Credential-Derived Encryption Key Firmware Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firmware is not well-suited for protecting passwords or credentials, as they can be extracted from flash devices, leading to security vulnerabilities, and existing solutions add cost and complexity with additional controllers like TPMs that lock user profiles before OS handoff.
Innovation Solution
Using credential-derived symmetric keys to authenticate users without storing passwords in firmware, allowing access to firmware services by decrypting data containers using keys generated from user credentials, and supporting multi-factor authentication with nested Lock Boxes and User Profiles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If passwords or credentials are stored in firmware flash devices, then user authentication can be performed, but security is compromised due to credential extraction vulnerabilities
Solution Approach 1:
The patent extracts the credential storage function from firmware and relocates it to a separate secure element or TPM. The firmware no longer contains passwords or credentials directly, instead receiving authenticated status from the secure element. This separation removes the vulnerability of credential extraction from the firmware image while preserving authentication functionality.
Solution Approach 2:
The patent introduces a secure element or TPM as an intermediary between the user credentials and the firmware. The secure element stores credentials securely and provides authentication services to the firmware without exposing the actual credential data. This intermediary layer prevents direct extraction of credentials from firmware while enabling authentication.
2Reliability
If additional controllers like TPMs are added to protect credentials, then security is improved, but device complexity and cost increase
Solution Approach 1:
The patent designs the secure element or TPM to perform multiple functions: credential storage, authentication, and secure key management. By consolidating these security functions into a single multi-functional component, the patent reduces overall system complexity compared to having separate dedicated controllers for each function, while still providing robust credential protection.
Data Source
AI summary
A firmware-based technique for using one or more symmetric keys generated from one or more user credentials to decrypt user profile information and authenticate the user before allowing access to firmware-provided services is discussed. Exemplary credential types include user passwords, smart card data, fingerprint sensor data and retinal scan data. The credentials may be verified in a resource-constrained pre-operating system (OS) environment, upon control of the computing device being returned to the firmware by the OS, and/or may enable recovery scenarios executed by the firmware, such as in the case where a password is lost.