Encrypted OS Boot via Pre-OS Authentication and Block-Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices with non-volatile memory storage face challenges in achieving whole operating system encryption due to the lack of BIOS interrupts for flash memory access, making it difficult to separate and encrypt the operating system without exposing unencrypted portions, which can be exploited by attackers.
Innovation Solution
An encryption system that includes a pre-operating system and an encrypted start-up module, where the pre-operating system authenticates users and block-decrypts the start-up module into volatile memory, providing a filter for encryption and decryption operations to ensure the entire operating system remains encrypted throughout the boot process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the operating system is encrypted and requires authentication before loading, then security is improved, but the device cannot boot or access hardware functions before authentication is complete
Solution Approach 1:
The system divides the operating system into multiple segments: an unencrypted authentication module that runs first, and encrypted system modules that load afterward. This segmentation allows the boot process to proceed in stages, with authentication happening in a controlled environment before the main encrypted system is accessed.
Solution Approach 2:
The authentication module is executed in advance before the main encrypted operating system is decrypted and loaded. This preliminary authentication action establishes security credentials and decrypts the encryption key, enabling subsequent secure loading of the encrypted system modules without blocking the boot process.
2Ease of operation
If only part of the operating system is left unencrypted to enable boot process, then ease of operation is improved, but security deteriorates due to exposed unencrypted portions
Solution Approach 1:
The operating system is segmented into a small unencrypted authentication module and encrypted system modules. The authentication module contains only the minimal code needed for user verification and key recovery, while all other system components are encrypted. This minimizes the attack surface while maintaining boot functionality.
Solution Approach 2:
The authentication functionality is extracted from the main encrypted operating system and placed in a separate unencrypted module. This extracted authentication module is sufficient for its specific purpose (user verification and key recovery) but does not contain the sensitive system code, thereby protecting the majority of the system while enabling the boot process.
3Reliability
If the authentication module is separated from the encrypted operating system, then security is improved, but device complexity increases
Solution Approach 1:
The system is segmented into distinct functional modules: an authentication module stored in non-volatile memory, a volatile memory area for decryption operations, and encrypted system modules. This modular segmentation organizes complexity into manageable, well-defined components with clear interfaces.
Solution Approach 2:
Volatile memory serves as an intermediary between the unencrypted authentication module and the encrypted system modules. It provides a temporary workspace for decryption operations and acts as a buffer that isolates the authentication logic from the encrypted system, simplifying the interaction between these separated components.
Data Source
AI summary
An encryption system and method for a computing device having an encrypted operating system is disclosed. The encryption system includes a pre-operating system and an encrypted start-up module. The pre-operating system is executed on start-up of the computing device and is configured to receive user inputs for authenticating the user, the pre-operating system authenticating the user in dependence on the user inputs and, upon authentication, block-decrypting the encrypted start-up module into volatile memory for booting of the encrypted operating system on the computing device.