Granted Patent B2

US 10,705,855 · App. 15/826,281 · Granted Jul 7, 2020

Inventors: Mickey J. Malone, II (Rowlett, TX); Jacob Minnis (Plano, TX)

Assignee: FORCEPOINT LLC

G06F9/44505G06F21/51G06F21/575H04L9/3236H04L9/3247

Abstract

Claims (44)

1. A system for configuring an information computing machine during execution of a kernel image and an initial file system, the system comprising:

a storage resource;

a processor communicatively coupled to the storage resource, wherein the processor executes application code instruction that are stored in the storage resource to cause the system to:

create a file system from a base file system image in system memory of the information computing system;

apply binary and configuration files from a bundle image to the file system in memory;

copy files from a persistent file system stored in the storage resource to memory;

validate the files from the persistent file system;

apply validated files to the file system in memory; and

verify the bundle image by comparing a signed hash of the image with a hash generated by the initial file system and checking the hash signature against a public certificate included in the initial filesystem, wherein the initial filesystem includes a memory file system module, a base file system image and the bundle image, wherein the bundle image is further verified by determining if the hash has been signed by an administrator and validated against a white list.

2. The system of claim 1 further comprising application code instruction to cause the system to:

verify the base file system image by comparing a signed hash of the image that includes a plurality of digital signatures with a hash generated by the initial file system and checking the plurality of digital signatures against public certificates included in the initial filesystem.

3. The system of claim 1 wherein the base file system image can be retrieved from a local storage resource or from a remote storage resource.

4. The system of claim 1 wherein the bundle image can be retrieved from a local storage resource or from a remote storage resource.

5. The system of claim 1 further comprising application code instruction to cause the system to:

execute /sbin/init; and

start services.

6. A computer aided method of a system for configuring an information computing system during execution of a kernel image and an initial file system, the method comprising:

creating a file system from a base file system image in system memory of the information computing system;

applying configuration files from a bundle image to the file system in memory;

copying files from a persistent file system stored in the storage resource to memory;

validating the files from the persistent file system;

applying validated files to the file system in memory; and

verifying the bundle image by comparing a signed hash of the image with a hash generated by the initial file system and checking the hash signature against a public certificate included in the initial filesystem, wherein the initial filesystem includes a memory file system module, a base file system image and the bundle image, wherein the bundle image is further verified by determining if the hash has been signed by an administrator and validated against a white list.

7. The method of claim 6 further comprising:

verifying the base file system image by comparing a signed hash of the image with a hash generated by the initial file system and checking the hash signature against a public certificate included in the initial filesystem.

8. The method of claim 6 further comprising retrieving the base file system image from a local storage resource or from a remote storage resource.

9. The method of claim 6 further comprising retrieving the bundle image from a local storage resource or from a remote storage resource.

10. The method of claim 6 further comprising:

executing /sbin/init; and

starting services.

11. A non-transitory computer readable medium containing computer readable instructions for configuring an information computing machine, the computer-readable instructions comprising instructions for causing the computing machine to:

create a file system from a base file system image in system memory of the information computing system;

apply configuration files from a bundle image to the file system in memory;

copy files from a persistent file system stored in the storage resource to memory;

validate the files from the persistent file system;

apply validated files to the file system in memory; and

verify the bundle image by comparing a signed hash of the image with a hash generated by the initial file system and checking the hash signature against a public certificate included in the initial filesystem, wherein the initial filesystem includes a memory file system module, a base file system image and the bundle image, wherein the bundle image is further verified by determining if the hash has been signed by an administrator and validating the bundle image against a white list.

12. The non-transitory computer readable medium of claim 11 further includes computer readable instruction to cause the computing machine to:

verify the base file system image by comparing a signed hash of the image with a hash generated by the initial file system and checking the hash signature against a public certificate included in the initial filesystem.

13. The non-transitory computer readable medium of claim 11 wherein the base file system image can be retrieved from a local storage resource or from a remote storage resource.

14. The non-transitory computer readable medium of claim 11 wherein the bundle image can be retrieved from a local storage resource or from a remote storage resource.

15. The non-transitory computer readable medium of claim 11 further includes computer readable instruction to cause the computing machine to:

execute /sbin/init; and

start services.

Assignments (11)