Encrypted OS Boot via Pre-OS Authentication and Block-Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices with non-volatile memory face challenges in achieving whole operating system encryption due to the lack of BIOS interrupts for flash memory access, making it difficult to separate and encrypt the operating system and authentication components effectively, leaving them vulnerable to attacks.
Innovation Solution
An encryption system that includes a pre-operating system environment and an encrypted start-up module, where the pre-operating system authenticates users and block-decrypts the start-up module into volatile memory, providing a filter for encryption and decryption operations, allowing the entire operating system to be encrypted and securely booted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the operating system is stored encrypted in non-volatile memory, then security is improved, but the device cannot boot or access authentication components
Solution Approach 1:
The storage system is segmented into multiple partitions: an unencrypted first partition containing the bootloader and authentication components, and an encrypted second partition containing the operating system. This segmentation allows the device to boot using unencrypted authentication components while keeping the OS encrypted for security.
Solution Approach 2:
An unencrypted first partition acts as an intermediary layer between the encrypted OS and the bootloader. This intermediary contains the authentication components needed to decrypt the OS, enabling the system to boot securely without exposing the entire OS in plaintext.
2Reliability
If the entire operating system is encrypted, then security is improved, but authentication components cannot access the system during boot
Solution Approach 1:
The system is divided into functional segments: unencrypted authentication components in the first partition and encrypted OS in the second partition. This allows authentication to occur in an unencrypted environment before accessing the encrypted OS, resolving the conflict between security and authentication access.
3Ease of manufacture
If only part of the operating system is left unencrypted for booting, then ease of manufacture is improved, but security is worsened due to vulnerability of unencrypted portions
Solution Approach 1:
Instead of leaving the entire OS unencrypted for booting purposes, only the essential authentication components in the first partition remain unencrypted. The majority of the OS in the second partition remains encrypted, maintaining both engineering simplicity and enhanced security.
Solution Approach 2:
Different security qualities are applied to different parts of the system: the first partition has unencrypted local quality to enable booting, while the second partition has encrypted local quality for security. This local differentiation resolves the contradiction between ease of manufacture and security.
4Reliability
If a pre-operating system is introduced to facilitate authentication, then security is improved, but device complexity increases
Solution Approach 1:
The pre-operating system functionality is segmented into the first partition, which contains authentication components. This modular approach provides security benefits while limiting complexity increase to only the necessary authentication functionality rather than a full pre-operating system environment.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An encryption system (10) and method for a computing device (100) having an encrypted operating system (50) is disclosed. The encryption system (10) includes a pre-operating system (20) and an encrypted start-up module (40). The pre-operating system (20) is executed on start-up of the computing device (100) and is configured to receive user inputs for authenticating the user, the pre-operating system (20) authenticating the user in dependence on the user inputs and, upon authentication, block-decrypting the encrypted start-up module into volatile memory (102) for booting of the encrypted operating system (50) on the computing device (100).