Securely recovering a computing device
A method and an apparatus for establishing an operating environment by certifying a code image received from a host over a communication link are described. The code image may be digitally signed through a central authority server. Certification of the code image may be determined by a fingerprint embedded within a secure storage area such as a read only memory (ROM) of the portable device based on a public key certification process. A certified code image may be assigned a hash signature to be stored in a storage of the portable device. An operating environment of the portable device may be established after executing the certified code.
1. A method, comprising:
by a computing device:
loading, from a first storage of the computing device, a code image digitally signed by a signature into a second storage of the computing device;
determining if the code image is certified by verifying the signature using a fingerprint embedded within a read only memory (ROM) of the device; and
executing the code image when the code image is certified to establish an operating environment of the computing device; and
entering a Device Firmware Upgrade (DFU) mode when the code image is not certified to establish the operating environment of the computing device, wherein the DFU mode performs system management tasks for the computing device.
2. The method of claim 1 , further comprising:
prior to entering the DFU mode, removing the code image from the second storage of the computing device.
3. The method of claim 1 , wherein the executing the code image comprises:
determining if the code image matches the signature based on a public key compatible with X.509 standard; and
determining if the fingerprint matches the public key, wherein the fingerprint is based on a hash value of the public key.
4. The method of claim 3 , further comprising:
deriving a hash value based on the code image; and
encrypting the hash value into a header value based on a key stored in the ROM of the computing device.
5. The method of claim 1 , further comprising:
when the code image is certified, verifying that an operating system component is trusted before executing the operating system component in the second storage.
6. The method of claim 1 , wherein the first storage and the second storage are separate memory devices.
7. A machine-readable non-transitory storage medium storing instructions that when executed by a processor in a computing device cause the computing device to perform:
loading, from a first storage of the computing device, a code image digitally signed by a signature into a second storage of the computing device;
determining if the code image is certified by verifying the signature using a fingerprint embedded within a read only memory (ROM) of the computing device; and
executing the code image if the code image is certified to establish an operating environment of the computing device; and
entering an upgrade mode if the code image is not certified to establish the operating environment of the computing device, wherein the upgrade mode performs system management tasks for the computing device.
8. The machine-readable non-transitory storage medium of claim 7 , further comprising:
prior to entering the upgrade mode, removing the code image from the second storage of the computing device.
9. The machine-readable non-transitory storage medium of claim 7 , further comprising:
determining if the code image matches the signature based on a public key compatible with X.509 standard; and
determining if the fingerprint matches the public key, wherein the fingerprint is based on a hash value of the public key.
10. The machine-readable non-transitory storage medium of claim 9 , further comprising:
deriving a hash value based on the code image; and
encrypting the hash value into a header value based on a key stored in the ROM of the computing device.
11. The machine-readable non-transitory storage medium of claim 9 , further comprising:
when the code image is certified, verifying that an operating system component is trusted before executing the operating system component in the second storage.
12. The machine-readable non-transitory storage medium of claim 7 , wherein the first storage and the second storage are separate memory devices.
13. A computing device, comprising:
a processor; and
a memory storing instruction that when executed by the processor cause the computing device to carry out:
loading, from a first storage of the computing device, a code image digitally signed by a signature into a second storage of the computing device;
determining if the code image is certified by verifying the signature using a fingerprint embedded within a read only memory (ROM) of the computing device;
executing the code image if the code image is certified to establish an operating environment of the computing device; and
entering a Device Firmware Upgrade (DFU) mode if the code image is not certified to establish the operating environment of the computing device, wherein the DFU mode performs system management tasks for the computing device.
14. The computing device of claim 13 , wherein the ROM (read only memory) of the computing device is a secure ROM associated with a UID (Unique Identifier) of the computing device.
15. The computing device of claim 13 , further comprising:
prior to entering the DFU mode, removing the code image from the second storage of the computing device.
16. The computing device of claim 13 , wherein the processor verifies the code image by determining if the code image matches the signature based on a public key compatible with X.509 standard, and determining if the fingerprint matches the public key, wherein the fingerprint is based on a hash value of the public key.
17. The computing device of claim 16 , wherein the processor derives a hash value based on the code image and encrypts the hash value into a header value based on a key stored in the ROM of the computing device.
18. The computing device of claim 13 , further comprising:
when the code image is certified, verifying that an operating system component is trusted before executing the operating system component in the second storage.
19. The computing device of claim 18 , wherein the operating system component is a user application, library, graphical user interface component, or user data.
20. The computing device of claim 13 , wherein the first storage and the second storage are separate memory devices.