Pre-boot network-based authentication

1. A method comprising:

entering, by a computing device, a Unified Extensible Firmware Interface (UEFI) environment upon powering on the computing device;

while in the UEFI environment:

restricting, by the computing device, booting of an operating system of the computing device;

accessing, by the computing device and from a trusted platform module of the computing device, a certificate corresponding to a particular user;

sending, by the computing device, a verification request to a server system over a communication network, the verification request being generated based on the certificate; and

receiving, by the computing device, a verification response from the server system over the communication network, the verification response confirming authorization for the particular user corresponding to the certificate; and

in response to receiving the verification response:

initiating, by the computing device, a communication session based on confirming authorization for the particular user,

enabling, by the computing device, the operating system to boot, and

passing, by the computing device, the communication session to the operating system such that the operating system continues the communication session after the operating system is enabled to boot.

2. The method of claim 1 , wherein:

the trusted platform module stores a secure address for the server system; and

sending the verification request to the server system comprises:

determining an address to send the verification request based on the secure address stored in the trusted platform module, and

sending the verification request to the secure address for the server system.

3. The method of claim 1 , while in the UEFI environment, the method further comprises:

initiating the communication session by entering a virtual private network session; and

passing the communication session to the operating system by passing the virtual private network session to the operating system such that the operating system continues the virtual private network session after the operating system is enabled to boot.

4. The method of claim 1 , further comprising:

receiving, by the computing device, a proof of identity of the particular user;

verifying the proof of identity of the particular user; and

enabling the operating system to boot based on verifying the proof of identity of the particular user.

5. The method of claim 4 , wherein verifying the proof of identity of the particular user comprises verifying at least one of:

a personal identification number (PIN) provided by the particular user;

a username and password combination provided by the particular user;

biometric data of the particular user; or

proximity of one or more trusted devices of the particular user.

6. The method of claim 1 , wherein the verification response indicates that (i) an authorization issued to a user is valid and has not expired, and (ii) use of the authorization is not presently restricted by an authorization policy.

7. The method of claim 6 , wherein the authorization policy specifies a particular time frame during which use of the authorization is restricted.

8. The method of claim 6 , wherein:

the method further comprises obtaining, by the computing device, context data associated with the computing device upon powering on the computing device; and

the verification response confirms that the context data associated with the computing device satisfies the authorization policy.

9. The method of claim 1 , wherein:

while in the UEFI environment, the method further comprises:

determining, by the computing device, that the computing device is unable to connect to the communication network;

in response to determining that the computing device is unable to connect to the communication network, accessing by the computing device and from the trusted platform module, a limited certificate corresponding to the particular user; and

enabling, by the computing device, the operating system to boot in a limited configuration such that the operating system restricts network access on the computing device after the operating system logs in the particular user.

10. The method of claim 9 , further comprising:

after enabling the operating system to boot in the limited configuration, providing, by the computing device, identify verification data specifying the limited certificate to one or more applications running on the operating system such that one or more applications logs in the particular user without requiring proof of identity.

11. The method of claim 1 , wherein the verification request comprises at least a device identifier of the computing device stored within the trusted platform module and a user identifier for with the particular user.

12. A system comprising:

one or more computers; and

one or more storage devices storing instructions that, when executed by the one or more computers, cause the one or more computers to perform operations comprising:

entering, by a computing device, a Unified Extensible Firmware Interface (UEFI) environment upon powering on the computing device;

while in the UEFI environment:

restricting, by the computing device, booting of an operating system of the computing device;

accessing, by the computing device and from a trusted platform module of the computing device, a certificate corresponding to a particular user;

sending, by the computing device, a verification request to a server system over a communication network, the verification request being generated based on the certificate; and

receiving, by the computing device, a verification response from the server system over the communication network, the verification response confirming authorization for the particular user corresponding to the certificate; and

in response to receiving the verification response:

initiating, by the computing device, a communication session based on confirming authorization for the particular user,

enabling, by the computing device, the operating system to boot, and

passing, by the computing device, the communication session to the operating system such that the operating system continues the communication session after the operating system is enabled to boot.

13. The system of claim 12 , wherein:

the trusted platform module stores a secure address for the server system; and

sending the verification request to the server system comprises:

determining an address to send the verification request based on the secure address stored in the trusted platform module, and

sending the verification request to the secure address for the server system.

14. The system of claim 12 , wherein, while in the UEFI environment, the operations further comprise:

initiating the communication session by entering a virtual private network session; and

passing the communication session to the operating system by passing the virtual private network session to the operating system such that the operating system continues the virtual private network session after the operating system is enabled to boot.

15. The system of claim 12 , wherein the operations further comprise:

receiving, by the computing device, a proof of identity of the particular user;

verifying the proof of identity of the particular user; and

enabling the operating system to boot based on verifying the proof of identity of the particular user.

16. One or more non-transitory computer-readable storage devices encoded with computer program instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising:

entering, by a computing device, a Unified Extensible Firmware Interface (UEFI) environment upon powering on the computing device;

while in the UEFI environment:

restricting, by the computing device, booting of an operating system of the computing device;

accessing, by the computing device and from a trusted platform module of the computing device, a certificate corresponding to a particular user;

sending, by the computing device, a verification request to a server system over a communication network, the verification request being generated based on the certificate; and

receiving, by the computing device, a verification response from the server system over the communication network, the verification response confirming authorization for the particular user corresponding to the certificate; and

in response to receiving the verification response:

initiating, by the computing device, a communication session based on confirming authorization for the particular user,

enabling, by the computing device, the operating system to boot, and

passing, by the computing device, the communication session to the operating system such that the operating system continues the communication session after the operating system is enabled to boot.

17. The one or more non-transitory computer-readable storage devices of claim 16 , wherein:

the trusted platform module stores a secure address for the server system; and

sending the verification request to the server system comprises:

determining an address to send the verification request based on the secure address stored in the trusted platform module, and

sending the verification request to the secure address for the server system.

18. The one or more non-transitory computer-readable storage devices of claim 16 , wherein, while in the UEFI environment, the operations further comprise:

initiating the communication session by entering a virtual private network session; and

passing the communication session to the operating system by passing the virtual private network session to the operating system such that the operating system continues the virtual private network session after the operating system is enabled to boot.

19. The one or more non-transitory computer-readable storage devices of claim 16 , wherein the operations further comprise:

receiving, by the computing device, a proof of identity of the particular user;

verifying the proof of identity of the particular user; and

enabling the operating system to boot based on verifying the proof of identity of the particular user.

20. The method of claim 1 , further comprising, in response to receiving the verification response, providing, by the computing device, identity verification data for the particular user to the operating system such that the operating system logs in the particular user without requiring further proof of identity for the particular user.