OS Boot Integrity Verification via Hash Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods struggle to prevent file alteration and execution of altered programs, especially in systems without a Trusted Platform Module (TPM) or environments where signature verification cannot be executed, leading to potential unauthorized file updates and executions.
Innovation Solution
An information processing device is configured with processing circuitry to determine the integrity of data during the OS boot sequence and suspend shutdown if integrity is compromised, using hash values to verify the integrity of update definition data, execution programs, and update files, and notifying potential alterations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TPM and signature verification are used to ensure file integrity, then security is improved, but device complexity and cost increase
Solution Approach 1:
The patent extracts the essential integrity verification function from complex TPM-based systems and implements it through simple hash value comparison. The determination unit calculates hash values of boot sequence data and compares them against stored hash values to detect alterations, eliminating the need for TPM hardware while maintaining security functionality.
Solution Approach 2:
The patent uses disposable hash values stored in non-volatile memory to verify integrity throughout the boot sequence. These hash values are calculated once and stored, then repeatedly compared during boot without requiring expensive cryptographic infrastructure, providing cost-effective security verification.
2Reliability
If signature verification is implemented to prevent altered program execution, then security is improved, but ease of operation deteriorates in environments without TPM support
Solution Approach 1:
The patent replaces the mechanical TPM hardware system with a software-based hash verification mechanism. The determination unit performs integrity checks by calculating and comparing hash values, substituting the complex TPM infrastructure with a simpler computational approach that works on standard processors.
Solution Approach 2:
The patent creates a universal integrity verification method that functions on any computing platform without requiring TPM support. The hash-based approach can be implemented in various operating systems and environments, making the security mechanism broadly applicable across different hardware and software configurations.
3Adaptability or versatility
If conventional file update mechanisms are used during boot sequence, then system flexibility is improved, but vulnerability to file alteration increases
Solution Approach 1:
The patent performs preliminary integrity verification by calculating and storing hash values of boot sequence data before the boot process begins. During subsequent boot operations, these pre-stored hash values are compared against newly calculated hash values to detect any alterations, preventing malicious file updates from executing.
Solution Approach 2:
The patent implements a feedback mechanism where the determination unit continuously monitors boot sequence data integrity by comparing calculated hash values against stored reference values. When alterations are detected, the system can respond by preventing altered programs from executing or alerting the user, creating a closed-loop security system.
Data Source
AI summary
An information processing device includes processing circuitry configured to determine whether or not there is integrity in predetermined data regarding a boot sequence of an Operating System (OS) during execution of shutdown of the OS, arid suspend shutdown of the OS when it is determined that there is no integrity in the predetermined data.