Authenticating software using protected master key
View Patent ↗A processing unit includes a read-only encryption key. Software is loaded into a system memory area from a non-volatile storage device. Software code image that resides in the system storage area includes a prefix value and a suffix value. The prefix value is combined with the master key from the processing unit to create a random value that is the seed for a hashing algorithm. The hashing algorithm uses the seed value with a signature formed from the blocks of code to form a result. Finally, after the last block has been processed, a final result remains. The suffix value is combined with the master key, this hash result is compared with the result that was created using the hashing algorithm on the code. If the two results match, the code is authenticated and is executed. If the results do not match, the code is not loaded.
1. An information handling system comprising:
a semiconductor package that includes one or more processors, a first memory area, and a locked nonvolatile memory, wherein the locked nonvolatile memory includes a key value and wherein the locked nonvolatile memory is inaccessible from outside the semiconductor package;
a system memory interconnected to the processors with a bus; and
a software loader for authenticating and loading software, the software loader located within the semiconductor package, wherein the software loader performs steps comprising:
reading a software image from the first memory area, wherein the software image comprises a prefix value, a plurality of blocks of software code, and a suffix value;
reading the key value from the locked nonvolatile memory;
generating a seed value using the prefix value and the key value;
seeding a hashing algorithm with the seed value;
reading the first block of software code;
hashing the first block of software code using the seed value, the hashing resulting in an updated seed value;
processing each remaining block of software code, wherein the processing comprises:
reading a next block of software code;
hashing the next block of software code using the updated seed value, the hashing resulting in a hash value; and
setting the updated seed value equal to the hash value;
after all blocks of software code have been processed, performing the following:
generating an expected hash value using the suffix value and the key value;
authenticating the software program based upon the expected hash value and the hash value;
in response to the expected hash value being equal to the hash value, loading the software program; and
executing the loaded software program.
2. The information handling system of claim 1 wherein the generating the seed value further comprises performing an exclusive OR operation between the prefix value and the key value.
3. The information handling system of claim 1 wherein the generating the expected hash value further comprises performing an exclusive OR operation between the suffix value and the key value.
4. The information handling system of claim 1 wherein the locked nonvolatile memory is an array of programmable fuses.
5. A computer program product stored on a computer storage media, the computer storage media containing instructions for execution by a computer, which, when executed by the computer, cause the computer to implement a method for loading a software program, the method comprising:
reading a software image from a first memory area, wherein the software image comprises a prefix value, a plurality of blocks of software code, and a suffix value;
reading a key value from a second memory area, wherein the second memory area is located in an area inaccessible to a user;
generating a seed value using the prefix value and the key value;
seeding a hashing algorithm with the seed value;
reading the first block of software code;
hashing the first block of software code using the seed value, the hashing resulting in an updated seed value;
processing each remaining block of software code, wherein the processing comprises:
reading a next block of software code;
hashing the next block of software code using the updated seed value, the hashing resulting in a hash value; and
setting the updated seed value equal to the hash value;
after all blocks of software code have been processed, performing the following:
generating an expected hash value using the suffix value and the key value;
authenticating the software program based upon the expected hash value and the hash value;
in response to the expected hash value being equal to the hash value, loading the software program; and
executing the loaded software program.
6. The computer program product of claim 5 wherein the loading is performed by a processor and wherein the processor and the second memory area are located in a common semiconductor package.
7. The computer program product of claim 5 wherein the second memory area and a processor that performs the reading, generating, and hashing steps are located in a common semiconductor package.
8. The computer program product of claim 5 wherein the generating the seed value further comprises performing an exclusive OR operation between the prefix value and the key value.
9. The computer program product of claim 5 wherein the generating the expected hash value further comprises performing an exclusive OR operation between the suffix value and the key value.
10. The computer program product of claim 5 wherein the second memory area is a locked nonvolatile storage area included in a semiconductor package, the semiconductor package also including one or more processors.
11. The computer program product of claim 10 wherein the locked nonvolatile storage area is an array of programmable fuses.