Patent ID: 8127146
Filing Date: 2012-02-28
Classification: G06F

Abstract:
1. A method of booting an untrusted computing device comprising a trusted platform module, the method comprising the steps of: requesting, from the trusted platform module, a first certificate comprising a first key, the first certificate being signed by a certificate authority acting as a root of trust anchor; obtaining, from a memory of the untrusted computing device, an unencrypted log listing all computer-executable instructions then executed on the untrusted computing device and all modules then loaded on the untrusted computing device; providing, prior to the execution of an operating system on the untrusted computing device, the first certificate and the unencrypted log to a trusted peripheral device communicationally coupled to the untrusted computing device, the trusted peripheral device being portable by a user of the untrusted computing device; receiving, from the trusted peripheral device, a first set of encrypted data encrypted with the first key, the first set of encrypted data comprising a second key utilizable to decrypt an encrypted volume that comprises the operating system and at least one value expected by the trusted peripheral device to be stored within at least one platform configuration register of the trusted platform module given the unencrypted log; providing the first set of encrypted data to the trusted platform module; receiving, from the trusted platform module, the second key only if the at least one value expected to be stored within the at least one platform configuration register of the trusted platform module is, in fact, stored within the at least one platform configuration register of the trusted platform module; decrypting, using the second key, the encrypted volume on the untrusted computing device prior to the execution of the operating system on the untrusted computing device; and executing the operating system on the untrusted computing device from the decrypted encrypted volume.