Granted Patent B2

US 10,733,300 · App. 15/791,625 · Granted Aug 4, 2020

Inventor: Brian Steven Wotherspoon (Fife, GB)

Assignee: NCR Corporation

G06F21/575G06F9/4401G06F21/44G06Q20/1085

Abstract

Claims (34)

1. A method, comprising:

detecting, during a boot of a device, a Hard Disk Drive (HDD) or a Solid State Drive (SSD) attached to the device;

obtaining a signed identifier in a storage location of the HDD or the SSD;

determining whether to finish boot processing for the boot based at least in part on verifying the signed identifier;

writing a universally unique identifier (UUID) for a Basic Input/Output System (BIOS) or a Unified Extensible Firmware Interface (UEFI) that represents an executing instance of the method and an identifier for the HDD or the SSD as a UUID-HDD/SSD identifier pair on the HDD or the SSD when the signed identifier is verified; and

verifying, during a subsequent boot of the device, that the UUID-HDD/SSD identifier pair obtained from the HDD or the SSD matches the UUID for the BIOS or the UEFI and the identifier for the HDD or the SSD ensuring the HDD or the SSD is paired with the BIOS or the UEFI before permitting the subsequent boot of the device to process.

2. The method of claim 1 further comprising, updating a whitelist maintained on the device to include the identifier for the HDD or the SSD.

3. The method of claim 1 , wherein detecting further includes obtaining an identifier for the HDD or the SSD during boot communication with the peripheral.

4. The method of claim 3 , wherein obtaining further includes determining that the identifier for the HDD or the SSD is missing from a whitelist maintained on the device.

5. The method of claim 4 , wherein determining further includes determining a signed key is present in a device location of the device.

6. The method of claim 5 , wherein determining further includes processing a key portion of the signed key against the signed identifier for verifying a signature portion of the signed identifier.

7. The method of claim 6 , wherein processing further includes verifying an identifier portion of the signed identifier matches the identifier.

8. The method of claim 1 , wherein determining further includes verifying a signature portion of a signed key and obtaining a key associated with the signed key from a device location of the device.

9. The method of claim 8 , wherein verifying further includes processing the key for verifying a signature of the signed identifier.

10. The method of claim 1 further comprising, processing the method as one of: a Basic Input/Output System (BIOS) and a Unified Extensible Firmware Interface (UEFI) of the device.

11. A method, comprising:

initiating a Basic Input/Output System (BIOS)/Unified Extensible Firmware Interface (UEFI) on a Self-Service Terminal (SST) during a boot of the SST;

determining, by the BIOS/UEFI, that a hard disk identifier for an attached hard disk is missing from a whitelist;

obtaining, by the BIOS/UEFI, a key located on the SST;

acquiring, by the BIOS/UEFI, a signed identifier located on the hard disk;

verifying, by the BIOS/UEFI, a signature of the signed identifier using the key;

proceeding, by the BIOS/UEFI, with boot processing of SST when the signature is verified;

writing, by the BIOS/UEFI, a universally unique identifier (UUID) for the BIOS/UEFI and the hard disk identifier for the hard disk as a UUID-hard disk identifier pair to a hard disk location on the hard disk; and

verifying, during a subsequent boot of the SST, that the UUID-hard disk identifier pair obtained from the hard disk location matches the UUID for the BIOS/UEFI and the hard disk identifier for the hard disk ensuring the hard disk is paired with the BIOS/UEFI before permitting the subsequent boot of the SST to process.

12. The method of claim 11 further comprising, updating, by the BIOS/UEFI, the whitelist to include the hard disk identifier.

13. The method of claim 11 , wherein obtaining further includes verifying a second signature that is different from the signature when obtaining the key.

14. The method of claim 11 , wherein verifying further includes processing the key as a public key against the signed identifier to verify the signature.

15. The method of claim 14 , wherein processing further includes validating that an identifier portion of the signed identifier matches the hard disk identifier.

16. The method of claim 11 , wherein verifying further includes terminating the boot and preventing the SST from booting up when the signature is invalidated.

17. A Self-Service Terminal (SST), comprising:

a processor; and

a Basic Input/Output System (BIOS)/Unified Extensible Firmware Interface (UEFI) executed by the processor on a boot of the SST;

wherein the BIOS/UEFI is configured to: i) detect an identifier for a hard disk attached to the SST, ii) attempt to match the identifier to other identifiers in a whitelist located on the SST, iii) obtain a key located on the SST when the identifier is missing in the whitelist, iv) verify a signed identifier located on the hard disk when the key is obtained, v) permit the boot to continue for starting up the SST when the signed identifier is verified; vi) write a universally unique identifier (UUID) for the BIOS/UEFI and the identifier for the hard disk as a UUID-hard disk identifier pair to a hard disk location on the hard disk; and vii) verify, during a subsequent boot of the SST, that the UUID-hard disk identifier pair obtained from the hard disk location matches the UUID for the BIOS/UEFI and the identifier for the hard disk to ensure that the hard disk is paired with the BIOS/UEFI before permitting the subsequent boot of the SST to process.

18. The SST of claim 17 , wherein the SST is an ATM.

Assignments (10)

Continuity (1)