Encrypted hard disk imaging process
One method disclosed includes booting a computer with a bootloader, where the bootloader is stored on an unencrypted portion of a data storage device of the computer. The method further includes unsealing a decryption password for an encrypted portion of the data storage device from a trusted platform module (TPM) using a first sealing policy, where the first sealing policy excludes dependence on a first platform configuration register (PCR), wherein the first PCR stores a measurement result associated with the bootloader. The method subsequently includes sealing the decryption password into the TPM using a second sealing policy, where the second sealing policy includes dependence on the first PCR.
1. A method comprising:
booting a computer with a bootloader, wherein the bootloader is stored on an unencrypted portion of a data storage device of the computer;
during the booting of the computer with the bootloader, unsealing a decryption password for an encrypted portion of the data storage device from a trusted platform module (TPM) using a first sealing policy, wherein the first sealing policy is based on a first set of one or more platform configuration registers (PCRs) that does not include a first PCR, wherein the first PCR stores a measurement result associated with the bootloader; and
during the booting of the computer with the bootloader and after unsealing the decryption password from the TPM using the first sealing policy, sealing the decryption password into the TPM using a second sealing policy, wherein the second sealing policy is based on a second set of one or more PCRs that does include the first PCR.
2. The method of claim 1 , further comprising:
using a temporary encryption key associated with a removable storage device attached to the computer to decrypt the decryption password after unsealing the decryption password from the TPM using the first sealing policy and before subsequently sealing the decryption password into the TPM using the second sealing policy.
3. The method of claim 2 , wherein the temporary encryption key is based on a static certificate stored on the removable storage device.
4. The method of claim 1 , further comprising initially sealing the decryption password for the encrypted portion of the data storage device into the TPM using the first sealing policy.
5. The method of claim 4 , further comprising booting the computer with a bootloader stored on a removable storage device before initially sealing the decryption password into the TPM using the first sealing policy.
6. The method of claim 5 , wherein the bootloader stored on the removable storage device is different than the bootloader stored on the unencrypted portion of the data storage device of the computer.
7. The method of claim 5 , wherein the removable storage device is a universal serial bus (USB) stick.
8. The method of claim 5 , further comprising encrypting the decryption password using a temporary encryption key associated with the removable storage device before initially sealing the decryption password into the TPM.
9. The method of claim 5 , further comprising:
partitioning the data storage device of the computer into the encrypted portion and the unencrypted portion after booting the computer with the bootloader stored on the removable storage device.
10. The method of claim 1 , wherein the first sealing policy depends on a second PCR, wherein the second PCR stores a measurement result associated with a basic input/output system (BIOS) of the computer.
11. The method of claim 1 , wherein sealing the decryption password into the TPM using the second sealing policy is performed by executing program code stored on an encrypted portion of the data storage device.
12. The method of claim 11 , wherein the program code was copied to the data storage device from a removable storage device during an imaging process.
13. The method claim 1 , wherein the second sealing policy depends on a boot source, and wherein the first sealing policy does not depend on the boot source.
14. A computer, comprising a non-transitory computer readable medium containing instructions executable by at least one processor of the computer to cause the at least one processor to perform operations comprising:
booting the computer with a bootloader, wherein the bootloader is stored on an unencrypted portion of a data storage device of the computer;
during the booting of the computer with the bootloader, unsealing a decryption password for an encrypted portion of the data storage device from a trusted platform module (TPM) using a first sealing policy, wherein the first sealing policy is based on a first set of one or more platform configuration registers (PCRs) that does not include a first PCR, wherein the first PCR stores a measurement result associated with the bootloader; and
during the booting of the computing with the bootloader and after unsealing the decryption password from the TPM using the first sealing policy, sealing the decryption password into the TPM using a second sealing policy, wherein the second sealing policy is based on a second set of one or more PCRs that does include the first PCR.
15. The computer of claim 14 , wherein the operations further comprise after unsealing the decryption password from the TPM using the first sealing policy, removing dependence of the decryption password on an identifier associated with a removable storage device attached to the computer before sealing the decryption password into the TPM using the second sealing policy.
16. The computer of claim 14 , wherein the computer comprises a control system for a robotic device.
17. The computer of claim 14 , wherein the computer comprises a touchscreen input device.
18. The computer of claim 14 , wherein the computer lacks a keyboard for password entry.
19. The computer of claim 14 , wherein both the first sealing policy and the second sealing policy depend on a second PCR, wherein the second PCR stores a measurement result independent of the bootloader.
20. A non-transitory computer readable medium containing instructions executable by at least one processor of a computer to cause the at least one processor to perform operations comprising:
booting the computer with a bootloader, wherein the bootloader is stored on an unencrypted portion of a data storage device of the computer;
during the booting of the computer with the bootloader, unsealing a decryption password for an encrypted portion of the data storage device from a trusted platform module (TPM) using a first sealing policy, wherein the first sealing policy is based on a first set of one or more platform configuration registers (PCRs) that does not include a first PCR, wherein the first PCR stores a measurement result associated with the bootloader; and
during the booting of the computer with the bootloader and after unsealing the decryption password from the TPM using the first sealing policy, sealing the decryption password into the TPM using a second sealing policy, wherein the second sealing policy is based on a second set of one or more PCRs that does include the first PCR.