Patent Application
20060048222
1. Field of the Invention
The present invention relates in general to the field of information handling systems and, more particularly, to a method and apparatus for ensuring the security and integrity of software and data on an information handling system.
2. Description of the Related Art
As the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option available to users is information handling systems. An information handling system generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes, thereby allowing users to take advantage of the value of the information. Because technology and information handling needs and requirements vary between different users or applications, information handling systems may also vary regarding what information is handled, how the information is handled, how much information is processed, stored, or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in information handling systems allow for information handling systems to be general or configured for a specific user or specific use, such as financial transaction processing, airline reservations, enterprise data storage, or global communications. In addition, information handling systems may include a variety of hardware and software components that may be configured to process, store, and communicate information and may include one or more computer systems, data storage systems, and networking systems.
In recent years, there has been an increase in the number of information handling systems that are manufactured based on a “build to order” process that allows a customer to specify hardware and software options. Currently, a “build to order” manufacturer often ships information handling systems from the factory to the customer. In the case of smaller customers, the customer may receive the system directly. For larger customers, however, the information handling system may pass through a number of intermediate entities such as value added resellers (VARs).
In general, there is no assurance for the customer that the contents of the information handling system have not been modified after leaving the secure set-up area at the manufacturing facility. Ensuring the security and integrity of the system contents is essential, however, since the system contents may include confidential customer set-up information including provisioning data, configuration data, and other sensitive information.
Efforts are underway in the industry to promote secure computing systems. However, there is no current system or procedure for ensuring the security of information handling systems from a manufacturing facility to the customer. In view of the foregoing, there is a need for a method and apparatus to ensure the security and integrity of software and data contained on a “build to order” information handling system.
The present invention overcomes the shortcomings of the prior art by providing a method and apparatus for ensuring the security of a particular configuration of hardware and software for an information handling system that is assembled using a “build-to-order” system. Specifically, the present invention ensures the security and integrity of data on an information handling system from the point of manufacture to the final destination at the customer's facility.
The method and apparatus of the present invention is implemented using a plurality of electronic keys to generate electronic seals and to verify the contents of a predetermined set of data and system parameters contained in a manifest file that is stored in the information handling system. In one embodiment of the invention, the electronic seal is generated using public key infrastructure (PKI) encryption keys. In an alternate embodiment of the invention, the electronic seal is generated using symmetric keys.
In the embodiment of the invention that is implemented using a PKI key, a customer provides a public key at the time an order is placed for an information handling system. The information handling system is then manufactured with the operating system and a predetermined set of software files is installed thereon. When the process of fabricating the information handling system is complete, a manifest file is constructed comprising a plurality of specified files, registry settings, provisioning information, and any additional information needed for a specific level of security. The manufacturer then “signs” this manifest with a private key and the customer's public key. When the information handling system performs its initial boot, the public key provided by the manufacturer is extracted from the storage in the information handling system and a comparison is made of the BIOS and the CMOS against the information contained in the encrypted manifest. If any of the information compared to the manifest has been altered, the initial boot is designated as “invalid” and the user is notified of the potential for a breach of security.
If the system passes the test conducted during the initial boot sequence, the system then requests the customer to provide private key information. The customer-provided private key is used to verify (or to re-verify and/or decrypt where necessary) all of the “signed” information and the customer configuration/ordering information.
In an alternate embodiment of the invention, the electronic seal is generated using a symmetric key. In this embodiment, the information handling system is manufactured with the operating system and a predetermined set of software is installed thereon. When the process of fabricating the information handling system is complete, a manifest file is constructed comprising a plurality of specified files, registry settings, provisioning information, and any additional information needed for a specific level of security. The manufacturer then “signs” this manifest with the manufacturer's private key and the symmetric key which has been provided to the customer at the time of purchase. When the information handling system performs its initial boot, the public key provided by the manufacturer is extracted from the storage in the information handling system and a comparison is made of the BIOS and the CMOS against the information contained in the encrypted manifest. If any of the information compared to the manifest has been altered, the initial boot is designated as “invalid” and the user is notified of the potential for a breach of security.
If the system passes the test conducted during the initial boot sequence, the system then requests the customer to provide a symmetric key. The customer-provided symmetric key is used to verify (or to re-verify and/or decrypt where necessary) all of the “signed” information and the customer configuration/ordering information.
