PCR Key Unbinding During System Upgrades for Secure Boot
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
During system upgrades, the hash values stored in platform configuration registers (PCRs) may not match the current state of the computing device, preventing automatic decryption of encrypted data and disrupting the boot process, leading to unauthorized access or system lockouts.
Innovation Solution
A system that manages data encryption by temporarily unbinding PCR values and disk decryption before the boot process, utilizing network-based disk encryption during the upgrade, and subsequently updating PCR values to ensure secure decryption post-upgrade.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PCR values are bound to disk decryption for security verification, then data security is improved, but system upgrade capability deteriorates due to hash value mismatches
Solution Approach 1:
The patent makes the decryption binding dynamic by allowing it to be temporarily deactivated during system upgrades. The system can switch between bound and unbound states: during normal operation, PCR values are bound to disk decryption for security; during upgrades, the binding is deactivated to allow hash value changes; after upgrades, new bindings are created. This dynamic adaptability resolves the contradiction between maintaining security and enabling system evolution.
Solution Approach 2:
The patent performs preliminary actions by detecting upcoming system upgrades before they occur and proactively deactivating the PCR binding in advance. This prevents the hash value mismatch problem from occurring in the first place, allowing the system to upgrade without disruption while maintaining security bindings for non-upgraded components.
2Ease of operation
If PCR binding is maintained during boot process, then automatic decryption is enabled, but system lockout occurs after upgrades due to hash mismatches
Solution Approach 1:
The system dynamically adjusts the decryption binding state based on system conditions. During normal boot operations, PCR binding is active to enable automatic decryption. When system upgrades are detected or occur, the binding is temporarily deactivated to prevent lockouts. After upgrades complete, new bindings are established. This dynamic approach ensures both automatic decryption functionality and continuous system access reliability.
3Object-affected harmful factors
If disk encryption is secured with PCR hash verification, then unauthorized access is prevented, but legitimate access is blocked after configuration changes
Solution Approach 1:
The patent segments the disk encryption protection into multiple independent binding instances. Instead of a single binding that blocks all access after changes, the system creates separate bindings for different system states and time periods. Old bindings protect against unauthorized access for previous configurations, while new bindings enable legitimate access after upgrades. This segmentation allows both unauthorized access prevention and legitimate access to coexist.
Solution Approach 2:
The system introduces an intermediary mechanism that manages the transition between security states. This intermediary detects system changes, temporarily suspends binding verification during upgrades, and then creates new bindings that reflect the current system state. This intermediary layer prevents both unauthorized access and legitimate access blocks by mediating between the security requirements and system evolution needs.
Data Source
AI summary
A system can be provided for managing data encryption during system updates. For example, the system can detect an upgrade to a component of a computing device that includes encrypted data. In response to detecting the upgrade and prior to a boot process the system can deactivate a link between a set of platform configuration register (PCR) values and a decryption key usable to decrypt the encrypted data. The system can further authorize access to the decryption key during the boot process by provisioning an alternative link between a network server and the decryption key. Additionally, subsequent to the boot process, the system can update the set of PCR values and link the updated set of PCR values and the decryption key.