Pre-boot Credential Passing for Encrypted Disk Single Sign-on
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-user operating systems, the requirement for double credential entry to access encrypted disk storage is cumbersome and inefficient, especially when the OS needs to boot without a user present, leading to issues with booting and user authentication in managed environments.
Innovation Solution
A communication path is established between a pre-operating system component and the logon component to pass credentials, allowing for a single login by using a protected database of authorized users updated by the domain administration system during boot to authenticate users and derive disk encryption keys, eliminating the need for repeated credential entry.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption of the whole disk is used with key derivation from user credentials, then data security is improved, but the system requires double credential entry and cannot boot without a user present
Solution Approach 1:
The patent segments the credential verification process into two distinct phases: pre-boot phase (for disk decryption) and post-boot phase (for user logon). By separating these functions and implementing a pre-logon component that can verify credentials before the full OS loads, the system allows the disk to be encrypted while enabling automatic credential passing to avoid double entry for the same user.
Solution Approach 2:
The patent implements preliminary credential verification by a pre-logon component before the operating system fully boots. This preliminary action stores the verified credential in a protected memory location, allowing the subsequent logon component to retrieve and use it automatically, thereby eliminating the need for users to re-enter credentials after system boot.
2Ease of operation
If a pre-operating system component passes credentials to the logon component, then single sign-on is achieved, but system complexity increases
Solution Approach 1:
The patent implements a universal credential storage mechanism using a protected database (such as a registry hive) that serves multiple purposes: storing pre-logon verified credentials, providing them to the logon component, and maintaining user authentication information. This multi-functional approach consolidates what could be separate complex systems into a unified credential management infrastructure.
Solution Approach 2:
The patent introduces a protected database as an intermediary between the pre-logon component and the logon component. Instead of direct complex communication between components, the credential is stored in this intermediary protected storage mechanism, simplifying the interaction model while maintaining security through the protected nature of the database.
3Adaptability or versatility
If a protected database of authorized users is updated by domain administration, then multi-user support is improved, but boot authentication complexity increases
Solution Approach 1:
The patent implements a dynamic credential verification process where the pre-logon component can adapt to different authentication scenarios. The system dynamically determines whether to use locally stored credentials from the protected database or to perform additional verification based on domain policies, allowing flexibility in supporting both standalone and domain-joined multi-user environments without requiring separate boot processes.
Data Source
AI summary
A method of avoiding a second login of user information in an encrypted disk computer system includes a communications path for transferring user login information. The login information is acquired and used by a first software module which authenticates the user to decrypt a disk with an encrypted operating system. The same login information is transferred using the communications channel to a second use which logs the user into the decrypted operating system. The method also supports multiple users through maintenance of multiple users credentials.