Encrypted Storage Boot Access via Secure-Memory Password Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption systems for storage devices in computing devices face challenges in securely managing passwords for encrypted data, particularly during device updates, which can alter the BIOS and disrupt access, and require manual or network-dependent password inputs, leading to security vulnerabilities and update failures.
Innovation Solution
A system where a password is stored in a secure memory and managed by a controller using a private key, with validity information, allowing automatic decryption without user intervention, and enabling password deletion after use or invalidation, ensuring secure and uninterrupted access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a password is stored in secure memory for automatic decryption, then ease of operation is improved, but security may be compromised if the password is exposed
Solution Approach 1:
The password is stored in advance in secure memory (TPM) in an encrypted form, and the system is pre-configured to automatically retrieve and use this password during boot processes. This preliminary setup eliminates the need for manual password input while maintaining security through encrypted storage and controlled access mechanisms.
Solution Approach 2:
The patent introduces an intermediary mechanism where the password is not stored in plaintext but is instead encrypted and stored in a secure memory component (TPM). The password is released only through a controlled decryption process that verifies system integrity, thus mediating between the need for automatic access and security protection.
2Adaptability or versatility
If BIOS updates are performed, then adaptability is improved, but security may be compromised as BIOS alteration triggers unauthorized access detection
Solution Approach 1:
The system pre-stores the password in secure memory before any BIOS updates occur. This preliminary preparation ensures that when BIOS updates are performed, the password is already available in the secure storage, preventing security checks from failing due to BIOS alterations and allowing updates to proceed without triggering unauthorized access detection.
Solution Approach 2:
The patent implements a cushioning mechanism by storing the password in advance in a secure, protected environment (TPM). This creates a buffer that protects against security check failures during BIOS updates, as the password remains accessible even when the BIOS is altered, thus cushioning the system against potential security disruptions.
3Ease of operation
If network-dependent automatic password input is used, then ease of operation is improved, but reliability deteriorates when network is unavailable
Solution Approach 1:
The patent extracts the password storage function from the network-dependent secure storage server and places it locally within the device's own secure memory (TPM). This extraction eliminates the dependency on network connectivity, as the password is now stored locally and can be retrieved automatically regardless of network availability, thereby improving reliability while maintaining ease of operation.
4Reliability
If manual password input is required, then security is improved, but productivity deteriorates due to cumbersome input process
Solution Approach 1:
The system implements self-service by automatically retrieving and inputting the password stored in secure memory during the boot process, eliminating the need for manual user intervention. This self-service mechanism maintains security through encrypted storage and controlled access while significantly improving productivity by removing the time-consuming manual password input step.
Data Source
AI summary
An example storage medium is described, wherein the storage medium comprises instructions that, when executed cause a processor of an electronic device to store a private key in a first memory of the electronic device. The controller also stores an encrypted version of a password and validity information defining a condition to the password's validity in a second memory of the electronic device. During a boot process of the electronic device, the controller may detect a failure to decrypt data stored in a third memory and, upon this detection, decrypt the encrypted version of the password using the private key, and determine, using the validity information, whether the password is valid. If the password is valid, the controller may input the decrypted password to a decryption service, wherein the decryption service is to decrypt the data stored in the third memory.