Manageability Engine Pre-Boot Authentication for Encrypted Drives
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Full Disk Encryption (FDE) in Intel® Anti-Theft Technology makes it difficult for the Operating System (OS) to authenticate users pre-boot, as the OS is encrypted, necessitating user authentication before drive access, which complicates initial authentication processes.
Innovation Solution
A manageability engine (ME) receives user authentication responses during pre-boot operations, employs the Kerberos protocol to register with a Key Distribution Center (KDC), and provides single-sign-on credentials in the form of a Key Encryption Key (KEK), allowing secure access to enterprise servers without relying on the OS, and intercepts OS login prompts to suppress redundant authentication requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Full Disk Encryption is implemented to protect data, then data security is improved, but user authentication becomes more complex and cannot rely on the OS
Solution Approach 1:
The manageability engine performs user authentication before the operating system is loaded and before disk decryption occurs. This preliminary authentication action allows the system to unlock the encrypted drive early in the boot process, eliminating the need for complex post-encryption authentication mechanisms and actually simplifying the overall process.
Solution Approach 2:
The manageability engine acts as an intermediary component between the hardware and the encrypted storage system. It handles authentication independently of the encrypted OS, serving as a trusted mediator that can verify user credentials and release decryption keys without being affected by the encryption of the main operating system.
2Reliability
If the OS is encrypted for security, then data protection is improved, but the OS cannot perform pre-boot authentication
Solution Approach 1:
Authentication is performed as a preliminary action before the encrypted operating system is accessed. The manageability engine authenticates users during the boot process before disk decryption, making authentication accessible and independent of the encrypted OS state.
Solution Approach 2:
The system is segmented into two independent authentication domains: the manageability engine domain for pre-boot authentication and the operating system domain for post-boot authentication. This segmentation allows the encrypted OS to remain secure while enabling accessible authentication through the separate manageability engine.
3Reliability
If pre-boot authentication is implemented, then secure access is improved, but redundant authentication prompts may appear
Solution Approach 1:
The manageability engine provides feedback to the operating system about the authentication state. After successful pre-boot authentication, the manageability engine communicates this status to the OS, which then suppresses redundant authentication prompts, improving user experience while maintaining secure access.
Data Source
AI summary
A manageability engine (ME) receives an authentication response from a user during pre-boot authentication and registers the user with a key distribution center (KDC), indicating that the user has successfully authenticated to the PC. The KDC supplies the ME with single-sign-on credentials in the form of a Key Encryption Key (KEK). The KEK may later be used by the PC to obtain a credential used to establish secure access to Enterprise servers.