Abstract: A method, apparatus, and system are disclosed for updating firmware on a storage device. The apparatus includes a detection module and an update module. The detection module detects, during a boot sequence, an indicator of an available update of firmware controlling a storage device. The available update is stored on non-volatile storage media of the storage device. The update module updates the storage device with the available update in response to the detection module detecting the indicator of the available update.

Abstract: A computer program product and system for reducing the boot time of a TCPA based computing system. A flash memory in the TCPA based computing system may include a register comprising bits configured to indicate whether the segments of the flash memory have been updated. The flash memory may further include a table configured to store measurements of the segments of the flash memory. The flash memory may further include a boot block code that includes a Core Root of Trust for Measurement (CRTM). The CRTM may read the bits in the register to determine if any of the segments of the flash memory have been updated. The CRTM may further obtain the measurement values in the table for those segments that store the POST BIOS code that have not been updated thereby saving time from measuring the POST BIOS code and consequently reducing the boot time.

Abstract: Computer implemented method, system and computer program product for controlling software entitlement. A computer implemented method for controlling software entitlement includes receiving a request to install a software item on a designated machine. A determination is made if the designated machine is of a machine type authorized for installation of the software item. If the designated machine is of a machine type authorized for installation of the software item, a determination is made, using stored configuration data, if at least one additional criterion specified for entitlement to install the software item on the designated machine is satisfied using stored configuration data. If the at least one additional criterion specified for entitlement to install the software item on the designated machine is satisfied, installation of the software item on the designated machine is enabled in accordance with the at least one additional criterion.

Abstract: When a disk sector is written to, a bit for the sector is set indicating that the sector will require secure data disposal (SDD) to be run on it. To save time during end of life disposal, SDD is executed only on sectors whose bits indicate that they have been written to. SDD can be executed on each dirty sector in one operation at end of life or incrementally during use as disk activity permits.

Abstract: When a disk sector is written to, a bit for the sector is set indicating that the sector will require secure data disposal (SDD) to be run on it To saw time during end of life disposal, SDD is executed only on sectors whose bits indicate that they have been written to. SDD can be executed on each dirty sector in one operation at end of life or incrementally during use as disk activity permits.

Abstract: A system, method, and program product is provided that initializes expected PCRs stored in a TPM by generating and storing a random number, seeding expected PCRs with the random number, inputting a set of startup code processes to a hash algorithm resulting in a set of hash values, updating the expected PCRs using the set of hash values, and saving the expected PCRs in a nonvolatile data area that is secured by the TPM. Upon reboot, the random number is retrieved from the nonvolatile data area, the PCRs are seeded with the retrieved random number, the startup code processes are input to the hash algorithm process resulting in another set of hash values, the PCRs are updated using the resulting set of hash values, and an encrypted data object is decrypted in response to the PCRs being the same as the expected PCRs.

Abstract: A system, computer program product and method for booting to a partition in a non-volatile storage unit without a local operator. In one embodiment, one or more bits in a BOOT register may be set by an operating system indicating if the BIOS should boot to the partition. The BIOS may then read the BOOT register to determine if the BIOS is to boot to the partition as well as any activities to perform if the BIOS is to boot to the partition. In another embodiment, a network interface card may insert directive information received from a packet in a register within the network interface card. The BIOS may then read the register within the network interface card to determine if the BIOS is to boot to the partition as well as any activities to perform if the BIOS is to boot to the partition.

Abstract: A computer system is disclosed that includes a primary processor and a service processor operable regardless of a power state of the computer system. A non-volatile memory device is communicatively coupled to the primary processor and the service processor. The non-volatile memory device stores firmware which includes a first list of patches required for installation on the computer system and a second list of patches previously installed on the computer system. A comparator module is provided to determine whether there are patches included in the first list that are not included in second list. A boot module is provided to boot a maintenance operating system in the event the first list includes patches not included in the second list. The maintenance operating system is configured to install, on the computer system, patches included in the first list but not the second list.

Abstract: A “setmax” command is issued in BIOS to hide the service area (HPA) of a HDD during normal operation, so that the HPA cannot be accessed or erased inadvertently by the user or by a virus. Pressing a special key (e.g., F11) during booting permits access to the HPA.

Abstract: A system and method to avoid disk lube pooling is presented. A track access monitor tracks the number of times that a program accesses a particular track located on a hard drive. When the track access monitor determines that the number of track accesses to a particular track exceed a track access threshold, the track access monitor invokes a sequence of events to scan adjacent tracks in order to uniformly redistribute lubrication over the hard drive. In one embodiment, the track access monitor incrementally performs the adjacent track scanning during hard drive idle periods, such as when the system waits for a password from a user or when the operating system conserves power and idles the hard drive due to lack of activity.

