Patent Description:
When a case enclosing a computer system is detected to be tampered, a mechanism of case tampering of the computer system is applied to protect data of the computer system from being tampered. However, it is still unknown how the computer system fails a secure boot in a case tampering event when the computer system is powered off. Thus, failing the secure boot in the case tampering event of the computer system when the computer system is powered off is a problem to be solved.

<CIT> teaches a secure boot provided for a breakout system having multiple subsystems at the edge of a mobile data network. The secure boot utilizes two trusted platform modules to secure multiple subsystems. The first TPM is used to boot a service processor and the second TPM is used to secure boot two additional subsystems. Booting of the final subsystem is accomplished in a two-step process which first loads a boot loader and verifies the boot loader, and then second loads an operating system load image and verifies the operating system code.

The present invention therefore provides a method of failing a secure boot in a case tampering event of a computer system to solve the abovementioned problem.

This is achieved by a computer system for handling the secure boot according to the independent claim here below. The dependent claims pertain to corresponding further developments and improvements.

As will be seen more clearly from the detailed description following below, the claimed computer system for failing a secure boot in a case tampering event comprises a microcontroller unit (MCU); a trusted platform module (TPM), for generating a plurality of random bytes for a secure boot of the computer system, if the MCU does not comprise the plurality of random bytes; a bootloader, for storing information in the MCU and at least one hardware of the computer system and performing the secure boot, wherein the information comprises the plurality of random bytes, and the TPM is comprised in the bootloader; an operating system (OS), for performing the secure boot; and at least one sensor, coupled to the MCU, for detecting a case tampering event in the computer system, and transmitting a signal for triggering a deletion of the plurality of random bytes, if the case tampering event happens in the computer system. The MCU performs the operation of deleting the plurality of random bytes stored in the MCU and the at least one hardware according to a power supply, to fail the secure boot, in response to the signal transmitted by the at least one sensor.

<FIG> is a schematic diagram of a trusted platform module (TPM) <NUM> according to an example of the present invention. The TPM <NUM> is a passive hardware element which enhances security of a computer system, and is used to keep the computer system running well. The TPM <NUM> includes a cryptographic processor <NUM> and a storage device <NUM>. The cryptographic processor <NUM> includes a random byte generator <NUM>, a key generator <NUM>, a hash generator <NUM> and an encryption-decryption-signature engine <NUM>. The random byte generator <NUM> may generate random bytes for a secure boot. The random bytes may include numbers, alphabets, punctuations, or combination thereof. The key generator <NUM> may generate public keys for encryptions and private keys for decryptions. The hash generator <NUM> may generate hashes according to the random bytes generated by the random byte generator <NUM>. The encryption-decryption-signature engine <NUM> may manage the public keys and the private keys for signings and verifications. The storage device <NUM> may be used to store an endorsement key (EK), a storage root key (SRK), attestation identity keys (AIKs) and storage keys. In addition, the storage device <NUM> includes platform configuration registers (PCRs) <NUM>. The PCRs <NUM> stores the random bytes generated by the random byte generator <NUM>, and generates the hashes according to a cryptographic hash function and the random bytes. The hashes generated according to the cryptographic hash function may be drastically different even if the random bytes (i.e., inputs of the PCRs <NUM>) are similar.

The PCRs <NUM> may initiate different functions of the TPM <NUM> according to different hashes, and may establish a PCR policy for the TPM <NUM>. In a boot process, the TPM <NUM> may store information (e.g., a central processing unit (CPU) identity (ID), a media access control (MAC) address, a serial number, a product ID,. etc.) in the PCRs <NUM>, and the PCRs <NUM> may generate the hashes according to the above information. When the hashes are correct (i.e., the hashes generated by the PCRs <NUM> are the same as the hashes generated by the hash generator <NUM>, and the TPM <NUM> is able to function according to the hashes), the random bytes stored in the PCRs <NUM> may be acquired.

