Boot System Challenge-Response Access for Secure External Booting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electronic data processing systems in public spaces face security risks due to unauthorized access and malware transmission through external storage media, particularly during the boot process, which existing solutions like disabling hardware interfaces, proprietary memory, and secure boot are either costly, inflexible, or provide weak protection.
Innovation Solution
Implementing a challenge-response protocol between the boot system and the user, where a randomly generated challenge is communicated to the user, and a response is verified to authenticate the user, using symmetric or asymmetric key techniques, ensuring secure access without additional hardware costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the boot system allows selective loading from external storage media, then the system provides flexibility and ease of operation, but security is compromised due to potential malware or viruses
Solution Approach 1:
The patent applies preliminary action by implementing a challenge-response protocol during the boot process before the external storage medium can be accessed. The boot system generates a challenge and verifies the user's response beforehand, preventing unauthorized access to the boot process and ensuring that only authenticated users can load operating systems from external media.
Solution Approach 2:
The patent uses an intermediary mechanism in the form of a challenge-response authentication protocol between the boot system and the user. This intermediary layer verifies user identity before allowing access to the boot process, acting as a mediator that prevents direct unauthorized access while maintaining legitimate user access.
2Reliability
If mechanical locks or epoxy are used to block USB ports, then security is improved, but device complexity and cost increase
Solution Approach 1:
The patent replaces mechanical security measures (locks, epoxy) with an electronic/software-based challenge-response authentication protocol. This substitution eliminates the need for physical blocking mechanisms while providing equivalent or superior security through cryptographic verification during the boot process.
Solution Approach 2:
The challenge-response protocol serves as an intermediary software layer that provides security without requiring physical hardware modifications. Instead of mechanically blocking USB ports, the system uses this intermediary authentication mechanism to control access, simplifying the overall system while maintaining security.
3Reliability
If proprietary USB sticks are used, then security is improved through restricted access, but adaptability and versatility are reduced
Solution Approach 1:
The patent implements universality by creating a challenge-response authentication protocol that works with any external storage medium (USB drives, DVDs, network drives) rather than requiring proprietary media. The system maintains security through authentication while allowing flexibility in choosing different storage media for booting operating systems.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention is related to a method for operating an electronic data processing system (10) operable under an operating system, the electronic data processing system (10) comprising a boot system (13) for selectively loading an operating system from one of a plurality of storage media (12, 30), said boot system (13) being accessible to an external user on execution of an identification protocol between said boot system (13) and said user, wherein said identification protocol is a challenge-response protocol based on a challenge generated by said boot system (13), more particularly, based on a challenge randomly generated by said boot system (13), and communicated to said user in an outgoing message, and on verification of a response generated by said user on the basis of said challenge and received by said boot system (13) as an incoming message generated by said user. Furthermore, the invention is related to an electronic data processing system (20), and to a weighing scale (1) and an authentication system comprising the electronic data processing system (10). (Fig. 2)