The alternate embodiment comprising a symmetric key has the advantage of minimizing vulnerability and maximizing flexibility. For example, the symmetric key embodiment can be used for a dealer or a vendor who can print out the key for a customer. As discussed herein, the symmetric key in combination with information stored in the computer provides a comprehensively secure system since the end user must have physical possession of the computer in order to initiate the initial boot sequence using the symmetric key.
The present invention may be better understood, and its numerous objects, features and advantages made apparent to those skilled in the art by referencing the accompanying drawings. The use of the same reference number throughout the several figures designates a like or similar element.
Because different families of information handling systems and different individual computer components require different software installation, it is necessary to determine which software to install on a target information handling system 120. A descriptor file 130 is provided by converting an order 110, which corresponds to a desired information handling system having desired components, into a computer readable format via conversion module 132.
Component descriptors are computer readable descriptions of the components of target information handling system 120 which components are defined by the order 110. In an embodiment of the present invention, the component descriptors are included in a descriptor file called a system descriptor record which is a computer readable file containing a listing of the components, both hardware and software, to be installed onto target information handling system 120. Having read the plurality of component descriptors, database server 140 provides a plurality of software components corresponding to the component descriptors to file server 142 over network connection 144. Network connections 144 may be any network connection well-known in the art, such as a local area network, an intranet, or the internet. The information contained in database server 140 is often updated such that the database contains a new factory build environment. The software is then installed on the target information handling system 120. The software installation is controlled by a software installation management server that is operable to control the installation of the operating system and other software packages specified by a customer.
For purposes of this disclosure, an information handling system may include any instrumentality or aggregate of instrumentalities operable to compute, classify, process, transmit, receive, retrieve, originate, switch, store, display, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, or other purposes. For example, an information handling system may be a personal computer, a network storage device, or any other suitable device and may vary in size, shape, performance, functionality, and price. The information handling system may include random access memory (RAM), one or more processing resources such as a central processing unit (CPU) or hardware or software control logic, ROM, and/or other types of nonvolatile memory. Additional components of the information handling system may include one or more disk drives, one or more network ports for communicating with external devices, as well as various input and output (I/O) devices, such as a keyboard, a mouse, and a video display. The information handling system may also include one or more buses operable to transmit communications between the various hardware components.
In one embodiment of the present invention, the security is based on a PKI system. In an alternate embodiment however, a customer can order a system from the manufacturer over a secure SSL-protected link. If the customer does not have a PKI key, the customer can request a symmetric key instead, which is displayed on a web page and can be saved or printed by the customer. Using a secure socket layer (SSL) security system, information relating to the symmetric key is maintained in a secure environment.
When the information handling system 120 arrives at the customer's site, the customer uses the symmetric key to “break the seal.” The symmetric key embodiment is particularly useful for consumers who may not have a public key or do not know how to use one. For example, if the computer is a gift, the customer can print out the key and give it to the recipient of the gift. Even if the key is exposed through unsecured e-mail, it is necessary to have physical possession of the computer to use it. This embodiment also avoids the positive verification requirement of obtaining a copy of the manufacturer's public key directly from the Internet rather than relying on the key stored on the hard drive. The alternate embodiment comprising a symmetric key also has the advantage of minimizing vulnerability and maximizing flexibility. For example, the symmetric key embodiment can be used for a dealer or a vendor who can print out the key for a customer. As discussed hereinabove, the symmetric key in combination with information stored in the computer provides a comprehensively secure system since the end user must have physical possession of the computer in order to initiate the initial boot sequence using the symmetric key.
The contents of the manifest file 216 and the level of security verification can vary depending on predetermined security parameters selected by the manufacturer or the customer for a desired level of security. For example, at one level of security, the security information can comprise signed configuration files and a manifest file containing a predetermined set of operating system and boot files. At this level of security, the initial boot security can include a checksum verification of the BIOS and the CMOS, and the verification can be conducted with or without the public key of the end user. In another level of security, the security information can include a signed checksum of the entire hard drive 206 and a checksum verification of the entire hard drive and the BIOS and CMOS during the initial boot. This level of security can also be implemented with or without the public key of the end user. A third level of security can include encrypted customer configuration files, signed operating system and boot files, and various checksum verifications performed using electronic keys in accordance with PKI protocols. A fourth level of security can include encrypted customer configuration files, a signed checksum of the entire hard drive 206, and a checksum verification of the BIOS and CMOS using electronic keys in accordance with PKI protocols.
Other embodiments are within the following claims.
Although the present invention has been described in detail, it should be understood that various changes, substitutions and alterations can be made hereto without departing from the spirit and scope of the invention as defined by the appended claims.
