Patent ID: 8694763

Claim:
A method for initializing an operating system on a computer system in a secure manner, the computer system including an internal primary memory having a primary operating system image and corresponding bootstrap files recorded thereon, a non-volatile memory having a system BIOS recorded thereon, and a non-volatile parameter memory having a BIOS watchdog, and a digital signature verification functionality, the method comprising the steps of: detecting a presence of a removable secondary memory coupled to the computer system, the secondary memory having a secondary operating system image and corresponding bootstrap files recorded thereon, the corresponding bootstrap files being signed by digital signatures, the secondary operating system image being identical to the primary operating system image; first attempting to boot from the internal primary memory by using the primary operating system image after the step of detecting does not detect a presence of the removable secondary memory; second attempting to boot from the removable secondary memory by using the secondary operating system image after the detecting detects the presence of the removable secondary memory, and incrementing a parameter for a number of boot attempts each time the attempting to boot from the removable secondary memory has failed; checking whether the number of boot attempts from the removable secondary memory has exceeded a maximum number; third attempting to boot from the internal primary memory by using the primary operating system image after the checking indicates that the maximum number has been exceeded; activating the BIOS watchdog for assuring the system is operating in a known state during said step of checking the number of boot attempts; verifying the digital signatures of the bootstrap files by the digital signature verification functionality; booting from the secondary operating system image of the removable secondary memory when said digital signatures are verified by the step of verifying; and changing a boot procedure from the secondary operation system image to the primary operating system image, when at least one of said digital signatures cannot be verified by the step of verifying, by executing a code jump to the primary operating system image, such that the operating system continues to run as if it has been booting from the primary operating system image.