Extensible pre-boot authentication

• US 8,201,239 B2
• Filed: 06/23/2008
• Issued: 06/12/2012
• Est. Priority Date: 06/23/2008
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Smith, Ned, Zimmer, Vincent J.
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): Le, David
• Application Number:
  US12/214,830
• Publication Number:
  US 20090319806A1
• Time in Patent Office: 1,450 Days
• Field of Search: 713/193, 713/1, 713/2, 713/187, 713/189, 726 17- 21
• US Class Current: 726/16
• CPC Class Codes: G06F 21/575 Secure boot

Abstract

In one embodiment, the present invention includes a method for obtaining a pre-boot authentication (PBA) image from a full disk encryption disk in a pre-boot environment, executing the PBA using a chipset to obtain user credential information, authorizing the user based on the user credential information and stored credential information, and storing the user credential information in a PBA metadata region of the disk. Other embodiments are described and claimed.

Claims

1. A method comprising:

obtaining a pre-boot authentication (PBA) image from a non-volatile storage in a pre-boot environment, wherein the non-volatile storage is configured with full disk encryption (FDE);

executing the PBA image using an engine of a chipset to obtain user credential information from a user; and

controlling access to a PBA metadata region of the non-volatile storage using the engine based on the user credential information and stored credential information, and storing the user credential information in the PBA metadata region.

2. The method of claim 1, further comprising receiving a request for the PBA image from a pre-boot software agent, and verifying the PBA image responsive to the request.

3. The method of claim 2, wherein the PBA image comprises a unified extensible firmware interface (UEFI)-hosted PBA, and obtaining the user credential information via a trusted path.

4. The method of claim 3, further comprising publishing credential drivers to enable the UEFI-hosted PBA to access hardware capabilities of the chipset.

5. The method of claim 1, further comprising receiving the user credential information from a first application that executes on an operating system that is unaware of the PBA metadata region, and authorizing the first application to access the PBA metadata region using the engine.

6. The method of claim 5, further comprising updating the stored credential information in the PBA metadata region using the authorized first application.

7. The method of claim 6, further comprising thereafter executing the PBA in a later pre-boot environment, wherein the user credential information to be obtained is of a different security policy responsive to the updated stored credential information.

8. An article comprising a machine-accessible storage medium including instructions that when executed cause a system to:

receive a request from a pre-boot authentication (PBA) agent in a pre-boot environment of the system to store a PBA context into a PBA region of a non-volatile storage, wherein the PBA region is unencrypted and is hidden from view of non-PBA agents; and

write the PBA context to the PBA region using security firmware of a chipset coupled to the non-volatile storage.

9. The article of claim 8, further comprising instructions that enable the system to transition from the pre-boot environment to a boot environment and launch an operating system, the operating system unaware of the PBA region and unable to exchange authentication information between the pre-boot environment and a post-boot environment using an extensible firmware interface.

10. The article of claim 9, further comprising instructions that enable the system to:

receive a request from a post-boot agent to obtain the PBA context; and

access the PBA context and provide the PBA context to the post-boot agent using the security firmware and without operating system support.

11. The article of claim 10, further comprising instructions that enable the system to receive from the post-boot agent an update to the PBA context in the chipset firmware and to store the updated PBA context in the PBA region.

12. The article of claim 11, further comprising instructions that when executed enable the system to synchronize a state between the pre-boot agent and the post-boot agent using the PBA region to pass synchronization variables therebetween.

13. A system comprising:

a processor;

a chipset coupled to the processor and including a first engine to execute a pre-boot authorization module (PBAM); and

a mass storage coupled to the chipset, the mass storage configured for full disk encryption, wherein the mass storage has an encrypted region and a hidden region to store metadata for the PBAM, wherein the first engine is to access the hidden region to authorize a user during the execution of the PBAM in a pre-boot environment and to store pre-boot authentication (PBA) context in the hidden region.

14. The system of claim 13, wherein the processor is to transition from the pre-boot environment to a boot environment and launch an operating system, the operating system unaware of the hidden region.

15. The system of claim 14, wherein the first engine is to receive a request from a post-boot agent to obtain the PBA context, access the PBA context and provide the PBA context to the post-boot agent without operating system support.

16. The system of claim 15, wherein the first engine is to receive from the post-boot agent an update to the PBA context and store the updated PBA context in the hidden region.

17. The system of claim 15, wherein the first engine is to synchronize a state between the pre-boot agent and the PBAM using the hidden region to pass credential synchronization variables between the pre-boot environment and a post-boot environment.

18. The system of claim 14, wherein the first engine is to re-authorize the user during execution of a first application that executes in a post-boot environment, and authorize the first application to access the metadata.

19. The system of claim 18, wherein the first engine is to update the metadata using the authorized first application.

20. The system of claim 19, wherein the first engine is to execute the PBAM in a later pre-boot environment, wherein the user authorization is of a different security policy responsive to the updated metadata.