Secure Boot via Storage Device Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing host devices lack a cost-effective and flexible method to securely verify the integrity of operating system code before execution, as provisioning controllers with verification code increases costs and limits retrofittability.
Innovation Solution
The boot loader code stored in a storage device performs a security check to verify the integrity of the operating system code, ensuring it has not been altered by a hacker, and only executes the code if the check is successful, using a private memory area managed by the storage device controller.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the host device controller is provisioned with verification code to perform security checks, then the security of the boot process is improved, but the controller cost increases and retrofittability is limited
Solution Approach 1:
The verification code is extracted from the host device controller and relocated to the storage device. The boot loader code stored in the storage device's private memory area contains the verification logic, allowing security checks to be performed without requiring the controller to be provisioned with verification code during manufacturing.
Solution Approach 2:
The boot loader code acts as an intermediary between the operating system code and the host device controller. It performs the security verification function that would otherwise require special provisioning in the controller, enabling secure boot without increasing controller complexity or cost.
2Adaptability or versatility
If the operating system code is stored on the storage device, then the flexibility and cost-effectiveness of the system is improved, but the risk of code alteration and malware introduction increases
Solution Approach 1:
The boot loader code performs a security check before executing the operating system code to verify that the code has not been altered. This preliminary verification action ensures code integrity before the system becomes operational, preventing malware execution while maintaining the flexibility of storing OS code on the storage device.
3Ease of manufacture
If the controller is manufactured without verification code, then the manufacturing cost is reduced, but the ability to perform secure boot is lost
Solution Approach 1:
The verification functionality is extracted from the controller and placed in the storage device's boot loader code. This allows controllers to be manufactured without expensive verification code provisioning, while secure boot capability is maintained through the boot loader's verification routines.
Solution Approach 2:
The verification logic is copied into the boot loader code stored in the storage device's private memory area. This eliminates the need to provision verification code in the controller during manufacturing, reducing costs while maintaining security functionality.
Data Source
AI summary
A host device and method for securely booting the host device with operating system code loaded from a storage device are provided. In one embodiment, a host device is in communication with a storage device having a private memory area storing boot loader code and a public memory area storing operating system code. The host device instructs the storage device to initiate a boot mode and receives the boot loader code from the storage device. The host device executes the boot loader code which performs a security check and executes the operating system code loaded from the storage device only if the security check is successful.