Pre-OS Authentication Using TOTP Displayable Identifier
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing pre-OS authentication methods, such as BIOS boot passwords, are inadequate due to weak password choices, limited configurability, and impractical central management, especially in systems like ATMs that lack network access, requiring secure password rotation and storage.
Innovation Solution
Implementing a time-based one-time password (TOTP)-style rotating password system using a shared secret, where a displayable identifier encoding the system identifier, time, and encrypted secret is displayed, allowing a mobile device to generate the access password for booting the operating system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If fixed passwords are used for pre-OS authentication, then authentication is implemented, but security is weak due to poor password choices and lack of rotation
Solution Approach 1:
The patent implements dynamic password rotation using TOTP (Time-based One-Time Password) technology. Instead of static passwords, the system generates time-varying passwords that automatically expire and change, eliminating the need for manual password rotation while maintaining strong security. The password changes based on time and a shared secret, making it dynamic rather than fixed.
Solution Approach 2:
The system enables self-service password management through automated TOTP generation on the client device. The client application automatically generates and updates passwords without requiring administrative intervention or central management infrastructure. This eliminates the burden of manual password distribution and rotation while maintaining security.
2Adaptability or versatility
If central management of boot passwords is implemented, then password rotation is possible, but it requires network access and management infrastructure that many systems lack
Solution Approach 1:
The patent extracts the password management functionality from the central infrastructure and places it locally on the client device. The TOTP secret is stored on the client device itself, and the password generation occurs locally without requiring network access or central management servers. This eliminates the need for complex management infrastructure while maintaining password rotation capability.
Solution Approach 2:
The system segments the authentication process into two parts: the server stores only the shared secret and verification logic, while the client device stores its own TOTP secret and generates passwords locally. This segmentation allows independent operation without requiring continuous network connectivity or central management infrastructure.
3Reliability
If users must store and remember rotated passwords, then security can be maintained, but users must write down and securely share passwords
Solution Approach 1:
The patent replaces the mechanical system of manual password writing and physical security with an electronic TOTP generation system. The client application automatically generates passwords based on time and stored secret, eliminating the need for users to write down or manually manage passwords. The system substitutes human memory and physical security measures with automated cryptographic processes.
Data Source
AI summary
An information handling system may include at least one processor, an input device, and a display device. The information handling system may be configured to: prior to booting an operating system, display a displayable identifier on the display device, wherein the displayable identifier encodes information indicative of a system identifier of the information handling system, a time, and an encrypted shared secret, and wherein the displayable identifier is usable by a mobile information handling system to determine an access password for the information handling system; and in response to receiving the access password at the input device, booting the operating system.