Boot Device Selection Security via Password Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems with multiple bootable devices face security risks due to uncontrolled access, as users can potentially boot from unsecure devices by overriding the specified boot order without proper authentication.
Innovation Solution
Implementing a password-based security mechanism that enables users to set and enforce access controls, disabling the ability to manually select a boot device during the boot process if a password is set, ensuring that only authorized users can change the boot order and preventing the system from booting from unsecure devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple bootable devices are available to boot the system, then system versatility and flexibility are improved, but system security deteriorates due to uncontrolled access from unsecure devices
Solution Approach 1:
The patent applies preliminary action by establishing a boot order configuration before the boot process occurs. The system pre-defines a secure boot sequence that prioritizes trusted devices (e.g., internal hard drive before removable media), ensuring that even if unsecure devices are present, they cannot be accessed unless explicitly configured otherwise. This preliminary configuration prevents security issues before they can manifest during boot.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a boot manager or BIOS layer that mediates between the multiple bootable devices and the operating system. This intermediary enforces the configured boot order, controlling which devices can be accessed and in what sequence. It acts as a gatekeeper that prevents direct access to unsecure devices while maintaining the ability to boot from multiple devices when appropriate.
2Ease of operation
If users can manually select a boot device during boot process, then ease of operation is improved, but system security deteriorates due to unauthorized access
Solution Approach 1:
The patent applies dynamics by making the boot device selection capability conditional rather than static. The system dynamically enables or disables manual boot device selection based on system state, user authentication status, and security configuration. When security is prioritized, the manual selection interface is disabled or restricted, preventing unauthorized access while still allowing legitimate users to select devices when needed.
Solution Approach 2:
The patent changes the parameter of user interaction with boot device selection based on security requirements. The system modifies whether the boot device selection interface is available, visible, or actionable depending on authentication credentials, security policies, and system configuration. This parameter change ensures that ease of operation is maintained for authorized users while blocking unauthorized access attempts.
3Adaptability or versatility
If removable bootable devices like floppy drives are available, then adaptability is improved, but reliability deteriorates due to uncontrolled code execution
Solution Approach 1:
The patent applies segmentation by separating boot devices into distinct security zones or trust levels. Removable devices like floppy drives are segmented into a lower-trust category, while internal storage devices are placed in a higher-trust category. The boot process is segmented to first attempt loading from high-trust devices, and only proceed to low-trust devices if explicitly configured and authenticated, thereby maintaining adaptability while ensuring reliability through structured trust segmentation.
Data Source
AI summary
A method comprises receiving user input during a boot process requesting a list of selectable boot devices to be provided from which the user can select one of the devices to boot a system. The method further comprises precluding a function from being performed, the function otherwise permitting a user to select the device to be used to boot the system.