Software Image Hash Tree Authentication for Faster Secure Boot
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual machines are susceptible to hacking attempts where malicious actors modify the software images, compromising the integrity and security of the system, necessitating effective authentication methods to prevent unauthorized access and code alteration.
Innovation Solution
A secure storage device employs a tree structure to store hashes of software images, generating hashes based on parent nodes, ensuring authentication before booting, thereby preventing unauthorized modifications and reducing storage and computational resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software images are stored without authentication, then storage space is reduced and access is faster, but system security and integrity are compromised
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing hash values of software images in a tree structure before the boot process. This allows the authentication to be performed efficiently during boot by comparing the computed hash with the pre-stored hash, rather than performing complex authentication operations during the critical boot phase.
Solution Approach 2:
The patent uses hash values as an intermediary to represent software images. Instead of storing and comparing entire software images or performing complex cryptographic verification, the system computes hash values (intermediaries) that uniquely represent the software images and compares these compact representations for authentication.
2Reliability
If complete software images are stored for authentication, then authentication accuracy is improved, but storage space requirements increase
Solution Approach 1:
The patent extracts the essential authentication information from the complete software images by computing hash values. Instead of storing entire software images for authentication purposes, the system extracts and stores only the hash values, which are compact representations containing the necessary information to verify software image integrity.
Solution Approach 2:
The patent creates a simplified copy of the software image in the form of a hash value. This hash copy contains the essential information needed for authentication while occupying minimal storage space, allowing multiple versions and variants of software images to be authenticated without proportionally increasing storage requirements.
3Reliability
If traditional authentication methods are used, then security is improved, but boot time increases
Solution Approach 1:
The patent performs the computationally intensive hash computation and tree structure preparation in advance, before the boot process begins. During boot, the system only needs to compute a hash of the loaded software image and traverse the pre-built hash tree to verify authenticity, significantly reducing the time required during the critical boot phase while maintaining strong security.
Data Source
AI summary
Methods, systems, and devices for authenticating software images are described. Software images may include different portions (e.g., different versions, different users) that may be authenticated using hashes associated with an underlying data structure of the portion of the software image. In some examples, hashes (e.g., first hashes) associated with the software image may be generated and stored using a tree structure, such that a previous hash may be used when calculating a hash associated with a new portion of the software image. To authenticate a portion of the software image, a command may be issued, and a second hash may be calculated using the current data structure of the software image. The second hash may be compared to the associated first hash, and the software image may be authenticated based on the hashes matching.