Secure live media boot system

1. A secure live media boot system, comprising:

a storage subsystem;

a Trusted Platform Module (TPM);

a non-volatile memory system that is separate from the storage subsystem and that is included in a Trusted Platform Module (TPM);

at least one external device connector; and

a Basic Input/Output System (BIOS) that is coupled to the at least one external device connector, the storage subsystem, and the TPM, wherein the BIOS is configured to:

receive, during a BIOS boot process, an operating system image from an external device that is coupled to the external device connector and, in response, perform, during the BIOS boot process, a first measurement action on the operating system image prior to performing an installation of an operating system associated with the operating system image on a computing device that includes the BIOS, wherein the performance of the first measurement action produces a first operating system image measurement;

provide, during the BIOS boot process, the first operating system image measurement to the TPM, wherein the TPM is configured to encrypt and store the first operating system measurement in the non-volatile memory system;

store, during the BIOS boot process, the operating system image as a read-only operating system image on the storage subsystem;

receive a request to install the operating system provided by the operating system image on the computing device subsequent to storing the first operating system image measurement in the non-volatile memory system and, in response, perform a second measurement action on the operating system image stored as a read-only operating system image on the storage subsystem in order to produce a second operating system measurement; and

determine that the second operating system measurement matches the first operating system measurement and, in response, perform an installation of the operating system associated with the operating system image on the computing device.

2. The system of claim 1 , wherein the non-volatile memory system is included in the BIOS.

3. The system of claim 1 , wherein each of the first measurement action and the second measurement action are performed on all of a plurality of data that provides the operating system image.

4. The system of claim 1 , wherein the BIOS is configured to:

encrypt the read-only operating system image that is stored on the storage subsystem, wherein the performing the installation of the operating system associated with the operating system image on the computing device includes decrypting the read-only operating system image.

5. The system of claim 1 , wherein the TPM includes a cryptoprocessor that is configured to encrypt the first operating system measurement with a key.

6. The system of claim 1 , wherein the BIOS is configured to perform the installation of the operating system associated with the operating system image on the computing device by:

creating a Random Access Memory (RAM) drive;

copying the operating system image from the storage subsystem to the RAM drive;

disabling at least a portion of the storage subsystem and the at least one external device connector from accessing at least one component in the computing device; and

installing the operating system associated with the operating system image on the computing device using the operating system image that was copied to the RAM drive.

7. An Information Handling System (IHS), comprising:

a mass storage device;

a Trusted Platform Module (TPM);

a non-volatile memory subsystem that is separate from the mass storage device and that is included in the TPM;

an external device connector; and

a Basic Input/Output System (BIOS) that is coupled to the mass storage device, the TPM, and the external device connector, wherein the BIOS is configured to:

receive, during a BIOS boot process, an operating system image from an external device that is coupled to the external device connector and, in response, perform, during the BIOS boot process, a first measurement action on the operating system image prior to performing an installation of an operating system associated with the operating system image to produce a first operating system image measurement;

provide, during the BIOS boot process, the first operating system image measurement to the TPM, wherein the TPM is configured to encrypt and store the first operating system measurement in the non-volatile memory subsystem;

store, during the BIOS boot process, the operating system image as a read-only operating system image on the mass storage device;

receive a request to install the operating system provided by the operating system image subsequent to storing the first operating system image measurement in the non-volatile memory subsystem and, in response, perform a second measurement action on the operating system image in order to produce a second operating system measurement; and

determine that the second operating system measurement matches the first operating system measurement and, in response, perform an installation of the operating system associated with the operating system image.

8. The IHS of claim 7 , wherein the non-volatile memory subsystem is included in the BIOS.

9. The IHS of claim 7 , wherein each of the first measurement action and the second measurement action are performed on all of a plurality of data that provides the operating system image.

10. The IHS of claim 7 , wherein the BIOS is configured to:

encrypt the read-only operating system image that is stored on the mass storage device, wherein the performing the installation of the operating system associated with the operating system image includes decrypting the read-only operating system image.

11. The IHS of claim 7 , wherein the TPM includes a cryptoprocessor that is configured to encrypt the first operating system measurement with a key.

12. The IHS of claim 7 , wherein the BIOS is configured to perform the installation of the operating system associated with the operating system image by:

creating a Random Access Memory (RAM) drive;

copying the operating system image from the mass storage device to the RAM drive;

disabling the mass storage device and the external device connector; and

installing the operating system associated with the operating system image using the operating system image that was copied to the RAM drive.

13. The IHS of claim 7 , wherein the BIOS is provided by a Unified Extensible Firmware Interface (UEFI).

14. A method for providing secure live media booting, comprising:

receiving, during a Basic Input/Output System (BIOS) boot process by a BIOS through at least one external device connector, an operating system image and, in response, performing, by the BIOS during the BIOS boot process and prior to performing an installation of an operating system associated with the operating system image on a computing device, a first measurement action on the operating system image to produce a first operating system image measurement;

providing, by the BIOS during the BIOS boot process, the first operating system image measurement to a Trusted Platform Module (TPM), wherein the TPM is configured to encrypt and store the first operating system measurement in a non-volatile memory subsystem that is included in the TPM;

storing, by the BIOS during the BIOS boot process, the operating system image as a read-only operating system image on a storage subsystem that is separate from the non-volatile memory subsystem;

receiving, by the BIOS from an input device on the computing device subsequent to storing the first operating system image measurement in the non-volatile memory subsystem, a request to install the operating system provided by the operating system image and, in response, performing a second measurement action on the operating system image in order to produce a second operating system measurement; and

determining, by the BIOS, that the second operating system measurement matches the first operating system measurement and, in response, performing an installation of the operating system associated with the operating system image on the computing device.

15. The method of claim 14 , wherein the non-volatile memory subsystem is included in the BIOS.

16. The method of claim 14 , wherein each of the first measurement action and the second measurement action are performed on all of a plurality of data that provides the operating system image.

17. The method of claim 14 , further comprising:

encrypting, by the BIOS, the read-only operating system image that is stored on the storage subsystem, wherein the performing the installation of the operating system associated with the operating system image on the computing device includes decrypting the read-only operating system image.

18. The method of claim 14 , wherein the TPM includes a cryptoprocessor that is configured to encrypt the first operating system measurement with a key.

19. The method of claim 14 , wherein the performing the installation of the operating system associated with the operating system image on the computing device includes:

creating, by the BIOS, a Random Access Memory (RAM) drive;

copying, by the BIOS, the operating system image from the storage subsystem to the RAM drive;

disabling, by the BIOS, at least a portion of the storage subsystem and the at least one external device connector from accessing at least one component in the computing device; and

installing, by the BIOS, the operating system associated with the operating system image on the computing device using the operating system image that was copied to the RAM drive.

20. The method of claim 14 , wherein the BIOS is provided by a Unified Extensible Firmware Interface (UEFI).