Password management outside of a BIOS
View Patent ↗In accordance with at least one presently preferred embodiment of the present invention, there is broadly contemplated herein the managing of a POP not solely in the BIOS but at least partly in a more secure location. In accordance with a particularly preferred embodiment of the present invention, this location could be in a NVRAM (non-volatile random access memory) inside a TPM (trusted platform module). Most preferably, this location will contain code that the BIOS preferably will need to access and employ in order to complete the booting of the system.
1. A method comprising:
receiving a power-on password input at a BIOS, said power-on password input not being stored in said BIOS;
transmitting said power-on password input to a second location for authentication; and
authenticating the power-on password input at the second location, the second location being different from the BIOS;
transmitting the power-on password input together with a supplementary component to the second location for authentication;
transmitting an authorization request to the second location; and
receiving an output from the second location;
wherein said authenticating further comprises processing the output from the second location to create the supplementary component.
2. The method according to claim 1 , wherein said authenticating comprises authenticating the password input at a TPM.
3. The method according to claim 1 , wherein said processing comprises performing an HMAC procedure.
4. The method according to claim 3 , wherein said authenticating further comprises performing another HMAC procedure at the second location subsequent to transmission of the password input and supplementary component to the second location.
5. The method according to claim 1 , wherein said receiving of an output comprises receiving a random number from the second location.
6. The method according to claim 1 , further comprising the step of transmitting a return value from the second location to the BIOS responsive to successful authentication of the password input.
7. The method according to claim 6 , wherein the return value enables access to a hard drive.
8. A system comprising:
a main memory;
a BIOS configured to receive a power-on password input, said power-on password input not being stored in said BIOS;
an authenticator configured to authenticate the power-on password input, said authenticator being located differently from the BIOS;
said BIOS configured to transmit the power-on password input together with a supplementary component to the second location for authentication;
wherein said BIOS is configured to:
transmit an authorization request to said authenticator; and
receive an output from said authenticator;
wherein said BIOS is further configured to process the output from said authenticator to create the supplementary component.
9. The system according to claim 8 , wherein said authenticator comprises a TPM.
10. The system according to claim 8 , wherein said BIOS is configured to process the output from said authenticator via performing an HMAC procedure.
11. The system according to claim 10 , wherein authenticator is configured to perform another HMAC procedure subsequent to transmission of the password input and supplementary component to said authenticator.
12. The system according to claim 8 , wherein the output from said authenticator comprises a random number.
13. The system according to claim 8 , wherein said authenticator is further configured to transmit a return value to the BIOS responsive to successful authentication of the password input.
14. The system according to claim 13 , wherein the return value enables access to a hard drive.
15. A non-signal program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform acts comprising:
receiving a power-on password input at a BIOS, said power-on password input not being stored in said BIOS;
transmitting said power-on password input to a second location for authentication; and
authenticating the power-on password input at the second location, the second location being different from the BIOS;
transmitting the power-on password input together with a supplementary component to the second location for authentication;
transmitting an authorization request to the second location; and
receiving an output from the second location;
wherein said authenticating further comprises processing the output from the second location to create the supplementary component.