BIOS Boot Security via Trusted Platform Module Authentication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The BIOS in computer systems is susceptible to unauthorized access during the boot process, as existing security methods are ineffective in preventing attacks on the BIOS-verified boot password.

Innovation Solution

A computer security system that utilizes a trusted platform module (TPM) to generate and validate a user key for authenticating the boot process, ensuring that only authorized users can initiate the boot process by interfacing with the TPM to verify authentication data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the BIOS verifies a password provided by a user, then the boot process can be controlled, but the BIOS remains susceptible to attack enabling unauthorized access to the boot password

Engineering Contradiction:

Improveboot process securityVSAvoidunauthorized access to BIOS

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a Trusted Platform Module (TPM) as an intermediary security device between the user and the BIOS. The TPM generates and stores cryptographic keys securely, and performs authentication operations without exposing the keys to the BIOS or user space. This mediator architecture prevents direct attacks on the BIOS password verification mechanism while maintaining secure boot control.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the traditional mechanical password verification system in the BIOS with a cryptographic authentication system based on TPM. Instead of relying on BIOS-stored password hashes that are vulnerable to brute-force and extraction attacks, the system uses TPM's hardware-based cryptographic operations including key generation, sealing, and verification, which are resistant to these attacks.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Ease of operation

If the BIOS stores authentication data, then user verification is enabled, but the stored data becomes a target for attacks

Engineering Contradiction:

Improveuser authenticationVSAvoidattacks on stored authentication data

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent extracts the authentication data storage and management function from the BIOS and relocates it to the TPM. The TPM generates cryptographic keys, stores them in secure memory that cannot be read by external entities, and performs all authentication operations internally. This extraction removes the vulnerable authentication data from the BIOS attack surface while maintaining ease of user authentication through the TPM's secure interface.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent changes the fundamental parameters of authentication data representation and storage. Instead of storing password hashes or plaintext passwords in the BIOS, the system uses TPM-generated asymmetric key pairs where the private key remains permanently secured in the TPM's hardware. Authentication is performed by verifying cryptographic signatures or sealed data, transforming the authentication mechanism from password-based to certificate-based security.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS7711942B2Computer security system and method

Publication Date: 2010.05.04 HEWLETT PACKARD DEVELOPMENT COMPANY LP

AI summary

A computer security system comprises a basic input/output system (BIOS) adapted to store a user key generated by a trusted platform module (TPM) for a user. The BIOS is also adapted to receive TPM authentication data from the user for initiating a boot process and interface with the TPM to request validation of the TPM authentication data by the TPM for initiating the boot process using the user key.