AEGIS
Assuming that host hardware is valid, the integrity of a higher layer can be guaranteed if
The integrity of the lower layers is checked.
Transitions to higher layers occur only after integrity checks on them are complete.
The resulting integrity “chain” inductively guarantees system integrity.
Goal
Without a secure bootstrap, the operating system kernel cannot be trusted:
Since it is launched by an untrusted process.
Designers of trusted systems often avoid the problem by including boot components in the TCB.
AEGIS was a secure bootstrap process.
Ensuring the integrity of bootstrap code
Approach
It constructs a chain of integrity checks.
Beginning at power-on.
Continuing until the final transfer of control from the bootstrap process to the operating system.
Integrity checks are hard to circumvent.
Match of a computed cryptographic hash value with a stored digital signature associated with each component.
AEGIS secure boot process guaranty
Two mechanisms guarantee the boot process ends up in a secure state.
Even in the event of integrity failures outside of a minimal section of trusted code.
No code is executed unless it is either explicitly trusted or its integrity is verified before its use.
Upon an integrity failure, a process can recover a suitable, verified replacement module.
Boot process
Last updated