<FIG> is a schematic diagram of a computer system <NUM> according to an example of the present invention. The computer system <NUM> includes a bootloader <NUM>, an operating system (OS) <NUM>, at least one sensor <NUM> and a microcontroller unit (MCU) <NUM>. The bootloader <NUM> may be also called a basic input/output system (BIOS). The bootloader <NUM> performs hardware initialization in a power-on stage of the computer system <NUM>. The bootloader <NUM> includes a TPM <NUM>. The TPM <NUM> may be the TPM <NUM> described above, and is not narrated herein. The OS <NUM> manages hardware resource and software resource of the computer system <NUM>, and provides services for the computer system <NUM>. The OS <NUM> may be a Windows OS or a Linux OS, but is not limited thereto. The bootloader <NUM> and the OS <NUM> may apply asymmetric/symmetric keys for encryptions (e.g., using the public keys) and decryptions (e.g., using the private keys) to the entire computer system <NUM>. The at least one sensor <NUM> may be configured to detect incidents (e.g., case tampering events) and to notice the bootloader <NUM> and/or the OS <NUM> of the computer system <NUM>.

The MCU <NUM> may be coupled to the at least one sensor <NUM>, and may be equipped with a power supply. When the incidents (e.g., case tampering events) happen during a power failure of the computer system <NUM>, the power supply enables the at least one sensor <NUM> to detect the incidents. The MCU <NUM> may receive a signal from the at least one sensor <NUM>, and may perform corresponding operations even if the computer system <NUM> is powered off. In addition, the bootloader <NUM> may store the random bytes generated by a random byte generator of the TPM <NUM>, in the MCU <NUM>.

<FIG> is a flowchart of a process <NUM> according to an example of the present invention. The process <NUM> may be utilized in the computer system <NUM>, to detect a case tampering event. The process <NUM> may be complied into program codes and includes the following steps:.

According to the process <NUM>, when the secure boot is performed, whether the MCU <NUM> includes the plurality of random bytes may be checked (e.g., by the bootloader <NUM>). If the MCU <NUM> does not include the plurality of random bytes, the plurality of random bytes are generated by the TPM <NUM>. The bootloader <NUM> stores the information including the plurality of random bytes in the MCU and the at least one hardware. The at least one sensor <NUM> detects the case tampering event in the computer system <NUM>. If the case tampering event happens in the computer system <NUM>, the at least one sensor may transmit a signal for triggering the deletion of the plurality of random bytes. In a situation that the computer system <NUM> is powered off (or the computer system <NUM> encounters a power failure), the bootloader <NUM> and the OS <NUM> may not perform operations as usual. Accordingly, the MCU <NUM> may delete the plurality of random bytes stored in the MCU <NUM> and the at least one hardware according to (e.g., by using) the power supply, in response to the signal transmitted by the at least one sensor <NUM>. The secure boot may fail (e.g., not be finished) accordingly. In other words, the MCU <NUM> equipped with the power supply may be a replacement for the bootloader <NUM> or the OS <NUM>, if the case tampering event happens and the computer system <NUM> is powered off. The plurality of random bytes stored in the MCU <NUM> and the at least one hardware are deleted by the MCU <NUM> for a security of the computer system <NUM>.

In one example, the plurality of random bytes generated by the TPM <NUM> may not be known (e.g., acquired) by external users of the computer system <NUM>. Furthermore, even internal developers of the computer system <NUM> may not know (e.g., acquire) the plurality of random bytes. In other words, the plurality of random bytes can be acquired by neither the users nor the developers of the computer system <NUM>. This mechanism prevents the computer system <NUM> from being tampered. In addition, when the case tampering event happens, the MCU <NUM> may simply delete the plurality of random bytes stored in the MCU <NUM> and the at least one hardware. Information other than the plurality of random bytes may not be involved and may be maintained.

In one example, the bootloader <NUM> and the OS <NUM> perform the secure boot according to the information stored in the MCU <NUM> and the at least one hardware. That is, if the case tampering event does not happen during the process of the secure boot, the computer system <NUM> completes the secure boot as a general secure boot of the computer system <NUM>.

