Systems and methods for automatic boot to authenticated external device
An information handling system may include a processor, an external port communicatively coupled to the processor and configured to receive an external information handling resource and couple the external information handling resource to the processor, and a basic input/output system comprising a program of instructions executable by the processor. The program of instructions may be configured to cause the processor to: (i) determine if the external information handling resource coupled via the external port has a signed payload manifest stored thereon, the signed payload manifest comprising information regarding files of a bootable payload stored on the external information handling resource; (ii) if the external information handling resource has a signed payload manifest stored thereon, attempt to authenticate the signed payload manifest; (iii) if the signed payload manifest is authenticated, attempt to verify the files of the bootable payload based on the information with the signed payload manifest regarding files of the bootable payload; (iv) if the files of the bootable payload are verified, attempt to verify a bootable image of the bootable payload; and (v) if the bootable image is verified, cause the information handling system to boot from the bootable payload.
1. An information handling system comprising:
a processor;
an external port communicatively coupled to the processor and configured to receive an external information handling resource and couple the external information handling resource to the processor; and
a basic input/output system comprising a program of instructions executable by the processor and configured to cause the processor to:
determine if the external information handling resource coupled via the external port has a bootable payload and a signed payload manifest stored thereon, the signed payload manifest comprising:
a payload manifest signature;
information regarding one or more key files of the bootable payload; and
signatures for each of the one or more key files of the bootable payload;
if the external information handling resource has a signed payload manifest stored thereon, attempt to authenticate the signed payload manifest based on the payload manifest signature;
if the signed payload manifest is authenticated, attempt to verify the one or more key files of the bootable payload based on the signatures for each of the one or more key files of the bootable payload;
if the files of the bootable payload are verified, attempt to verify an external boot agent; and
if the external boot agent is verified, cause the information handling system to boot from the bootable payload.
2. The information handling system of claim 1 , wherein the external information handling resource is an external storage resource.
3. The information handling system of claim 1 , wherein:
the signed payload manifest is signed with a private cryptographic key; and
attempting to authenticate the signed payload manifest comprises authenticating the signed payload manifest using a public cryptographic key stored upon or otherwise accessible to the basic input/output system.
4. The information handling system of claim 1 , wherein:
information regarding files of a bootable payload stored on the external information handling resource comprises cryptographic signatures of the files; and
attempting to verify the files of the bootable payload comprises determining if the files within the bootable payload match the cryptographic signatures of the files.
5. The information handling system of claim 1 , wherein the bootable payload comprises a program of instructions for recovering an operating system of the information handling system.
6. The information handling system of claim 1 , wherein the bootable payload comprises an update package for the basic input/output system.
7. The information handling system of claim 1 , wherein the bootable payload comprises an automated and uninterruptable process.
8. A method comprising:
determining, with a basic input/output system of an information handling system, if an external information handling resource coupled to the information handling system via an external port of the information handling system has a bootable payload and a signed payload manifest stored thereon, the signed payload manifest comprising:
a payload manifest signature;
information regarding files one or more key files of the bootable payload; and
signatures for each of the one or more key files of the bootable payload;
if the external information handling resource has a signed payload manifest stored thereon, attempting, with the basic input/output system, to authenticate the signed payload manifest;
if the signed payload manifest is authenticated, attempting to verify, with the basic input/output system, the one or more key files of the bootable payload based on the signatures for each of the one or more key files of the bootable payload;
if the files of the bootable payload are verified, attempting to verify, with the basic input/output system, an external boot agent; and
if the external boot agent is verified, cause the information handling system to boot from the bootable payload.
9. The method of claim 8 , wherein the external information handling resource is an external storage resource.
10. The method of claim 8 , wherein:
the signed payload manifest is signed with a private cryptographic key; and
attempting to authenticate the signed payload manifest comprises authenticating the signed payload manifest using a public cryptographic key stored upon or otherwise accessible to the basic input/output system.
11. The method of claim 8 , wherein:
information regarding files of a bootable payload stored on the external information handling resource comprises cryptographic signatures of the files; and
attempting to verify the files of the bootable payload comprises determining if the files within the bootable payload match the cryptographic signatures of the files.
12. The method of claim 8 , wherein the bootable payload comprises a program of instructions for recovering an operating system of the information handling system.
13. The method of claim 8 , wherein the bootable payload comprises an update package for the basic input/output system.
14. The method of claim 8 , wherein the bootable payload comprises an automated and uninterruptable process.
15. An article of manufacture comprising:
a non-transitory computer readable medium; and
computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
determine, with a basic input/output system of an information handling system, if an external information handling resource coupled to the information handling system via an external port of the information handling system has a bootable payload and a signed payload manifest stored thereon, the signed payload manifest comprising;
a payload manifest signature;
information regarding one or more key files of the bootable payload stored on the external information handling resource; and
signatures for each of the one or more key files of the bootable payload;
if the external information handling resource has a signed payload manifest stored thereon, attempt, with the basic input/output system, to authenticate the signed payload manifest based on the payload manifest signature;
if the signed payload manifest is authenticated, attempt to verify, with the basic input/output system, the files of the bootable payload based on the signatures for each of the one or more key files of the bootable payload;
if the files of the bootable payload are verified, attempt to verify, with the basic input/output system, an external boot agent; and
if the external boot agent is verified, cause the information handling system to boot from the bootable payload.
16. The article of claim 15 , wherein the external information handling resource is an external storage resource.
17. The article of claim 15 , wherein:
the signed payload manifest is signed with a private cryptographic key; and
attempting to authenticate the signed payload manifest comprises authenticating the signed payload manifest using a public cryptographic key stored upon or otherwise accessible to the basic input/output system.
18. The article of claim 15 , wherein:
information regarding files of a bootable payload stored on the external information handling resource comprises cryptographic signatures of the files; and
attempting to verify the files of the bootable payload comprises determining if the files within the bootable payload match the cryptographic signatures of the files.
19. The article of claim 15 , wherein the bootable payload comprises a program of instructions for recovering an operating system of the information handling system.
20. The article of claim 15 , wherein the bootable payload comprises an update package for the basic input/output system.
21. The article of claim 15 , wherein the bootable payload comprises an automated and uninterruptable process.