Extensible Pre-Boot Authenticator UEFI Integration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing full disk encryption (FDE) schemes face challenges in the pre-boot environment due to the need for user authentication before the operating system (OS) loads, which often requires launching a separate OS outside the UEFI specification, leading to increased boot time and storage overhead, as well as duplication of BIOS capabilities.
Innovation Solution
An extensible pre-boot authenticator (PBA) is implemented, interacting with UEFI pre-OS and runtime flows, using security firmware for isolated storage and a virtualization engine to provide a trusted path for user authentication, leveraging UEFI drivers and credential providers like USB fingerprint sensors and smart cards, with secure storage and integrity checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a separate OS is launched in the pre-OS space to perform user authentication, then authentication functionality is provided, but boot time increases and storage overhead increases
Solution Approach 1:
The patent extracts the authentication functionality from a separate OS environment and integrates it directly into the UEFI firmware. The UEFI firmware hosts credential providers and authentication mechanisms natively, eliminating the need to launch a separate pre-OS for authentication purposes. This extraction resolves the contradiction by providing authentication functionality while avoiding the boot time penalty of loading an entire OS.
Solution Approach 2:
The UEFI firmware is designed to perform multiple functions including system initialization, device management, and user authentication. By making UEFI universal and capable of hosting authentication services directly, the system eliminates the need for dedicated authentication OS environments. This multi-functionality approach provides authentication while reducing boot time overhead.
2Reliability
If a separate OS is launched in the pre-OS space to perform user authentication, then authentication functionality is provided, but storage overhead increases
Solution Approach 1:
The patent extracts authentication services from a separate OS and consolidates them within the UEFI firmware. Credential providers, authentication logic, and related components are hosted directly in the firmware image, eliminating the need for separate storage allocations for a pre-OS authentication environment. This reduces storage overhead while maintaining authentication functionality.
3Reliability
If a separate OS is launched in the pre-OS space to perform user authentication, then authentication functionality is provided, but duplication of BIOS capabilities occurs
Solution Approach 1:
The UEFI firmware is designed as a universal platform that natively provides authentication services, device management, and system initialization capabilities. By making UEFI multi-functional and capable of hosting credential providers directly, the system eliminates the need for separate authentication OS environments that would duplicate BIOS/UEFI capabilities. This reduces system complexity while maintaining robust authentication functionality.
Data Source
AI summary
In one embodiment, the present invention includes a method for obtaining a pre-boot authentication (PBA) image from a non-volatile storage that is configured with full disk encryption (FDE), and storing the PBA image in a memory. Then a callback protocol can be performed between a loader executing on an engine of a chipset and an integrity checker of a third party that provided the PBA image to confirm integrity of the PBA image, the PBA image is executed if the integrity is confirmed, and otherwise it is deleted. Other embodiments are described and claimed.