Method and apparatus for providing centralized user authorization to allow secure sign-on to a computer system
View Patent ↗A method for providing centralized user authorization to allow secure sign-on to a computer system is disclosed. In response to a user attempting to boot up a computer system, a message is sent to a trusted server by a hypervisor within the computer to request a new hard drive password for the computer system. If the user is not authorized to access the computer system, a packet is sent by the trusted server to instruct the hypervisor to stop any boot process on the computer system. If the user is authorized to access the computer system, a packet containing a partial hard drive password is sent by the trusted server to the computer system. The packet is then encrypted with a system public key by the computer system to yield the partial hard drive password. The computer system subsequently combines the partial hard drive password with a user password to generate a new complete hard drive password to continue with the boot process.
1. A computer-implemented method comprising:
in response to a user attempting to boot up a computer system, sending a message to a server by a hypervisor within said computer system to request a new hard drive password for said computer system;
if said server determines that said user is not authorized to access said computer system, sending a packet by said server to instruct said hypervisor to stop any boot process on said computer system;
if said server determines that said user is authorized to access said computer system,
sending a packet containing a partial hard drive password by said server;
combining said partial hard drive password with a user password by said computer system to generate a complete hard drive password; and
sending said complete hard drive password to a hard drive of said computer system to continue boot process.
2. The computer-implemented method of claim 1 , wherein said packet is encrypted with a system public key.
3. The computer-implemented method of claim 2 , wherein said method further includes decrypting said packet by said computer system to yield said partial hard drive password using a public key.
4. The computer-implemented method of claim 3 , wherein said public key is stored in a Trusted Platform Module within said computer system.
5. The computer-implemented method of claim 1 , wherein said combining further includes requesting said user password from said user.
6. A computer usable medium having a computer program product for providing centralized user authentication to allow secure sign-on to a computer system, said computer usable medium comprising:
computer program code for, in response to a user attempting to boot up a computer system, sending a message to a server by a hypervisor within said computer system to request a new hard drive password for said computer system;
computer program code for, if said server determines that said user is not authorized to access said computer system, sending a packet by said server to instruct said hypervisor to stop any boot process on said computer system;
computer program code for, if said server determines that said user is authorized to access said computer system,
sending a packet containing a partial hard drive password by said server;
combining said partial hard drive password with a user password by said computer system to generate a complete hard drive password; and
sending said complete hard drive password to a hard drive of said computer system to continue boot process.
7. The computer usable medium of claim 6 , wherein said packet is encrypted with a system public key.
8. The computer usable medium of claim 7 , wherein said computer usable medium further includes computer program code for decrypting said packet by said computer system to yield said partial hard drive password using a public key.
9. The computer usable medium of claim 8 , wherein said public key is stored in a Trusted Platform Module within said computer system.
10. The computer usable medium of claim 6 , wherein said computer program code for combining further includes computer program code for requesting said user password from said user.
11. An apparatus comprising:
a hardware structure;
a hypervisor configured to, in response to a user attempting to boot up a computer system, sending a message to a server to request a new hard drive password for said computer system;
wherein said server, after said server has determined that said user is not authorized to access said computer system, sends a packet to instruct said hypervisor to stop any boot process on said computer system;
wherein said server, after said server has determined that said user is authorized to access said computer system,
sends a packet containing a partial hard drive password by said server;
combines said partial hard drive password with a user password by said computer system to generate a complete hard drive password; and
sends said complete hard drive password to a hard drive of said computer system to continue boot process.
12. The apparatus of claim 11 , wherein said packet is encrypted with a system public key.
13. The apparatus of claim 12 , wherein said apparatus further includes a public key for decrypting said packet to yield said partial hard drive password.
14. The apparatus of claim 13 , wherein said public key is stored in a Trusted Platform Module within said computer system.
15. The apparatus of claim 11 , wherein said server also requests said user password from said user.