External Boot Loader Accessing Encrypted Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securely booting computers in a bring-your-own (BYO) environment face challenges in ensuring secure execution of software on unprepared devices, particularly due to the limitations of external memory sticks for fast booting and the risk of memory stick failure from limited block write operations.
Innovation Solution
A method that allows an operating system to access an encrypted data storage system by comparing encrypted data units from the computer and an external device, enabling secure booting and data access based on matching partitioning information, with the option to update or recreate partitions if changes are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If an external memory stick is used to store the BYO OS for booting, then the OS can be executed on unprepared devices, but the memory stick may fail quickly due to limited block write operations and cannot provide fast access
Solution Approach 1:
The system divides the storage functions between two locations: the external memory stick stores only the boot loader and essential booting information, while the internal encrypted hard drive stores the complete OS and swap space. This segmentation reduces write operations on the external memory stick, improving its reliability while maintaining the ability to boot on unprepared devices.
Solution Approach 2:
The internal encrypted hard drive is pre-configured with partitions and encryption before the BYO OS needs to run. The boot loader is pre-installed on the external memory stick with all necessary information to access the internal drive. This preliminary preparation eliminates the need for repeated write operations during booting, enhancing both reliability and speed.
2Adaptability or versatility
If the swap space is located on the external drive, then the BYO OS can run from external media, but the memory stick may fail quickly due to limited block write operations
Solution Approach 1:
The system separates swap space from the external memory stick and places it on the internal encrypted hard drive. This segmentation eliminates intensive write operations from the external memory stick, preventing premature failure while maintaining the capability to run the OS from external media.
3Reliability
If the computer is booted from an external boot media, then a clean operating system can be started for security purposes, but access to encrypted data on the internal hard drive is restricted
Solution Approach 1:
The boot loader acts as an intermediary between the external boot media and the internal encrypted hard drive. It contains the necessary credentials and encryption keys to decrypt and access the internal drive's data, allowing secure booting while maintaining data accessibility.
Solution Approach 2:
The encryption keys and access credentials are pre-configured in the boot loader during system setup. This preliminary action enables the external boot media to automatically access the encrypted internal drive without requiring additional authentication steps, maintaining both security and ease of operation.
4Speed
If a fast memory stick is used for booting, then the BYO OS can be usably fast, but the memory stick may still fail quickly due to limited block write operations
Solution Approach 1:
The system segments storage responsibilities so that the external memory stick holds only small, static boot files that require minimal writes, while larger, more frequently accessed data resides on the internal drive. This allows use of fast memory sticks for booting without compromising durability.
Data Source
AI summary
The present invention is notably directed to a method for allowing an operating system, or OS, to access an encrypted data storage system of a computer (10), wherein: the data storage system (11) comprises: a partition (122); and first encrypted data units (120) that comprise partition table data of said data storage system; and said computer (10) is connectable to an external device (20) comprising: a boot loader (24) for an external OS (112) that is not installed on the computer; and partitioning information (22) capturing an expected location of said partition (122) in the data storage system; and wherein second encrypted data units (220) that comprise reference partition table data for said data storage system are available from said computer (10) or said external device, the method comprising: upon connection (S21) of said external device (20) to the computer, instructing to boot (S23) the computer (10) from said boot loader (24); and during or after booting of the computer: comparing (S25) the first (120) and second encrypted data units (220); and if (S27) the first and second encrypted data units match, allow (S28) the external OS (112) to access, based on the partitioning information (22) stored on the external device, one or more data units (14) of said partition on the data storage system (11). The present invention is further directed to related devices, systems and computer program products.