Abstract: A data processing system and method of password protecting the boot of a data processing system are disclosed. According to the method, in response to an attempt to boot the data processing system utilizing a boot device, the boot device is interrogated for a password. If the boot device supplies password information corresponding to that of a trusted boot device, the data processing system boots utilizing the boot device. If, however, the boot device does not supply password information corresponding to that of a trusted boot device, booting from the boot device is inhibited. In a preferred embodiment, the password information comprises a unique combination of the boot device's manufacturer-supplied model and serial numbers.

Abstract: To unlock a HDD when a computer is in the suspend state, at both BIOS and the HDD a secret is combined with a password to render a new one-time password. BIOS sends its new one-time password to the HDD which unlocks itself only if a match is found. The new one-time password is then saved as an “old” password for subsequent combination with the secret when coming out of subsequent suspend states. In this way, if a computer is stolen the thief cannot sniff the bus between BIOS and the HDD to obtain a password that is of any use once the computer ever re-enters the suspend state.

Abstract: An apparatus, system, and method are disclosed for suspend-resume scheduling in conjunction with an operation requiring a suspend-resume cycle of a computer 200, including updating, for purposes of system configuration management, a non-volatile memory 506, such as an electrically erasable programmable read-only memory (“EEPROM”) 702. A control module 402 sends 806 a request to update the EEPROM 702. A suspend module 404 suspends 818 an operating system 204. A standby module 406 prepares 904 the computer 200 to enter a standby state, estimates 914 a sufficient amount of time to enter the standby state, places 916 the estimate into an alarm register 608, and then enters 918 the standby state. An update module 308 exits 1004 the standby state in response to an alarm signal 612, receives the request if present 1008, writes 1012 the EEPROM 702 with the updated information, and resumes 1018 the operating system 204.

Abstract: A system and method for using a client-side hypervisor in conjunction with a secure network-side monitoring mechanism to detect removable media insertions since a client's last network session with the secure network is presented. The hypervisor uses a “client-side insertion value” to track the number of times that a user inserts removable media into a socket located on the client. When the client is connected to the secure network, the client's hypervisor notifies the secure network of each insertion and the secure network increments a “secure network-side tracker value.” For each login request, the client includes the client-side insertion value, which the secure network compares against its secure network-side tracker value. When the two values are different, the secure network sends an action request to the client, such as a request to perform a full system scan.

Abstract: A method, apparatus, and system are disclosed of forward caching for a managed client. A storage module stores a software image on a storage device of a backend server. The backend server provides virtual disk storage on the storage device through a first intermediate network point for a plurality of diskless data processing devices. Each diskless data processing device communicates directly with the first intermediate network point. The storage module caches an image instance of the software image at the first intermediate network point. A tracking module detects an update to the software image on the storage device. The storage module copies the updated software image to the first intermediate network point as an updated image instance.

Abstract: In the event of a virally infected MBR on a hard disk drive that might prevent booting, a service MBR in a hidden protected area (HPA) can be used to boot a service O.S., and then the service MBR can be replaced with a previously backed-up MBR, also in the HPA, to mount any missing partitions.

Abstract: A method and system is described for selectively downloading antidotes onto a client computer. The client computer is connected via a network interface card (NIC) to a network that contains an anti-virus server. The NIC is initially logically isolated from the client computer, thus permitting the NIC to autonomously examine packets to and from the client computer and the network. The NIC selectively accepts packets only from trusted Internet Protocol (IP) addresses that conform to a security format such as Internet Protocol Security (IPSec).

Abstract: An apparatus, system, and method are disclosed for computer system power management. A control module 602 is activated on a computer 200 in response to an event and enters 818 a standby state if the computer 200 is not already 814 in the standby state. A policy module 604 detects 904 a power source of a predetermined type connected to the computer 200 and dictates 908 one or more processors 302 of higher power consumption for a more abundant type of power source such as an AC adapter 314, or one or more processors 304 of lower power consumption for a less abundant type of power source such as a battery 318. A configuration module 606, activated by the control module 602, switches 1004 the computer 200 to one or more processors 302 and 304 of a predetermined power consumption as dictated and exits 1016 the standby state.

Abstract: An apparatus, system, and method are disclosed for granting hypervisor privileges. An installation module installs a monitor hypervisor wherein only the monitor hypervisor is granted the hypervisor privileges by the computer. An authentication module authenticates a second hypervisor. An eviction module evicts the monitor hypervisor if the second hypervisor is authenticated.

Abstract: An apparatus, system, and method are disclosed for quiescing a boot environment. A reservation module reserves a portion of a first storage device. A store module stores an update boot image to the reserved portion. A detection module detects the update boot image stored on the first storage device when the computer boots and executes the update boot image in place of a standard boot image in response to detecting the update boot image. The update boot image places a computer in a known quiescent state.