Browse Prior Art Database

Making Legacy DOS Boot devices Secure

IP.com Disclosure Number: IPCOM000015135D
Original Publication Date: 2001-Aug-11
Included in the Prior Art Database: 2003-Jun-20
Document File: 2 page(s) / 65K

Publishing Venue

IBM

Abstract

Most PC vendors have developed tools that work in DOS mode. Although these tools are inexpensive and easy to use, they create a problem if used in a secure TCPA environment. For instance, a Flash Diskette today utilizes DOS to load the appropriate utilities. A company could go to all the trouble of digging up all of the various components that load when you load a DOS Flash diskette and make the TCPA hash and extend changes but this may not be feasible if the source code is not available. This invention allows existing DOS utilities that boot off of a DISKETTE CD ROM to work with very little change.

This text was extracted from a PDF file.
At least one non-text object (such as an image or picture) has been suppressed.
This is the abbreviated version, containing approximately 53% of the total text.

Page 1 of 2

Making Legacy DOS Boot devices Secure

Most PC vendors have developed tools that work in DOS mode. Although these tools are inexpensive and easy to use, they create a problem if used in a secure TCPA environment. For instance, a Flash Diskette today utilizes DOS to load the appropriate utilities. A company could go to all the trouble of digging up all of the various components that load when you load a DOS Flash diskette and make the TCPA hash and extend changes but this may not be feasible if the source code is not available. This invention allows existing DOS utilities that boot off of a DISKETTE / CD ROM to work with very little change.

A method needs to be developed which will allow existing utilities to run. This solution addresses this problem for data read off of a media which supports the INT 13h handler. Refer to figure 1. This is an existing flow. When the system gets to the end of the boot process, the Master Boot Record (MBR) is read. The MBR gives the BIOS enough data to determine that a bootable media is available and then the BIOS jumps to the MBR. The MBR loads the OS loader which then takes control of the system. At the completion of the OS loader, the appropriate utility is loaded which then starts the Flash process. In this process, there are many area's in which untrusted code could be loaded (MBR,Loader,....). These are attack points in which an attacker could modify the BIOS.

Figure 1

Our solution attempts to solve this problem. Refer to Figure 2. At the completion of POST, the BIOS will go out to a media and determine if the media is bootable. The MBR has four boot partitions. One partition will point to the OS loader and be marked as bootable. A second partition could be pointed to which would contains a file of a specific length. The BIOS would go read the data in the second partition and look for a particu...