Method of installing an image on a client over a network securely using a wanboot binary and a kernel to install the image
View Patent ↗A method for installing an image on a client including obtaining a wanboot binary from the boot server, determining whether the wanboot binary is valid, obtaining a security payload from the boot server using the wanboot binary if the wanboot binary is valid, establishing a first secure connection between the client and boot server, obtaining a boot file system from the boot server using the first secure connection, installing the boot file system on the client to obtain a kernel, establishing a second secure connection between the client and an installation server using the security payload and the kernel, obtaining an installation image from the installation server using the kernel and the second secure connection, and installing the installation image on the client.
1. A method for installing an image on a client comprising:
obtaining a wanboot binary from a boot server;
verifying that the wanboot binary is valid;
executing the wanboot binary to obtain a security payload from the boot server, wherein the security payload is used to create a first secure connection and a second secure connection;
establishing the first secure connection between the client and boot server using the security payload;
obtaining a boot file system from the boot server using the first secure connection, wherein the boot file system comprises a kernel;
loading, by the wanboot binary, the kernel on the client, wherein the kernel is configured to install an installation image on the client;
executing the kernel to establish the second secure connection between the client and an installation server using the security payload;
obtaining the installation image from the installation server using the kernel and the second secure connection; and
executing the kernel to install the installation image on the client.
2. The method of claim 1 , further comprising:
obtaining client configuration information from a DHCP server.
3. The method of claim 2 , wherein the client configuration information comprises:
a client internet protocol address;
a client hostname;
a boot server location;
an installation server location; and
an installation image location.
4. The method of claim 2 , wherein the client establishes the first secure connection with the boot server using the client configuration information.
5. The method of claim 2 , wherein the client establishes the second secure connection with the installation server using the client configuration information.
6. The method of claim 2 , wherein the client configuration information is obtained using unicast DHCP.
7. The method of claim 2 , wherein the client configuration information is configured on a per-client basis.
8. The method of claim 1 , wherein the wanboot binary obtained from the boot server is signed using a shared authentication key.
9. The method of claim 8 , wherein the shared authentication key is a symmetric key.
10. The method of claim 8 , wherein the shared authentication key is generated using a SHA-1 algorithm.
11. The method 8 , wherein the wanboot binary is valid if the wanboot binary is signed using the shared authentication key associated with the client.
12. The method of claim 1 , wherein the security payload comprises:
a message digest algorithm type;
a client private key; and
a client certificate.
13. The method of claim 1 , wherein the security payload is obtained in encrypted form from the boot server.
14. The method of claim 13 , wherein the security payload is encrypted using a shared encryption key.
15. The method of claim 14 , wherein the shared encryption key is a symmetric key.
16. The method of claim 14 , wherein the shared encryption key is generated using a 3DES algorithm.
17. The method of claim 1 , wherein the first secure connection is a secure socket layer (SSL) connection.
18. The method of claim 17 , wherein the SSL connection is established using the client certificate.
19. The method of claim 1 , wherein the second secure connection is a secure socket layer (SSL) connection.
20. The method of claim 19 , wherein the SSL connected is established using the client certificate.
21. The method of claim 20 , wherein the client comprises a shared authentication key and a shared encryption key.
22. The method of claim 21 , wherein the shared authentication key and the shared encryption key are stored in a programmable read only memory in the client.
23. The method of claim 1 , wherein the wanboot binary includes functionality to establish the first secure connection between the client and the boot server.
24. The method of claim 1 , wherein the boot file system comprises a utility and a library.
25. The method of claim 1 , wherein an appropriate utility and an appropriate library are obtained from the boot server when boot file system is obtained.
26. The method of claim 25 , wherein the appropriate utility and appropriate library provide the kernel the functionality to install the installation image.
27. A system, comprising:
a DHCP server configured to store client configuration information;
a boot server configured to store a wanboot binary and a boot file system;
an installation server configured to store an installation image; and
a client configured to:
connect to the DHCP server to obtain the client configuration information,
connect to boot server using the client configuration information to obtain the wanboot binary,
execute the wanboot binary to connect to the boot server to obtain the boot file system, wherein the boot file system comprises a kernel,
load, by the wanboot binary, the kernel on the client, wherein the kernel is configured to install an installation image on the client,
execute the kernel to connect to the installation server to obtain the installation image, and
execute the kernel to install the installation image on the client.
28. The system of claim 27 , wherein the boot server is further configured to store a security payload.
29. The system of claim 28 , wherein the client is further configured to obtain the security payload using the wanboot binary.
30. The system of claim 28 , wherein the security payload comprises:
a message digest algorithm type;
a client private key; and
a client certificate.
31. The system of claim 28 , wherein the security payload is obtained in encrypted form from the boot server.
32. The system of claim 31 , wherein the security payload is encrypted using a shared encryption key.
33. The system of claim 31 , wherein the shared encryption key is generated using a 3DES algorithm.
34. The system of claim 32 , wherein the shared encryption key is a symmetric key.
35. The system of claim 28 , wherein the security payload is used to establish a secure connection between the client and the boot server.
36. The system of claim 35 , where the secure connection is a secure socket layer connection.
37. The system of claim 28 , wherein the security payload is used to establish a secure connection between the client and the installation server.
38. The system of claim 37 , where the secure connection is a secure socket layer connection.
39. The system of claim 27 , wherein the client connects to the DHCP server using DHCP unicast.
40. The system of claim 27 , wherein the DHCP server is configured on a per-client basis.
41. The system of claim 27 , wherein the wanboot binary obtained from the boot server is signed using a shared authentication key.
42. The system of claim 41 , wherein the shared authentication key is a symmetric key.
43. The system of claim 42 , wherein the shared authentication key is generated using a SHA-1 algorithm.
44. The system of claim 27 , wherein the client configuration information comprises:
a client internet protocol address;
a client hostname;
a boot server location;
an installation server location; and
an installation image location.
45. The system of claim 27 , wherein the client establishes the connection with the boot server using the client configuration information.
46. The system of claim 27 , wherein the client establishes the connection with the installation server using the client configuration information.
47. The system of claim 27 , wherein the client configuration information is obtained using unicast DHCP.
48. The system of claim 27 , wherein the client comprises a shared authentication key and a shared encryption key.
49. The system of claim 48 , wherein the shared authentication key and the shared encryption key are stored in a programmable read only memory in the client.
50. The system of claim 27 , wherein the boot file system comprises a utility and a library.
51. The system of claim 27 , wherein an appropriate utility and an appropriate library are obtained from the boot server when boot file system is obtained.
52. The system of claim 51 , wherein the appropriate utility and appropriate library provide the kernel the ftmctionality to install the installation image.
53. A plurality of nodes, comprising:
a DHCP server configured to store client configuration information;
a boot server configured to store a wanboot binary and a boot file system;
an installation server configured to store an installation image; and
a client configured to:
connect to the DHCP server to obtain the client configuration information,
connect to boot server using the client configuration information to obtain the wanboot binary,
execute the wanboot binary to connect to the boot server to obtain the boot file system, wherein the boot file system comprises a kernel,
load, by the wanboot binary, the kernel on the client, wherein the kernel is configured to install an installation image on the client,
execute the kernel to connect to the installation server to obtain the installation image, and
execute the kernel to install the installation image on the client,
wherein the DHCP server is located on any one of the plurality of nodes,
wherein the boot server is located on any one of the plurality of nodes,
wherein the installation server is located on any one of the plurality of nodes, and
wherein the client server is located on any one of the plurality of nodes.