In one example, the MCU <NUM> scrambles the plurality of random bytes stored in the at least one hardware, if the case tampering event does not happens. That is, the secure boot is completed, and the plurality of random bytes stored in the at least one hardware are scrambled by the MCU <NUM> to prevent the OS <NUM> from acquiring the plurality of random bytes, if the case tampering event does not happen in the computer system <NUM>.

In one example, the at least one hardware of the computer system <NUM> includes a PCR. The PCR is included in the TPM <NUM>. The PCR generates a first plurality of hashes according to the plurality of random bytes. In one example, the secure boot of the computer system <NUM> may be completed, if the first plurality of hashes are correct. That is, if the plurality of random bytes are not deleted (i.e., the case tampering event does not happen), the first plurality of hashes are correct accordingly (i.e., the TPM <NUM> is able to function according to the first plurality of hashes). Thus, the TPM <NUM> is able to function, which leads to a completion of the secure boot. It should be noted that the OS <NUM> may be able to provide services for a user of the computer system <NUM>, after the secure boot is completed. In one example, the secure boot of the computer system <NUM> may fail, if the first plurality of hashes are incorrect. That is, if the plurality of random bytes have been deleted (e.g., have been tampered), the first plurality of hashes are incorrect accordingly (i.e., the TPM <NUM> is unable to function according to the first plurality of hashes). Thus, the TPM <NUM> is unable to function, and the computer system <NUM> may not be able to process into the OS <NUM>, which leads to a failure of the secure boot.

In one example, the bootloader <NUM> obtains the plurality of random bytes for the secure boot according to a password of the computer system <NUM> and the first plurality of hashes, after the secure boot fails. The bootloader <NUM> stores the plurality of random bytes in the MCU <NUM> and the at least one hardware, and resumes the secure boot according to the plurality of random bytes. That is, to resume the secure boot which fails due to the case tampering event, the plurality of random bytes are obtained from the TPM <NUM> if the first plurality of hashes generated by the PCR are correct. The computer system <NUM> identifies that the password (e.g., a BIOS password) is transmitted from the bootloader <NUM> to the PCR included in the TPM <NUM>, and allows the bootloader <NUM> to obtain the plurality of random bytes for the secure boot, from the TPM <NUM>. The computer system <NUM> may not allow the plurality of random bytes to be acquired, and the secure boot may not be resumed, if the computer system <NUM> identifies that the password is not transmitted from the bootloader <NUM> (e.g., transmitted from the OS <NUM>), or if the password is wrong to the PCR.

In one example, the MCU <NUM> communicates with the bootloader <NUM> (of the computer system <NUM>) according to the plurality of random bytes and a second plurality of hashes. That is, the OS <NUM> is not allowed to obtain the plurality of random bytes when the computer system <NUM> performs the secure boot. To prevent the OS <NUM> from acquiring the plurality of random bytes by means of a brute-force attack, the MCU <NUM> may use (e.g., part of) the plurality of random bytes and the second plurality of hashes when establishing a communication protocol with the bootloader <NUM>. In other words, the MCU <NUM> may distinguish between the bootloader <NUM> and the OS <NUM> according to an existence of the second plurality of hashes. In one example, the second plurality of hashes may be the same as the first plurality of hashes, and may include a plurality of SHA-<NUM> values. The plurality of SHA-<NUM> values may be generated by the PCR comprised in the TPM <NUM>, or may be generated by a software. The plurality of SHA-<NUM> values may be information for the bootloader <NUM> and the MCU <NUM> to communicate with each other. In one example, the plurality of SHA-<NUM> values may be generated simply by dividing a random byte in half, and the bootloader <NUM> and the MCU <NUM> ensure each other according to each of the plurality of SHA-<NUM> values.

