructions, that persists even when system 400 is turned off or otherwise loses power.

[0058] The term "computer-readable medium" as used herein refers to any medium that participates in providing information, including instructions, to the processor 403 for execution. Such media take many forms, including, but not limited to, computer-readable storage media (e.g., non-volatile media, volatile media). Non-volatile media include, for example, optical or magnetic disks. Volatile media include, for example, dynamic memory. Common forms of computer-readable media include, for example, a floppy disk, a flexible disk, a hard disk, magnetic tape, another magnetic medium, a CD-ROM, a CDRW, a DVD, another optical medium, a punch card, a paper tape, an optical mark sheet, another physical medium having a pattern of holes or other optically recognizable indicia, a RAM, a PROM, an EPROM, a FLASH-EPROM, an EEPROM, a flash memory, another memory chip or cartridge, or another medium from which a computer can read. The term computer-readable storage medium is used herein to refer to a computer-readable medium.

[0059] One aspect of the present disclosure relates to an apparatus for secure application launch using hashing during secure download. The apparatus includes a processor and a memory storing instructions that, when executed by the processor, cause the apparatus to cause firmware executed by the processor to verify a boot loader. In response to verifying the boot loader, the apparatus also causes the boot loader to execute and verify a kernel. In response to verifying the kernel, the apparatus also causes the kernel to execute and verify a trust agent. In response to verifying the trust agent, the apparatus also causes the trust agent to process an application list to identify one or more files that are part of the application and generate a hash for all of the combined one or more files or for each of the one or more files individually. The apparatus is also configured to compare the hash for all of the combined one or more files or for each of the one or more files individually with a hash included in an application manifest file stored in secure storage. The device is also caused to execute one or more files that are part of the application in response to verifying a hash match between the hash for all of the one or more files combined, or for each of the one or more files individually, and the hash included in the application manifest file.

[0060] In some embodiments, the trust agent is a kernel module.

[0061] In some embodiments, the boot loader includes a shim and grub, and the firmware verifies the shim to verify the boot loader, executes the shim to verify grub, and in response to verifying grub, grub verifies the kernel, just as the boot loader verifies the kernel.

[0062] In some embodiments, the device also, in response to receiving an application package from a source by secure download, the application package including one or more files that are part of the application, causes the hash calculator to calculate a hash of the application package and generate an application manifest file, the hash included in the application manifest file being the hash of the application package, and causes the application manifest file to be stored in secure storage.

[0063] In some embodiments, the application manifest file is generated before the firmware is executed. In some embodiments, the application manifest file is generated after the firmware is executed and before the trust agent is executed.

[0064] In some embodiments, the apparatus also causes, during secure downloading of one or more files that are part of the application from a source via secure download, the hash calculator to calculate a hash of an application package that includes the one or more files that are part of the application and generate an application manifest file, the hash included in the application manifest file being a hash of the application package, and the application manifest file is stored in secure storage.

[0065] Another aspect of the present disclosure relates to a method for secure application launch using hashing during secure download. The method includes having firmware executed by a processor verify a boot loader. In response to verifying the boot loader, the method also includes having the boot loader executed to verify a kernel. In response to verifying the kernel, the method also includes having the kernel executed to verify a trust agent. In response to verifying the trust agent, the method also includes having the trust agent process an application list to identify one or more files that are part of the application and generate a hash for all of the combined one or more files or for each of the one or more files individually. The method also includes comparing the hash for all of the combined one or more files or for each of the one or more files individually with a hash included in an application manifest file stored in secure storage. In response to determining a hash match between the hash for all of the combined one or more files or for each of the one or more files individually and the hash included in the application manifest file, the method also includes executing the one or more files that are part of the application.

[0066] In some embodiments, the trust agent is a kernel module.

[0067] In some embodiments, the boot loader includes a shim and grub, and the firmware verifies the shim to verify the boot loader, executes the shim to verify grub, and in response to verifying grub, grub verifies the kernel, just as the boot loader verifies the kernel.

[0068] In some embodiments, the method also includes, in response to receiving, by secure download from a source, an application package that includes one or more files that are part of the application, causing a hash calculator to calculate a hash for the application package; generating an application manifest file, where the hash included in the application manifest file is the hash for the application package; and storing the application manifest file in secure storage.

[0069] In some embodiments, the application manifest file is generated before the firmware is executed. In some embodiments, the application manifest file is generated after the firmware is executed and before the trust agent is executed.

