Patent ID: 8332652

Claim:
A method for ensuring that a processor will execute only authorized boot code, said method comprising: reading a certificate including a first public key into a protected memory; validating said certificate with a second public key permanently stored on said processor; reading a signed authorized boot code into said protected memory, wherein said protected memory is cryptographically protected; reading, by said processor, a digital signature used to sign said signed authorized boot code; decrypting said digital signature to generate a decrypted digital signature; verifying said decrypted digital signature in accordance with said first public key; executing, by said processor, said signed authorized boot code having a verified digital signature by branching to said signed authorized boot code in said protected memory, said signed authorized boot code including instructions for performing a boot process for a computer device comprising said processor, wherein said digital signature of said signed authorized boot code is previously verified and executing further comprises performing inline decryption of the copy of said signed authorized boot code in said protected memory by cryptography hardware on the processor during the boot process, wherein the performing the inline decryption further comprises generating plaintext data only within the process, the plaintext data corresponding to said copy of said signed authorized boot code from said protected memory.