<FIG> is a schematic diagram of a secure mode and a non-secure mode of a computer system according to an example of the present invention. In one example, the bootloader <NUM> transmits commands and hashes (e.g., the second plurality of hashes) to the MCU <NUM>. The MCU <NUM> may identify that the commands are transmitted from the bootloader <NUM> due to the existence of the hashes (e.g., the second plurality of hashes). The computer system <NUM> enters a secure mode, and all commands (e.g., including acquiring the plurality of random bytes) from the bootloader <NUM> are available. In one example, the OS <NUM> transmits commands to the MCU <NUM>. The MCU <NUM> may identify that the commands are transmitted from the OS <NUM> due to the lack of the hashes. The computer system <NUM> enters a non-secure mode, and only certain commands (e.g., not including acquiring the plurality of random bytes) from the OS <NUM> are available.

Those skilled in the art should readily make combinations, modifications and/or alterations on the abovementioned description and examples. The abovementioned description, steps and/or processes including suggested steps can be realized by means that could be hardware, software, firmware (known as a combination of a hardware device and computer instructions and data that reside as read-only software on the hardware device), an electronic system, or combination thereof. An example of the means may be the computer system <NUM>.

Examples of the hardware may include analog circuit(s), digital circuit(s) and/or mixed circuit(s). For example, the hardware may include ASIC(s), field programmable gate array(s) (FPGA(s)), programmable logic device(s), coupled hardware components or combination thereof. In another example, the hardware may include general-purpose processor(s), microprocessor(s), controller(s), digital signal processor(s) (DSP(s)) or combination thereof.

Examples of the software may include set(s) of codes, set(s) of instructions and/or set(s) of functions retained (e.g., stored) in a storage unit, e.g., a computer-readable medium. The computer-readable medium may include SIM, ROM, flash memory, RAM, CD-ROM/DVD-ROM/BD-ROM, magnetic tape, hard disk, optical data storage device, non-volatile storage unit, or combination thereof. The computer-readable medium (e.g., storage device) may be coupled to at least one processor internally (e.g., integrated) or externally (e.g., separated). The at least one processor which may include one or more modules may (e.g., be configured to) execute the software in the computer-readable medium. The set(s) of codes, the set(s) of instructions and/or the set(s) of functions may cause the at least one processor, the module(s), the hardware and/or the electronic system to perform the related steps.

Examples of the electronic system may include a system on chip (SoC), system in package (SiP), a computer on module (CoM), a computer program product, an apparatus, a mobile phone, a laptop, a tablet computer, an electronic book or a portable computer system, and the computer system <NUM>.

Claim 1:
A computer system (<NUM>) for failing a secure boot in a case tampering event, wherein the computer system (<NUM>) comprises:
a microcontroller unit (MCU) (<NUM>);
a trusted platform module (TPM) (<NUM>), for generating a plurality of random bytes for a secure boot of the computer system (<NUM>), if the MCU (<NUM>) does not comprise the plurality of random bytes;
a bootloader (<NUM>), for storing information in the MCU (<NUM>) and at least one hardware of the computer system (<NUM>) and performing the secure boot, wherein the information comprises the plurality of random bytes, and the TPM (<NUM>) is comprised in the bootloader (<NUM>), the at least one hardware of the computer system (<NUM>) comprises a platform configuration register (PCR), and the PCR generates a first plurality of hashes according to the plurality of random bytes;
an operating system (OS) (<NUM>), for performing the secure boot, wherein the secure boot of the computer system (<NUM>) is completed if the first plurality of hashes are correct, and the secure boot of the computer system (<NUM>) fails if the first plurality of hashes are incorrect; and
at least one sensor (<NUM>), coupled to the MCU (<NUM>), for detecting a case tampering event in the computer system (<NUM>), and transmitting a signal for triggering a deletion of the plurality of random bytes, if the case tampering event happens in the computer system (<NUM>);
wherein the MCU (<NUM>) performs the operation of:
deleting the plurality of random bytes stored in the MCU (<NUM>) and the at least one hardware by using a power supply, to fail the secure boot, in response to the signal transmitted by the at least one sensor (<NUM>).