Systems and methods for providing secure pre-boot and root authentication to an information handling system
View Patent ↗In accordance with embodiments of the present disclosure, a method may include receiving a unique identifier associated with a host information handling system. The method may also include, responsive to receiving the unique identifier, communicating a signed unique identifier to the host information handling system, the signed unique identifier comprising the unique identifier signed with a private key. The method may further include enabling at least one of pre-boot access and root access by a client information handling system to an access controller responsive to the access controller decrypting the signed unique identifier with a public key corresponding to the private key and determining that the decrypted signed unique identifier and the unique identifier match.
1. An authenticator module for providing secure authentication between a client information handling system and an access controller of a host information handling system, comprising:
a communication interface for communicatively coupling the authenticator module to the access controller;
a control module in communication with the communication interface, and configured to:
receive a unique identifier associated with the host information handling system;
responsive to receiving the unique identifier, determine if any unexpired entry associated with the unique identifier is stored in an identifier table stored on computer-readable media accessible to the control module;
responsive to determining that an unexpired entry associated with the unique identifier is stored in the identifier table, retrieve a signed unique identifier from the identifier table;
responsive to determining no unexpired entry associated with the unique identifier is stored in the identifier table:
communicate the unique identifier to the client information handling system; and
receive the signed unique identifier and an expiration time from the client information handling system;
communicate a signed unique identifier to the host information handling system, the signed unique identifier comprising the unique identifier signed with a private key; and
alone or in concert with the access controller, enable at least one of pre-boot access and root access by the client information handling system to the host information handling system responsive to the access controller decrypting the signed unique identifier with a public key corresponding to the private key and determining that the decrypted signed unique identifier and the unique identifier match.
2. The authenticator module of claim 1 , wherein the authenticator module is a physical dongle configured to couple to a communication interface of the host information handling system.
3. The authenticator module of claim 1 , wherein the authenticator module is embodied by a program of instructions stored on computer-readable media of the client information handling system and executable by the client information handling system.
4. The authenticator module of claim 1 , further comprising a second communication interface for communicatively coupling the authenticator module to the client information handling system.
5. The authenticator module of claim 1 , wherein the first communication interface comprises a network interface.
6. The authenticator module of claim 1 , wherein the first communication interface comprises a serial data port.
7. The authenticator module of claim 1 , wherein the unique identifier is a random number.
8. The authenticator module of claim 1 , wherein the client information handling system receives the signed unique identifier from a signing server in response to communicating the unique identifier to the signing server.
9. A method comprising:
receiving a unique identifier associated with a host information handling system;
responsive to receiving the unique identifier, determining if any unexpired entry associated with the unique identifier is stored in an identifier table stored on computer-readable media accessible to the control module;
responsive to determining that an unexpired entry associated with the unique identifier is stored in the identifier table, retrieving a signed unique identifier from the identifier table; and
responsive to determining no unexpired entry associated with the unique identifier is stored in the identifier table:
communicating the unique identifier to the client information handling system; and
receiving the signed unique identifier and an expiration time from the client information handling system;
communicating a signed unique identifier to an access of the host information handling system, the signed unique identifier comprising the unique identifier signed with a private key; and
enabling at least one of pre-boot access and root access by a client information handling system to the host information handling system responsive to the access controller decrypting the signed unique identifier with a public key corresponding to the private key and determining that the decrypted signed unique identifier and the unique identifier match.
10. The method of claim 9 , wherein the unique identifier is a random number.
11. The method of claim 9 , wherein the client information handling system receives the signed unique identifier from a signing server in response to communicating the unique identifier to the signing server.
12. An article of manufacture comprising:
a computer readable medium; and
computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
receive a unique identifier associated with a host information handling system;
responsive to receiving the unique identifier, determine if any unexpired entry associated with the unique identifier is stored in an identifier table stored on computer-readable media accessible to the control module;
responsive to determining that an unexpired entry associated with the unique identifier is stored in the identifier table, retrieve a signed unique identifier from the identifier table;
responsive to determining no unexpired entry associated with the unique identifier is stored in the identifier table:
communicate the unique identifier to the client information handling system; and
receive the signed unique identifier and an expiration time from the client information handling system;
communicate a signed unique identifier to an access of the host information handling system, the signed unique identifier comprising the unique identifier signed with a private key; and
enable at least one of pre-boot access and root access to the host information handling system by a client information handling system responsive to the access controller decrypting the signed unique identifier with a public key corresponding to the private key and determining that the decrypted signed unique identifier and the unique identifier match.
13. The article of claim 12 , wherein the unique identifier is a random number.
14. The article of claim 12 , wherein the client information handling system receives the signed unique identifier from a signing server in response to communicating the unique identifier to the signing server.