Smart Card Secure Single Sign-On for Computer Boot Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face the inconvenience of remembering multiple passwords for power-on, hard-drive, and operating system access, increasing the likelihood of misplacement and prolonging the time required to boot up a secured computer system.
Innovation Solution
Pre-boot passwords are stored in a secure smart card area, with the operating system password encrypted as a blob in a non-secure area, allowing single sign-on by decrypting the blob upon correct PIN entry, enabling secure boot and logon using a Trusted Platform Module for authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple passwords are used for power-on, hard-drive, and operating system access, then security is enhanced, but the number of passwords to remember increases and boot time is prolonged
Solution Approach 1:
The patent combines multiple password storage locations into a single smart card. The smart card contains both secure storage (for pre-boot passwords) and non-secure storage (for operating system password), merging what were previously separate authentication mechanisms into one unified device that users carry and interact with through a single interface
2Reliability
If multiple passwords are stored in separate locations, then security is maintained, but the boot process becomes more complex and time-consuming
Solution Approach 1:
The system performs preliminary authentication actions during the boot process by first validating the pre-boot password from secure storage on the smart card before proceeding to load the operating system. This staged approach ensures security requirements are met while automating the sequence to minimize user intervention time and overall boot duration
Solution Approach 2:
The boot process is segmented into distinct phases: pre-boot authentication using secure storage, then operating system loading, and finally OS-level authentication if needed. This segmentation allows each security check to be performed efficiently in isolation rather than as a single prolonged process, reducing overall boot time while maintaining security
3Productivity
If passwords are stored in non-secure areas for easy access, then boot time is reduced, but security is compromised
Solution Approach 1:
The smart card implements local quality by providing different storage areas with different security characteristics within the same device. The secure storage area protects pre-boot passwords with high security, while the non-secure storage area holds operating system password data that can be quickly accessed. Each area's security level matches its specific security requirements, optimizing both security and boot performance
Data Source
AI summary
A method for providing a secure single sign-on to a computer system is disclosed. Pre-boot passwords are initially stored in a secure storage area of a smart card. The operating system password, which has been encrypted to a blob, is stored in a non-secure area of the smart card. After the smart card has been inserted in a computer system, a user is prompted for a Personal Identification Number (PIN) of the smart card. In response to a correct smart card PIN entry, the blob stored in the non-secure storage area of the smart card is decrypted to provide the operating system password, and the operating system password along with the pre-boot passwords stored in the secure storage area of the smart card are then utilized to log on to the computer system.