Microsoft Technology Licensing, LLC

Gregory J Zavertnik

Soumya Jain

Vimalraj Vasudevan Thekkoot

Vishwajit Tumkur Mahalingappa

Karthikeyan Nagarathinam

Sampath Kumar Victor

Varsha Jagdale

Rochak Chadha

Cheng-Yi Hung

Techniques are described herein in which boot firmware validated by secure flash memory validates read-only portions of firmware stored by the firmware or a downloaded image of the read-only portions. The secure flash memory validates a portion of the firmware, which includes the boot firmware and a reference hash of the read-only portions, by comparing a calculated hash of the portion and the reference hash of the portion. The boot firmware initiates a boot of the firmware and validates the read-only portions (or the downloaded image of the read-only portions) by comparing a calculated hash of the read-only portions (or a calculated hash of the downloaded image) and the reference hash of the read-only portions. The boot firmware completes the boot of the firmware based at least on the read-only portions (or the downloaded image) being validated.

Validating read-only portions of firmware or a downloaded image thereof by boot firmware validated by secure flash memory

One example provides a method for authenticating a computing device received from a manufacturer, the method including establishing a secured connection with the computing device, receiving, from the computing device, a first set of security artifacts, and retrieving, from a secure cloud storage location, a second set of security artifacts, the second set of security artifacts including the EK public key and the PCR values for the computing device obtained during manufacturing. The method further comprises, when the first set of security artifacts matches the second set of security artifacts, then verifying the computing device as trusted and permitting communication between the computing device and a secured computing environment, and when the first set of security artifacts does not match the second set of security artifacts, then not verifying the computing device as trusted and not permitting communication between the computing device and the secured computing environment.

Verifying a computing device after transport

Growing community of inventors

Mountain House, CA, United States of America

Gregory J Zavertnik