Encrypted Pre-Boot Operating System Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems cannot effectively encrypt the pre-boot operating system on non-volatile data storage devices, making them vulnerable to attacks and compromising system security, especially in high-security applications like ATMs.
Innovation Solution
The system encrypts both the pre-boot and main operating systems on non-volatile data storage devices by using a remote authentication server to provide decryption keys, ensuring that the pre-boot operating system is decrypted only in dynamic memory and never stored permanently, and the system BIOS chip is configured to perform additional authentication processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the pre-boot operating system is stored unencrypted on the non-volatile data storage device to enable system booting, then the system can start up normally, but the pre-boot operating system becomes vulnerable to attacks and modifications
Solution Approach 1:
The system performs authentication and decryption key retrieval before the pre-boot operating system is loaded or executed. The BIOS/UEFI authenticates with a remote authentication server during the boot process, obtains the decryption key, and then decrypts the pre-boot operating system in memory before execution. This preliminary authentication action ensures the operating system is encrypted on storage while still enabling normal system booting.
2Reliability
If the pre-boot operating system is encrypted on the non-volatile data storage device to prevent attacks, then system security is improved, but the BIOS chip ROM space must be increased to accommodate the operating system
Solution Approach 1:
The patent moves the pre-boot operating system from being stored in the BIOS chip ROM to being stored on a non-volatile data storage device (such as a hard disk drive or solid-state drive). This dimensional change in storage location allows the BIOS chip to remain small while still supporting an encrypted pre-boot operating system. The BIOS/UEFI retrieves the encrypted operating system from the non-volatile storage, decrypts it in memory, and then executes it, thereby eliminating the need for large BIOS chip ROM space.
3Adaptability or versatility
If the pre-boot operating system is stored in unencrypted form on non-volatile data storage to allow modification, then system adaptability is improved, but security is compromised
Solution Approach 1:
The system performs authentication and decryption control before the pre-boot operating system is loaded into memory or executed. The BIOS/UEFI authenticates with a remote authentication server during the boot process, and only after successful authentication does it retrieve and decrypt the pre-boot operating system. This preliminary authentication action ensures that the operating system remains encrypted on storage, preventing unauthorized access and modification, while still allowing legitimate system operation.
Data Source
AI summary
A computing system and method has a pre-boot operating system stored in an encrypted form according to a first key on a first portion of a non-volatile data storage drive and a main operating system stored in an encrypted form according to a second key on a second portion of the non-volatile data storage drive. A system built in operating system (BIOS) chip is configured to initiate a first authentication process, obtain the first key after successful completion of the first authentication process, load and decrypt the pre-boot operating system into dynamic memory, and cause the pre-boot operating system to run. The pre-boot operating system is configured to initiate a second authentication process, obtain the second key after successful completion of the second authentication process, load and decrypt the main operating system into dynamic memory, and cause the main operating system to run.