Secure resume for encrypted drives
View Patent ↗Systems, methods and products are described that provide secure resume for encrypted drives. One aspect provides a method including: receiving an indication to resume from a suspended state at a computing device; responsive to authenticating a user at one or more input devices, accessing a value in a BIOS derived from authenticating the user at the one or more input devices; responsive to accessing the value, releasing a credential for unlocking one or more encrypted drives; and thereafter proceeding to resume from the suspend state.
1. A method comprising:
in a boot process at a computing device, setting up an alternate credential in a pre-boot environment, wherein the pre-boot environment includes master boot record shadowing;
after the boot process, receiving an indication to resume from a suspended state at the computing device;
responsive to authenticating a user at one or more input devices, accessing a value in a BIOS derived from authenticating the user at the one or more input devices;
responsive to accessing the value, releasing the alternate credential for unlocking one or more encrypted drives; and
thereafter proceeding to resume from the suspend state.
2. The method according to claim 1 , wherein the one or more input devices comprise a biometric device.
3. The method according to claim 1 , wherein the one or more input devices comprise a fingerprint reader.
4. The method according to claim 1 , wherein one or more input devices comprise a smart card reader.
5. The method according to claim 1 , wherein the suspend state is S3.
6. The method according to claim 1 , wherein the one or more encrypted drives comprises one or more self-encrypting drives.
7. The method according to claim 1 , wherein the value derived from authenticating the user at the one or more input devices is a hash.
8. The method according to claim 7 , further comprising:
comparing a hash of the alternate credential with the hash of the value derived from authenticating the user at the one or more input devices;
wherein said releasing the alternate credential for unlocking an encrypted drive occurs responsive to a match between the hash of the alternate credential and the hash of the value derived from authenticating the user at the one or more input devices.
9. The method according to claim 1 , wherein the alternate credential is stored in a secure form.
10. The method according to claim 9 , wherein the secure form is releasable using the value derived from authenticating the user at the one or more input devices.
11. A system comprising:
one or more processors;
one or more encrypted drives; and
one or more input devices;
wherein, responsive to execution of computer program instructions accessible to the one or more processors, the one or more processors are configured to:
in a boot process at the system, setting up an alternate credential in a pre-boot environment, wherein the pre-boot environment includes master boot record shadowing;
after the boot process, receive an indication to resume from a suspended state;
responsive to authenticating a user at one or more input devices, access a value in a BIOS derived from authenticating the user at the one or more input devices;
responsive to accessing the value, release the alternate credential for unlocking the one or more encrypted drives; and
thereafter proceed to resume the system from the suspend state.
12. The system according to claim 11 , wherein the one or more input devices comprise a biometric device.
13. The system according to claim 11 , wherein the one or more input devices comprise a fingerprint reader.
14. The system according to claim 11 , wherein the one or more input devices comprise a smart card reader.
15. The system according to claim 11 , wherein the suspend state is S3.
16. The system according to claim 11 , wherein the value derived from authenticating the user at the one or more input devices is a hash.
17. The system according to claim 16 , wherein, responsive to execution of computer program instructions accessible to the one or more processors, the one or more processors are further configured to:
compare a hash of the alternate credential with the hash of the value derived from authenticating the user at the one or more input devices;
wherein the alternate credential for unlocking an encrypted drive is released responsive to a match between the hash of the alternate credential and the hash of the value derived from authenticating the user at the one or more input devices.
18. The system according to claim 11 , wherein the alternate credential is stored in a secure form.
19. The system according to claim 18 , wherein the secure form is releasable using the value derived from authenticating the user at the one or more input devices.
20. A computer program product comprising:
a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
computer readable program code configured to, in a boot process at a computing device, setting up an alternate credential in a pre-boot environment, wherein the pre-boot environment includes master boot record shadowing;
computer readable program code configured to, after the boot process, receive an indication to resume from a suspended state at the computing device;
computer readable program code configured to, responsive to authenticating a user at one or more input devices, access a value in a BIOS derived from authenticating the user at the one or more input devices;
computer readable program code configured to, responsive to accessing the value, release the credential for unlocking one or more encrypted drives; and
computer readable program code configured to thereafter proceed to resume from the suspend state.