System method for fractional secure boot by validating secure enclave using instructions of pre-drivers stored in memory by manufacturer
Disclosed are systems, apparatuses, methods, and computer-readable media for configuring network groups without software-based processing and management. A method includes: validating veracity of a secure enclave based on a secure identify of the secure enclave using the instructions of a secure enclave predriver stored in a memory integral to a processor; establishing a secure connection with the secure enclave; retrieving at least one authentication key from the secure enclave; retrieving at least a portion of a bootstrapper from a secure storage based on the instructions of the secure enclave predriver; validating a veracity of the bootstrapper based on the at least one authentication key; initializing an external memory using the instructions of the bootstrapper; copying a bootloader from the secure storage into the external memory; validating a veracity of the bootloader based on the at least one authentication key; and executing the bootloader.
1. A method for securely configuring a booting operation, comprising:
validating veracity of a secure enclave based on a secure identifier of the secure enclave using instructions of a secure enclave predriver stored in a memory integral to a processor;
establishing a secure connection with the secure enclave based on the veracity of the secure enclave using the instructions of the secure enclave predriver;
retrieving at least one authentication key from the secure enclave based on the instructions of the secure enclave predriver;
retrieving at least a portion of a bootstrapper from a secure storage based on the instructions of the secure enclave predriver;
validating a veracity of the bootstrapper based on the at least one authentication key;
initializing an external memory using the instructions of the bootstrapper, wherein the external memory is connected to the processor;
copying a bootloader from the secure storage into the external memory based on the instructions in the bootstrapper or the secure enclave predriver;
validating a veracity of the bootloader based on the at least one authentication key;
clearing the at least one authentication key from the memory of the processor; and
executing the bootloader to load a least a portion of an operating system into the external memory.
2. The method of claim 1 , wherein a different processor is configured to execute the bootloader.
3. The method of claim 1 , wherein the memory comprises a first memory and a second memory.
4. The method of claim 3 , wherein the bootstrapper comprises a first portion and a second portion, and
wherein the first portion of the bootstrapper is loaded into the first memory of the processor, and the second portion of the bootstrapper is loaded in the second memory of the processor, and wherein the second portion of the bootstrapper includes instruction to initialize the external memory.
5. The method of claim 4 , wherein the at least one authentication key is loaded into a third memory of the processor.
6. The method of claim 4 , wherein the first portion of the bootstrapper is validated with a first key in the at least one authentication key and the second portion of the bootstrapper is validated with a second authentication key.
7. The method of claim 6 , wherein the second authentication key is loaded after validation of at the first portion of the bootstrapper.
8. The method of claim 4 , wherein the first portion of the bootstrapper and the second portion of the bootstrapper are loaded into the second memory of the processor, and the secure enclave predriver is loaded into the first memory of the processor.
9. The method of claim 3 , further comprising:
in response to validating the veracity of the bootstrapper, removing the secure enclave predriver from the first memory.
10. The method of claim 1 , wherein the at least one authentication key includes a first key associated with the bootstrapper and a second key associated with the bootloader is stored in a separate memory associated with a secure register.
11. A system on chip (SoC), comprising:
a processor including a memory integral to the processor and configured to execute instructions and cause the processor to:
validate veracity of a secure enclave based on a secure identifier of the secure enclave using the instructions of a secure enclave predriver stored in a memory integral to the processor;
establish a secure connection with the secure enclave based on the veracity of the secure enclave using instructions of the secure enclave predriver;
retrieve at least one authentication key from the secure enclave based on the instructions of the secure enclave predriver;
retrieve at least a portion of a bootstrapper from a secure storage based on the instructions of the secure enclave predriver;
validate a veracity of the bootstrapper based on the at least one authentication key;
initialize an external memory using the instructions of the bootstrapper, wherein the external memory is connected to the processor;
copy a bootloader from the secure storage into the external memory based on the instructions in the bootstrapper or the secure enclave predriver;
validate a veracity of the bootloader based on the at least one authentication key;
clear the at least one authentication key from the memory of the processor; and
execute the bootloader to load a least a portion of an operating system into the external memory.
12. The SoC of claim 11 , wherein a different processor is configured to execute the bootloader.
13. The SoC of claim 11 , wherein the memory comprises a first memory and a second memory.
14. The SoC of claim 13 , wherein the bootstrapper comprises a first portion and a second portion, and wherein the first portion of the bootstrapper is loaded into the first memory of the processor, and the second portion of the bootstrapper is loaded in the second memory of the processor, and wherein the second portion of the bootstrapper includes instruction to initialize the external memory.
15. The SoC of claim 14 , wherein the at least one authentication key is loaded into a third memory of the processor.
16. The SoC of claim 14 , wherein the first portion of the bootstrapper is validated with a first key in the at least one authentication key and the second portion of the bootstrapper is validated with a second authentication key.
17. The SoC of claim 16 , wherein the second authentication key is loaded after validation of at the first portion of the bootstrapper.
18. The SoC of claim 14 , wherein the first portion of the bootstrapper and the second portion of the bootstrapper are loaded into the second memory of the processor, and the secure enclave predriver is loaded into the first memory of the processor.
19. The SoC of claim 13 , wherein the processor is configured to execute the instructions and cause the processor to:
in response to validating the veracity of the bootstrapper, remove the secure enclave predriver from the first memory.
20. The SoC of claim 11 , wherein the at least one authentication key includes a first key associated with the bootstrapper and a second key associated with the bootloader is stored in a separate memory associated with a secure register.