Force locking storage devices
A password protection module is added to a BIOS firmware initialization routine to lock a password protected device on a warm reset. The password protection module sets one or more variables associated with the operation of a password protected device. The variables enable password protection for the password protected device and enable a shift from an unlocked state to a locked state upon a warm reset.
1. A computer-implemented method for configuring a computing system to password protect a device connected to the computing system following a warm reset of the computing system, the method comprising:
determining, by way of a firmware executing on the computing system, whether the device supports password protection;
responsive to determining that the device supports password protection, setting a LockOnReset (LOR) variable in a table maintained by the device, whereby setting the LOR variable causes the device to be configured in a password-protected state following the warm reset of the computing system;
determining if a programmatic reset command to perform the warm reset of the computing system has been initiated, wherein the device is in an unlocked state following the warm reset; and
configuring the device in the password-protected state responsive to initiation of the programmatic reset command.
2. The computer-implemented method according to claim 1 , further comprising:
validating, by way of the firmware executing on the computing system, a user password entry;
responsive to determining that the user password entry is valid, shifting processing control from the firmware to an operating system loader; and
allowing operation of the device connected to the computing system by booting to an operating system.
3. The computer-implemented method according to claim 1 , further comprising:
validating, by way of the firmware executing on the computing system, a user password entry;
responsive to determining that the user password entry is invalid, determining whether a number of repeated invalid password entry attempts is greater than a predetermined threshold for invalid attempts; and
initiating, by way of the firmware, a scrubbing procedure responsive to determining that the number of repeated invalid password entry attempts is greater than the predetermined threshold for invalid attempts.
4. The computer-implemented method according to claim 3 , wherein the scrubbing procedure comprises erasing data on the device connected to the computing system.
5. A non-transitory computer-readable storage medium having instructions stored thereupon which, when executed by a processor, cause the processor to:
determine, by way of a firmware executing on the processor, whether a device supports password protection;
responsive to determining that the device supports password protection, set a LockOnReset (LOR) variable in a table maintained by the device, whereby setting the LOR variable causes the device to be configured in a password-protected state following a warm reset of the device;
determine if a programmatic reset command to perform the warm reset of the computing system has been initiated, wherein the device is in an unlocked state following the warm reset; and
configure the device in the password-protected state responsive to initiation of the programmatic reset command.
6. The non-transitory computer-readable storage medium according to claim 5 , having further instructions stored thereupon to:
validate, by way of the firmware executing on the computing system, a user password entry;
responsive to determining that the user password entry is valid, shift processing control from the firmware to an operating system loader; and
allow operation of the device connected to the computing system by booting to an operating system.
7. The non-transitory computer-readable storage medium according to claim 5 having further instructions stored thereupon to:
validate, by way of the firmware executing on the computing system, a user password entry;
responsive to determining that the user password entry is invalid, determine whether a number of repeated invalid password entry attempts is greater than a predetermined threshold for invalid attempts; and
initiate, by way of the firmware, a scrubbing procedure responsive to determining that the number of repeated invalid password entry attempts is greater than the predetermined threshold for invalid attempts.
8. The non-transitory computer-readable storage medium according to claim 7 , having further instructions stored thereupon to perform the scrubbing procedure by erasing data on the password protected device.
9. A computing system, comprising:
a processor; and
a non-transitory computer-readable storage medium having instructions stored thereupon which, when executed by the processor, cause the processor to
set a LockOnReset (LOR) variable in a table maintained by a device, whereby setting the LOR variable causes the device to be configured in a password-protected state following a warm reset of the device;
determine if a programmatic reset command to perform the warm reset of the computing system has been initiated, wherein the device is in an unlocked state following the warm reset; and
configure the device in the password-protected state responsive to initiation of the programmatic reset command.