Platform authentication via a transparent second factor

• US 20080148388A1
• Filed: 10/25/2006
• Published: 06/19/2008
• Est. Priority Date: 10/25/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ureche, Tony, Maclver, Douglas M., Wooten, David R., Thom, Stefan, Holt, Erik, Sledz, Dan
• Granted Patent: US 8,200,952 B2
• Time in Patent Office: Days
• US Class Current: 726/17
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06Q 20/3415 Cards acting autonomously as pay-media
• CPC Class Codes: G06Q 20/3563 Software being resident on card
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

Firmware of a system is configured to allow secondary devices, such as a smart card, to be used for authentication. In an example embodiment, the secondary device is a CCID smart card in compliance with the ISO 7816 specification. The smart card is inserted into a card reader coupled to the system prior to booting the system. The firmware comprises an emulator and driver configured to allow authentication information from the smart card to be utilized to allow execution of the boot process. In an example embodiment, the smart card comprises external keys for use with BITLOCKER™. The secondary device is compatible with systems implementing a BIOS and with systems implementing EFI. Authentication also can be accomplished via devices that do not provide data storage, such as a biometric device or the like.

Claims

1. A platform authenticating system comprising:

at least one of a BIOS portion and an EFI portion comprising;

a block device emulator configured to;

detect a block device coupled to the system; and

open a file on the block device; and

a block device driver configured to access information on the block device.

2. A system in accordance with claim 1, wherein the block device comprises a smart card.

3. A system in accordance with claim 2, wherein the block device comprises a CCID smart card.

4. A system in accordance with claim 1, wherein the block device comprises a USB compatible block device.

5. A system in accordance with claim 1, wherein the block device comprises a PCMCIA compatible block device.

6. A system in accordance with claim 1, wherein access to the information on the block device is protected.

7. A system in accordance with claim 1, wherein the block device comprises a biometric device.

8. A system in accordance with claim 7, wherein the information accessed on the biometric device comprises a token for allowing an execution of a boot process of the system.

9. A system in accordance with claim 7, wherein the block device comprises a fingerprint reader.

10. A system in accordance with claim 1, wherein the information accessed on the block device comprises keying information for allowing an execution of a boot process of the system.

11. A method for authenticating a platform via a block device, the method comprising:

detecting a block device via at least one of a BIOS portion of the platform and an EFI portion of the platform;

authenticating the detected block device;

retrieving information from the block device for allowing an execution of a boot process of the system.

12. A method in accordance with claim 11, wherein the block device comprises at least one of a smart card and a CCID smart card.

13. A method in accordance with claim 11, wherein the block device comprises at least one of a USB compatible block device and a PCMCIA compatible block device.

14. A method in accordance with claim 11, further comprising providing an indication of authorization for retrieving the information from the block device.

15. A method in accordance with claim 11, wherein the block device comprises at least one of a biometric device and a fingerprint reader.

16. A computer-readable medium, having computer-executable instruction stored thereon for authenticating a platform via a block device by performing the steps of:

detecting a block device via a block device emulator of at least one of a BIOS portion of the platform system and an EFI portion of the platform; and

opening a file on the block device via the block device emulator; and

accessing, via a block driver of the least one BIOS portion and EFI portion, information on the block device.

17. A computer-readable medium in accordance with claim 16, wherein the block device comprises at least one of a smart card and a CCID smart card.

18. A computer-readable medium in accordance with claim 16, wherein the block device comprises at least one of a USB compatible block device and a PCMCIA compatible block device.

19. A computer-readable medium in accordance with claim 16, wherein the block device comprises at least one of a biometric device and a fingerprint reader.

20. A computer-readable medium in accordance with claim 16, wherein the information accessed on the block device comprises keying information for allowing an execution of a boot process of the system.