Pre-boot OS Configuration Authentication via Digital Key
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing systems lack assurance that an operating system configuration has not been modified or tampered with before booting, especially when users remotely access and change access control policies, allowing unauthorized users to elevate privileges.
Innovation Solution
A method that involves receiving a request to load an operating system configuration, storing a digital key for authentication, restarting the system, and authenticating the configuration using a trusted application during the pre-boot state to ensure the integrity of the chosen configuration before booting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users are allowed to remotely access and change operating system configurations, then system flexibility and ease of operation are improved, but security is worsened because unauthorized users can elevate privileges
Solution Approach 1:
The system performs preliminary authentication of the operating system configuration before booting. A trusted application executes during the pre-boot state to verify the integrity of the configuration using a digital key, ensuring that only authenticated configurations can be loaded. This preliminary security check prevents unauthorized configurations from being executed while still allowing legitimate configuration changes.
2Reliability
If the system authenticates operating system configurations using digital keys during pre-boot state, then security and reliability are improved, but device complexity and boot time are worsened
Solution Approach 1:
The trusted application automatically performs the authentication of the operating system configuration without requiring manual user intervention. The system self-verifies the digital key and configuration integrity during the pre-boot state, then automatically proceeds with booting if authentication succeeds. This automation reduces operational complexity while maintaining security.
3Object-affected harmful factors
If the system requires physical coupling of user interface to prevent unauthorized changes, then security is improved, but ease of operation is worsened because remote access is restricted
Solution Approach 1:
The trusted application acts as an intermediary between the configuration loading process and the boot process. It receives the operating system configuration, verifies its authenticity using the digital key, and only then allows the configuration to be loaded and booted. This intermediary layer provides security verification while still permitting remote configuration changes through authenticated interfaces.
4Reliability
If the system stores digital keys automatically when configuration requests are received, then security is improved, but loss of time is worsened due to additional processing steps
Solution Approach 1:
The system stores the digital key in advance when the configuration request is initially received, before the system restart and authentication phase. This preliminary storage action ensures the key is available when needed for verification without requiring real-time retrieval or generation during the critical authentication phase, thereby reducing processing time delays.
Data Source
AI summary
A method, system, and computer program product includes receiving, in a booted state of a computing system, a request to load an operating system configuration. The method further includes storing, automatically in response to receiving the request, a digital key to authenticate the operating system configuration. The method further includes restarting the computing system. In response to restarting the computing system and while the computing system is in a pre-boot state, the method includes: validating that the digital key stored is one for a valid operating system configuration; receiving, from a user interface physically coupled to the computing system, a signal confirming the received request; authenticating, in response to receiving the signal, the operating system configuration using the digital key; and booting, in response to the authenticating, the operating system configuration.