[0070] In some embodiments, the method also includes, during secure downloading of one or more files that are part of the application via secure download from a source, causing a hash calculator to calculate a hash of an application package that includes one or more files that are part of the application; generating an application manifest file, wherein the hash included in the application manifest file is a hash of the application package; and storing the application manifest file in secure storage.

[0071] Another aspect of the present specification relates to a non-transitory computer-readable medium for secure application launch using hashing during secure download. The non-transitory computer-readable medium stores instructions that, when executed by a processor, cause a device to cause firmware executed by the processor to verify a boot loader. In response to verifying the boot loader, the device also causes the boot loader to execute and verify a kernel. In response to verifying the kernel, the device also causes the kernel to execute and verify a trust agent. In response to verifying the trust agent, the device also causes the trust agent to process an application list to identify one or more files that are part of the application and generate a hash for all of the combined one or more files or for each of the one or more files individually. The device is also configured to compare the hash for all of the combined one or more files or for each of the one or more files individually with a hash included in an application manifest file stored in secure storage. The device is also caused to execute one or more files that are part of the application in response to verifying a hash match between the hash for all of the one or more files combined, or for each of the one or more files individually, and the hash included in the application manifest file.

[0072] In some embodiments, the trust agent is a kernel module.

[0073] In some embodiments, the boot loader includes a shim and grub, and the firmware verifies the shim to verify the boot loader, executes the shim to verify grub, and in response to verifying grub, grub verifies the kernel, just as the boot loader verifies the kernel.

[0074] In some embodiments, the device also, in response to receiving an application package from a source by secure download, the application package including one or more files that are part of the application, causes the hash calculator to calculate a hash of the application package and generate an application manifest file, the hash included in the application manifest file being the hash of the application package, and causes the application manifest file to be stored in secure storage.

[0075] In some embodiments, the application manifest file is generated before the firmware is executed. In some embodiments, the application manifest file is generated after the firmware is executed and before the trust agent is executed.

[0076] In some embodiments, the apparatus also causes, during secure downloading of one or more files that are part of the application from a source via secure download, the hash calculator to calculate a hash of an application package that includes the one or more files that are part of the application and generate an application manifest file, the hash included in the application manifest file being a hash of the application package, and the application manifest file is stored in secure storage.

[0077] The above outlines features of several embodiments so that those skilled in the art can better understand aspects of the present disclosure. The present disclosure includes features that enable verification of boot components up to the operating system and applications instantiated after successful boot of the operating system. The present disclosure provides a mechanism for verifying components within a computer system during the boot cycle by facilitating secure application launch using hash creation during secure download. The features described in this disclosure use a root of trust in accordance with the UEFI secure boot mechanism to provide a trust anchor and generate a hash using an application that is used to verify secure launch of an application at the root of trust. The features discussed in this disclosure improve computer system security by providing verification of all components within the system, including applications, at every boot cycle while simplifying secure boot of applications by leveraging the root of trust mechanism for secure boot in accordance with UEFI.

[0078] It should be appreciated that those skilled in the art may readily use this disclosure as a basis for designing or modifying other processes and structures which carry out the same purposes and / or achieve the same advantages as the embodiments introduced herein. Those skilled in the art should also recognize that such equivalent constructions do not depart from the spirit and scope of the disclosure, and that various changes, substitutions, and alterations can be made herein without departing from the spirit and scope of the disclosure.

Claims

1. 1. An apparatus comprising: a processor; and a memory storing instructions that, when executed by the processor, cause the apparatus to: causing firmware executed by the processor to verify the boot loader; responsive to verifying the boot loader, executing the boot loader to verify a kernel; responsive to verifying the kernel, executing the kernel to verify a trust agent; in response to verifying the trust agent, causing the trust agent to process an application list to identify one or more files that are part of the application and generate a hash for all of the one or more files combined or for each of the one or more files individually; comparing the hash for all of the one or more files combined, or the hash for each of the one or more files individually, to a hash contained in an application manifest file stored in secure storage; executing the one or more files that are part of the application in response to determining a hash match between the hashes for all of the one or more files combined or the hash for each of the one or more files individually and the hash included in the application manifest file; A device that performs the following.

2. the trust agent is a kernel module; 10. The apparatus of claim 1.

3. the boot loader includes a shim and a grub; The firmware verifies the shim to verify the boot loader, and executes the shim to verify the grub; in response to verifying the grub, the grub verifies the kernel, such that the boot loader verifies the kernel; 10. The apparatus of claim 1.

