Secure Boot Data Storage Device for Tamper-Proof Terminal Configuration

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing removable boot data storage devices lack secure configuration and update mechanisms, making it difficult to change software configurations securely and risking modification by hackers if stolen.

Innovation Solution

A method and device that utilize a secure boot process with digital signatures and encryption to ensure the operating system and user data are tamper-proof, allowing incremental updates and secure access through a tree structure in RAM, with authentication and encryption mechanisms to protect data integrity and accessibility.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If a removable boot data storage device is used to enable flexible terminal configuration, then adaptability is improved, but security deteriorates because the device can be stolen and hacked by attackers

Engineering Contradiction:

Improveterminal configuration flexibilityVSAvoiddevice security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The storage device is divided into a first memory zone containing a boot program with digital signature verification capability, and a second memory zone containing user data. The boot program securely verifies and loads only authenticated software environments, preventing unauthorized modifications while maintaining configuration flexibility.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The boot program performs preliminary digital signature verification of the software environment before loading it into memory. This advance authentication ensures that only verified software can execute, preventing hackers from modifying the removable device's content without detection.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If digital signature verification is implemented to ensure software integrity, then security is improved, but device complexity increases due to additional verification steps

Engineering Contradiction:

Improvesoftware integrityVSAvoidverification process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The digital signature verification functionality is merged into the boot program itself, which is already executed during system startup. This integration allows security verification to occur as a natural part of the boot process without requiring separate verification hardware or complex additional steps.

Inventive Principle:

Principle #5Merging (Combining)

3Adaptability or versatility

If the operating system is loaded from a removable device to enable portable computing, then adaptability is improved, but contamination risk increases from viruses or pirate programs on the terminal's hard disk

Engineering Contradiction:

Improveportable computing capabilityVSAvoidvirus contamination risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The verified software environment is extracted from the removable storage device and loaded into the terminal's random access memory (RAM) for execution. This extraction isolates the trusted operating system from the terminal's hard disk, preventing viruses or pirate programs residing on the hard disk from contaminating the verified software environment.

Inventive Principle:

Principle #2Taking out (Extraction)

4Reliability

If secure write access is restricted to prevent tampering, then security is improved, but ease of operation deteriorates because users cannot easily update configuration

Engineering Contradiction:

Improvedata protectionVSAvoidconfiguration update ability

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The storage device implements dynamic access control where the boot program has secure write access to verify and update the software environment, while users have read-only access during normal operation. This dynamic permission structure maintains security while allowing authorized updates when needed.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentEP2024798B1Secure terminal configuration method and device by means of a boot data storage device

Publication Date: 2018.01.10 ORANGE SA

Figure 1a~1b
Figure 2a~3
Figure 4

AI summary

Configuration method of a terminal (10a) by mean of an external device to said terminal (50a), suitable for communicating with said terminal and comprising data storage means, the initialisation of said terminal triggering at least: - an execution step of a boot program of an operating system of said terminal, said boot program being stored in a first memory zone of said storage means, - a verification step by the boot program of a first digital signature of a first file stored in a second memory zone of said storage means, said first file comprising a shell of an operating system of said terminal, - a boot step of said shell, said boot step being intended to only be activated in the event of the validity of said digital signature.