Secure boot with minimum number of re-boots
View Patent ↗Systems, methods and products are described that provide secure boot with a minimum number of re-boots. One aspect provides a method including receiving an indication to boot from a power off state at a computing device; responsive to authenticating a user at one or more input devices, releasing a value derived from authenticating the user at the one or more input devices; responsive to releasing the value, unlocking one or more encrypted drives with a previously established alternate credential; and thereafter proceeding to boot from the power off state. By not having to call the non-BIOS software each boot, this minimizes the number of reboots for each boot cycle.
1. A method comprising:
in an initial boot process at a computing device, setting up an alternate credential in a pre-boot environment, wherein the pre-boot environment includes master boot record shadowing;
after the initial boot process, receiving an indication to boot from a power off state at the computing device;
responsive to authenticating a user at one or more input devices, releasing a value derived from authenticating the user at the one or more input devices;
responsive to releasing the value, unlocking one or more encrypted drives with the previously established alternate credential; and
thereafter proceeding to boot from the power off state.
2. The method according to claim 1 , wherein the one or more input devices comprise a biometric device.
3. The method according to claim 1 , wherein the one or more input devices comprise a fingerprint reader.
4. The method according to claim 1 , wherein one or more input devices comprise a smart card reader.
5. The method according to claim 1 , wherein the power off state is one of S4 and S5.
6. The method according to claim 1 , wherein the one or more encrypted drives comprise one or more self-encrypting drives encrypted with the previously established alternate credential.
7. The method according to claim 1 , wherein the value derived from authenticating the user at the one or more input devices is a hash.
8. The method according to claim 7 , further comprising:
comparing a hash of the alternate credential with the hash of the value derived from authenticating the user at the one or more input devices;
wherein said unlocking occurs responsive to a match between said hashes.
9. The method according to claim 8 , wherein the alternate credential is stored in a secure form and subsequently converted into a useable form.
10. A system comprising:
one or more processors;
one or more encrypted drives; and
one or more input devices;
wherein, responsive to execution of computer program instructions accessible to the one or more processors, the one or more processors are configured to:
in an initial boot process, set UP an alternate credential in a pre-boot environment, wherein the pre-boot environment includes master boot record shadowing;
after the initial boot process, receive an indication to boot from a power off state of the system;
responsive to authenticating a user at one or more input devices, release a value derived from authenticating the user at the one or more input devices;
responsive to releasing the value, unlock one or more encrypted drives with the previously established alternate credential; and
thereafter proceed to boot from the power off state.
11. The system according to claim 10 , wherein the one or more input devices comprise a biometric device.
12. The system according to claim 10 , wherein the one or more input devices comprise a fingerprint reader.
13. The system according to claim 10 , wherein the one or more input devices comprise a smart card reader.
14. The system according to claim 10 , wherein the power off state is one of S4 and S5.
15. The system according to claim 10 , wherein the value derived from authenticating the user at the one or more input devices is a hash.
16. The system according to claim 15 , wherein, responsive to execution of computer program instructions accessible to the one or more processors, the one or more processors are further configured to:
compare a hash of the alternate credential with the hash of the value derived from authenticating the user at the one or more input devices;
wherein said unlocking occurs responsive to a match between said hashes.
17. The system according to claim 16 , wherein the alternate credential is stored in a secure form and subsequently converted into a useable form.
18. A computer program product comprising:
a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
computer readable program code configured to, in an initial boot process at a computing device, set up an alternate credential in a pre-boot environment, wherein the pre-boot environment includes master boot record shadowing;
computer readable program code configured to, after the initial boot process, receive an indication to boot from a power off state at a computing device;
computer readable program code configured to, responsive to authenticating a user at one or more input devices, release a value derived from authenticating the user at the one or more input devices;
computer readable program code configured to, responsive to releasing the value, unlock one or more encrypted drives with the previously established alternate credential; and
computer readable program code configured to thereafter proceed to boot from the power off state.