Pre-boot Recovery of a Locked Computer System

• US 20100169630A1
• Filed: 12/30/2008
• Published: 07/01/2010
• Est. Priority Date: 12/30/2008
• Status: Active Grant

• Current Assignee: Tahoe Research Limited (f/k/a Learndale Limited) (Vector Capital Corporation)
• Original Assignee: Intel Corporation
• Inventors: Prakash, Gyan, Hazra, Mousumi, Mirashrafi, Mojtaba, Dadu, Saurabh
• Granted Patent: US 8,296,554 B2
• Time in Patent Office: Days
• US Class Current: 713/2
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 9/4406 Loading of operating system

Abstract

Embodiments of the present disclosure provide methods, apparatuses, articles, and removable storage devices for pre-boot recovery of a locked computer system. Other embodiments may also be described and claimed.

Claims

1. A method comprising:

determining, by a basic input/output system (BIOS) of a computer system, on pre-boot, whether a removable storage device is attached to the computer system, wherein the computer system comprises a host operating environment and a manageability engine (ME) that operates independent of the host operating environment; and

on detection of the removable storage device, the BIOS transferring control to a pre-boot authentication (PBA) module stored on the removable storage device to interact with the ME to restore the computer system from a locked state to an unlocked state.

2. The method of claim 1, further comprising:

on detection of the removable storage device, determining, by the PBA module, whether the computer system is in the locked state.

3. The method of claim 2, further comprising:

on determining that the computer system is in the locked state, restoring the computer system from the locked state to the unlocked state.

4. The method of claim 3, wherein restoring the computer system from the locked state to the unlocked state comprises:

prompting a user to provide authentication credentials to the ME via the PBA module.

5. The method of claim 4, wherein the ME requires a public or private key for communication and wherein the PBA module comprises the public key or the private key to communicate with the ME.

6. The method of claim 4, wherein prompting the user to provide the authentication credentials comprises:

prompting the user for a server-generated pass phrase to restore the computer system from the locked state to the unlocked state.

7. The method of claim 1, further comprising:

determining, by the BIOS, whether the computer system is in the locked state.

8. The method of claim 7, further comprising:

shutting down the computer system, by the BIOS, if the BIOS determines that the computer system is in the locked state and the BIOS detects no PBA module to restore the computer system from the locked state to the unlocked state.

9. The method of claim 1, wherein the BIOS transferring control to a PBA module stored on the removable storage device further comprises the BIOS booting the computer system from a bootable environment stored on the removable storage device.

10. An apparatus comprising:

a host operating environment;

a manageability engine (ME) coupled to the host operating environment, but configured to operate independent of the host operating environment, the ME equipped to disable the apparatus on detection of a condition, and to re-enable the apparatus on authentication;

a peripheral interface configured to enable a removable storage device to be attached to the apparatus; and

a basic input/output system (BIOS) operatively coupled to the host operating environment, the ME, and the peripheral interface, and configured to determine, on pre-boot, whether a removable storage device is attached to the apparatus, and to transfer control, on detection of the removable storage device, to a pre-boot authentication (PBA) module stored on the removable storage device to interact with the ME to restore the apparatus from a disabled state to a re-enabled state.

11. The apparatus of claim 10, wherein the peripheral interface comprises a universal serial bus (USB).

12. The apparatus of claim 10, further comprising:

a central processing unit (CPU) configured to run the host operating environment and the BIOS; and

an embedded processor configured to run the ME.

13. The apparatus of claim 10, further comprising:

a local pre-boot authentication (PBA) module operatively coupled with the BIOS, the host environment, and the ME, to interact with the ME to restore the apparatus from the disabled state to the re-enabled state.

14. The apparatus of claim 10, wherein the BIOS is further configured to determine whether the apparatus is disabled by the ME.

15. The apparatus of claim 10, wherein the BIOS is further configured to shut down the apparatus when the apparatus is disabled by the ME and no PBA module is detected by the BIOS.

16. The apparatus of claim 10, wherein the BIOS is further configured to boot the apparatus from a bootable environment of the removable storage device.

17. The apparatus of claim 10, wherein the ME is configured to authenticate credentials via the PBA module to restore the apparatus from the disabled state to the re-enabled state.

18. The apparatus of claim 10, wherein the PBA module is configured to prompt a user to provide authentication credentials to the ME to restore the apparatus from the disabled state to the re-enabled state.

19. The apparatus of claim 10, wherein the ME requires a public key or private key for communication and wherein the PBA module comprises the public key or the private key to communicate with the ME.

20. An article of manufacture comprising:

a storage medium; and

a plurality of instructions stored in the storage medium configured to implement a basic input/output system (BIOS) for a digital device having a host operating environment and a manageability engine (ME) that operates independent of the host operating environment, the BIOS configured to detect, on pre-boot, whether a removable storage device is attached to the digital device, and to transfer control, on detection, to a pre-boot authentication (PBA) module stored on the removable storage device to interact with the ME to recover and return the digital device to a normal operating state from a stolen state.

21. The article of manufacture of claim 20, wherein the storage medium comprises non-volatile memory.

22. The article of manufacture of claim 20, further comprising another plurality of instructions stored in the storage medium configured to implement the ME, wherein the ME is configured to authenticate credentials via the PBA module to recover and return the digital device to the normal operating state from the stolen state.

23. The article of manufacture of claim 20, wherein the BIOS is further configured to determine whether the digital device is in the stolen state by querying the ME and to shut down the digital device if the digital device is in the stolen state and no PBA module is detected by the BIOS.

24. The article of manufacture of claim 20, wherein the BIOS is further configured to boot the digital device from a bootable environment of the removable storage device.

25. A removable storage device comprising:

a peripheral interface to attach the removable storage device to an electronic device;

non-volatile storage coupled to the peripheral interface; and

a pre-boot authentication (PBA) module stored in the non-volatile storage, configured to transfer control from pre-boot firmware of the electronic device, when the pre-boot firmware detects, on pre-boot, attachment of the removable storage device to the electronic device, and to interact with a manageability engine (ME) of the electronic device to restore the electronic device to an unprotected state from a protected state.

26. The removable storage device of claim 25, wherein the peripheral interface comprises a universal serial bus (USB) and wherein the non-volatile storage comprises flash memory.

27. The removable storage device of claim 25, wherein the PBA module is configured to prompt a user to provide authentication credentials to the ME to restore the electronic device from the protected state to the unprotected state.

28. The removable storage device of claim 25, wherein the ME requires a public key or private key for communication and wherein the PBA module comprises the public key or the private key to communicate with the ME.

29. The removable storage device of claim 25, wherein the pre-boot firmware is configured to determine whether the electronic device is in the protected state by querying the ME and to shut down the electronic device if the electronic device is in the protected state and no PBA module is detected by the pre-boot firmware.

30. The removable storage device of claim 25, wherein the pre-boot firmware is configured to boot the electronic device from a bootable environment of the removable storage device.