Obscured Recovery Codes for Encrypted Storage During BIOS Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for accessing encrypted storage devices in computing devices face challenges during BIOS updates, requiring manual password input, which is cumbersome and insecure, or remote network-based solutions that fail without connectivity, leading to update disruptions.
Innovation Solution
A system that uses a recovery code transmitted via a network connection, obscured from user view, to decrypt encrypted data by generating virtual keystrokes, allowing secure access without manual intervention or network reliance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual password input is required for encrypted storage access during BIOS updates, then security is maintained, but user convenience deteriorates and update process is disrupted
Solution Approach 1:
The system performs preliminary action by automatically obtaining and inputting the password before the user needs to access encrypted storage during BIOS update. The password is retrieved from secure storage and automatically provided to the decryption module, eliminating the need for manual user input while maintaining security.
Solution Approach 2:
The system implements self-service by automatically handling the password retrieval and input process without requiring user intervention. The decryption module autonomously obtains the password from secure storage and provides it to decrypt the encrypted storage device, making the system self-sufficient during critical operations like BIOS updates.
2Ease of operation
If remote network-based password input is used, then ease of operation improves, but reliability deteriorates when network is unavailable
Solution Approach 1:
The system uses an intermediary approach by introducing a local secure storage unit (such as TPM) as a mediator between the remote authentication server and the local decryption process. This intermediary enables automatic password input while ensuring the system can operate reliably even when network connectivity is unavailable, as the secure storage unit can provide passwords locally.
Solution Approach 2:
The system performs preliminary action by pre-storing the password in a secure storage unit before network connectivity is needed. This allows the system to maintain automatic password input capability and reliability during offline operations, as the password is already available in secure storage without requiring real-time network access.
3Ease of operation
If recovery code is displayed to user, then ease of operation improves, but security deteriorates due to potential exposure
Solution Approach 1:
The system extracts the recovery code from the user's view by separating the code display function from the code input function. The recovery code is transmitted to the processor but not displayed to the user; instead, the processor automatically inputs the code, extracting the code from the user interface and handling it programmatically to prevent exposure while maintaining operational ease.
Data Source
AI summary
An example storage medium is described, wherein the storage medium comprises instructions that, when executed cause a processor of an electronic device to store authentication data in a first memory of the electronic device. Upon detecting a failure to decrypt information, the processor is to perform an authentication with a webservice, receive a recovery code, and input the recovery code to a recovery service. The recovery code is obscured from the user.