4. The apparatus further comprises: in response to receiving an application package by secure download from a source, the application package including the one or more files that are part of the application, causing a hash calculator to calculate a hash of the application package; generating the application manifest file, wherein the hash included in the application manifest file is the hash of the application package; storing the application manifest file in the secure storage.

10. The apparatus of claim 1.

5. The application manifest file is generated before the firmware is executed.

5. The apparatus of claim 4.

6. the application manifest file is generated after the firmware is executed and before the trust agent is executed; 5. The apparatus of claim 4.

7. The apparatus further comprises: during secure download of the one or more files that are part of the application by secure download from a source, causing a hash calculator to calculate a hash of an application package that includes the one or more files that are part of the application; generating the application manifest file, wherein the hash included in the application manifest file is the hash of the application package; storing the application manifest file in the secure storage; and 10. The apparatus of claim 1.

8. 1. A method comprising: causing firmware executed by the processor to verify the boot loader; responsive to verifying the boot loader, executing the boot loader to verify a kernel; responsive to verifying the kernel, executing the kernel to verify a trust agent; in response to verifying the trust agent, causing the trust agent to process an application list, identify one or more files that are part of the application, and generate a hash for all of the one or more files combined or for each of the one or more files individually; comparing the hash for all of the one or more files combined, or the hash for each of the one or more files individually, to a hash contained in an application manifest file stored in secure storage; executing the one or more files that are part of the application in response to determining a hash match between the hashes for all of the one or more files combined or the hash for each of the one or more files individually and the hash included in the application manifest file; A method comprising:

9. the trust agent is a kernel module; The method of claim 8.

10. the boot loader includes a shim and a grub; The firmware verifies the shim to verify the boot loader, and executes the shim to verify the grub; in response to verifying the grub, the grub verifies the kernel, such that the boot loader verifies the kernel; The method of claim 8.

11. The method further comprises: in response to receiving an application package by secure download from a source, the application package including the one or more files that are part of the application, causing a hash calculator to calculate a hash of the application package; generating the application manifest file, wherein the hash included in the application manifest file is the hash of the application package; storing the application manifest file in the secure storage. The method of claim 8.

12. The application manifest file is generated before the firmware is executed. The method of claim 11.

13. the application manifest file is generated after the firmware is executed and before the trust agent is executed; The method of claim 11.

14. The method further comprises: during secure download of the one or more files that are part of the application by secure download from a source, causing a hash calculator to calculate a hash of an application package that includes the one or more files that are part of the application; generating the application manifest file, wherein the hash included in the application manifest file is the hash of the application package; storing the application manifest file in the secure storage. The method of claim 8.

15. A non-transitory computer-readable medium having stored thereon instructions that, when executed by a processor, cause an apparatus to: causing firmware executed by the processor to verify the boot loader; responsive to verifying the boot loader, executing the boot loader to verify a kernel; responsive to verifying the kernel, executing the kernel to verify a trust agent; in response to verifying the trust agent, causing the trust agent to process an application list, identify one or more files that are part of the application, and generate a hash for all of the one or more files combined or for each of the one or more files individually; comparing the hash for all of the one or more files combined, or the hash for each of the one or more files individually, to a hash contained in an application manifest file stored in secure storage; executing the one or more files that are part of the application in response to determining a hash match between the hashes for all of the one or more files combined or the hash for each of the one or more files individually and the hash included in the application manifest file; A non-transitory computer-readable medium for causing the execution of

16. the trust agent is a kernel module; 16. The non-transitory computer-readable medium of claim 15.

17. the boot loader includes a shim and a grub; The firmware verifies the shim to verify the boot loader, and executes the shim to verify the grub; in response to verifying the grub, the grub verifies the kernel, such that the boot loader verifies the kernel; 16. The non-transitory computer-readable medium of claim 15.

18. The apparatus further comprises: in response to receiving an application package by secure download from a source, the application package including the one or more files that are part of the application, causing a hash calculator to calculate a hash of the application package; generating the application manifest file, wherein the hash included in the application manifest file is the hash of the application package; storing the application manifest file in the secure storage; and 16. The non-transitory computer-readable medium of claim 15.

19. The application manifest file is generated before the firmware is executed.

20. The non-transitory computer-readable medium of claim 18.

20. The apparatus further comprises: during secure download of the one or more files that are part of the application by secure download from a source, causing a hash calculator to calculate a hash of an application package that includes the one or more files that are part of the application; generating the application manifest file, wherein the hash included in the application manifest file is the hash of the application package; storing the application manifest file in the secure storage; and 16. The non-transitory computer-readable medium of claim 15.

Images