Pre-boot Authentication via Trusted Execution Environment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication protocols are vulnerable to brute force attacks, particularly due to increased processing speeds and the use of technologies like GPGPU and FPGAs, which can rapidly crack passwords, necessitating a more secure method to protect biometric and bio-behavioral data.
Innovation Solution
Establishing a cryptographic trusted channel between a data acquisition device and a trusted execution environment (TEE) to securely collect and verify authentication factors during the pre-boot phase, allowing for single sign-on and secure post-boot access without re-identification, using lightweight crypto primitives suitable for wearables and devices with limited processing capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication protocols are used, then ease of operation is maintained, but security is compromised due to vulnerability to brute force attacks
Solution Approach 1:
The patent implements pre-boot authentication that occurs before the operating system loads, establishing security credentials in advance. This preliminary action ensures that even if the OS is compromised, the core authentication credentials remain protected, resolving the contradiction by maintaining security without affecting post-boot operational ease
Solution Approach 2:
The patent introduces a trusted execution environment (TEE) as an intermediary layer between the user and the system. This TEE acts as a secure mediator that handles authentication credentials independently from the main OS, providing enhanced security while maintaining ease of operation through seamless integration
2Reliability
If multifactor authentication is implemented, then security is improved, but device complexity increases
Solution Approach 1:
The patent combines multiple authentication factors (biometric data, possession credentials, knowledge factors) into a unified pre-boot authentication process. By merging these factors into a single integrated verification step before OS loading, the system achieves MFA security benefits without the complexity of managing multiple separate authentication systems
Solution Approach 2:
The trusted execution environment automatically manages and verifies multiple authentication factors without requiring user coordination between different authentication systems. The TEE self-services the authentication process by independently verifying credentials and making access decisions, reducing the complexity burden on the user
3Speed
If biometric data is stored locally, then authentication speed is improved, but security is worsened due to potential data compromise
Solution Approach 1:
The patent performs biometric verification in advance during pre-boot authentication before the operating system gains control. This preliminary verification ensures that only authenticated users can boot the system, providing both speed (early verification) and security (credentials protected from OS-level threats)
Solution Approach 2:
The trusted execution environment serves as a secure intermediary that stores and processes biometric data independently from the main operating system. This mediation allows fast local biometric matching while protecting the data from OS compromises, as the TEE maintains cryptographic isolation
Data Source
AI summary
An input device of a secure authentication protocol system may receive at least one user authentication factor in a pre-boot session. The input device may verify the received authentication factors and may store the verified authentication factors. During a post-boot session, the input device may communicate the verified authentication factor and a stored post-boot session credential received during a prior post-boot session to an authentication engine executing in a trusted execution environment. The authentication engine verifies the received post-boot session credential is logically associated with an immediately preceding post-boot session. Upon successful verification of the received post-boot session credential, the verified authentication factors or data indicative of a successfully verified authentication factor received during the pre-boot session are used in the current post-boot session.