Secure Boot Configuration via In-Memory File System Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems lack a secure method to validate and apply system configurations during the booting process, leading to potential compromised systems due to malformed or malicious configurations.
Innovation Solution
A system and method that creates a file system from a base file system image in system memory, applies and validates configuration files, and ensures only trusted files are executed by verifying hashes and signatures, thereby preventing unauthorized changes during the boot process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If configuration is done manually or automatically using automated solutions during runtime, then system configuration can be applied, but root access is required which can lead to malformed or malicious configurations compromising the system
Solution Approach 1:
The patent applies configuration files during the boot process before the operating system gains control, rather than during runtime. This preliminary action ensures configurations are established in a secure environment with restricted access, preventing unauthorized modifications while maintaining system security.
Solution Approach 2:
The patent introduces a boot-time configuration mechanism that acts as an intermediary between the boot process and the operating system. This intermediary applies configurations early in the boot sequence, isolating the configuration application process from the security risks associated with runtime root access.
2Reliability
If configuration is applied during booting process, then system security is improved by preventing unauthorized changes, but the configuration process becomes more complex
Solution Approach 1:
The patent merges the configuration application process with the existing boot process. By integrating configuration file application into the boot sequence, the system leverages the established boot infrastructure rather than creating a separate complex configuration mechanism, thus improving security without proportionally increasing complexity.
Solution Approach 2:
The system performs self-configuration during boot by automatically applying configuration files from storage to the running kernel. This self-service approach eliminates the need for manual intervention or complex external configuration management systems, reducing operational complexity while maintaining security.
3Reliability
If files are copied from persistent file system to memory during boot, then system can operate with validated files, but the boot process time increases
Solution Approach 1:
The patent applies only the necessary configuration files during boot rather than copying or validating the entire persistent file system. This partial action approach focuses validation efforts on critical configuration files, ensuring security while minimizing the time overhead during the boot process.
Data Source
AI summary
Systems, method, and non-transitory computer readable storage medium are provided for configuring an information computing machine during execution of a kernel image. The system can create a file system from a base file system image in system memory of the computing system, apply configuration files from a bundle image to the file system in memory, copy files from a persistent file system stored in the storage resource to memory, validate the files from the persistent file system, and apply validated files to the file system in memory. The base file system image and bundle image can be verified by comparing a signed hash of the image with a hash generated by the initial file system and checking the hash signature against a public certificate included in the initial filesystem. The system can further execute /sbin/init and start application services.