Basic input/output system protection using multi-factor authentication based on digital identity values
Techniques are provided for basic input/output system (BIOS) protection using multi-factor authentication (MFA) based on digital identity values. One method comprises obtaining, by a BIOS of a hardware device, from a user device, (i) a request to access the BIOS, and (ii) a token based on a digital identity value for the user device; providing the token to an MFA chip on the hardware device, wherein the MFA chip evaluates the token and provides a verification result to the BIOS; and allowing the user device to access the BIOS based on the verification result. The digital identity value for the user device may be stored by the MFA chip during a fabrication of the MFA chip and/or a registration of the user device. The MFA chip may compare the digital identity value from the token received from the BIOS with the digital identity value for the user device stored by the MFA chip.
1. A method, comprising:
obtaining, by a basic input/output system of a hardware device, from a user device, (i) a request to access the basic input/output system, and (ii) a token based at least in part on a digital identity value for the user device, wherein the digital identity value for the user device is obtained by applying at least one function to at least one identifier of one or more of: (i) at least one component associated with the user device and (ii) at least one network connection associated with the user device;
providing the token to a multi-factor authentication chip on the hardware device, wherein the multi-factor authentication chip evaluates the token and provides a verification result to the basic input/output system; and
allowing the user device to access the basic input/output system based at least in part on the verification result;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
2. The method of claim 1 , wherein the at least one identifier comprises one or more of: (a) at least one hardware identifier of one or more hardware components associated with the user device, (b) at least one software identifier of one or more software components associated with the user device, and (c) at least one network address identifier of one or more network connections associated with the user device.
3. The method of claim 1 , wherein the digital identity value for the user device is stored by the multi-factor authentication chip in conjunction with one or more of a fabrication of the multi-factor authentication chip and a registration of the user device to access the basic input/output system.
4. The method of claim 3 , wherein the multi-factor authentication chip compares the digital identity value from the token received from the basic input/output system with the digital identity value for the user device stored by the multi-factor authentication chip.
5. The method of claim 1 , further comprising performing one or more remedial actions in response to the token failing the verification.
6. The method of claim 1 , wherein the request to access the basic input/output system further comprises one or more of a username of a user of the user device and a password of the user.
7. The method of claim 1 , wherein the request to access the basic input/output system further comprises a dynamic value provided in conjunction with an evaluation of the request.
8. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
the at least one processing device being configured to implement steps of:
obtaining, by a basic input/output system of a hardware device, from a user device, (i) a request to access the basic input/output system, and (ii) a token based at least in part on a digital identity value for the user device, wherein the digital identity value for the user device is obtained by applying at least one function to at least one identifier of one or more of: (i) at least one component and (ii) at least one network connection associated with the user device;
providing the token to a multi-factor authentication chip on the hardware device, wherein the multi-factor authentication chip evaluates the token and provides a verification result to the basic input/output system; and
allowing the user device to access the basic input/output system based at least in part on the verification result.
9. The apparatus of claim 8 , wherein the at least one identifier comprises one or more of: (a) at least one hardware identifier of one or more hardware components associated with the user device, (b) at least one software identifier of one or more software components associated with the user device, and (c) at least one network address identifier of one or more network connections associated with the user device.
10. The apparatus of claim 8 , wherein the digital identity value for the user device is stored by the multi-factor authentication chip in conjunction with one or more of a fabrication of the multi-factor authentication chip and a registration of the user device to access the basic input/output system.
11. The apparatus of claim 10 , wherein the multi-factor authentication chip compares the digital identity value from the token received from the basic input/output system with the digital identity value for the user device stored by the multi-factor authentication chip.
12. The apparatus of claim 8 , further comprising performing one or more remedial actions in response to the token failing the verification.
13. The apparatus of claim 8 , wherein the request to access the basic input/output system further comprises one or more of a username of a user of the user device and a password of the user.
14. The apparatus of claim 8 , wherein the request to access the basic input/output system further comprises a dynamic value provided in conjunction with an evaluation of the request.
15. A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform steps of:
obtaining, by a basic input/output system of a hardware device, from a user device, (i) a request to access the basic input/output system, and (ii) a token based at least in part on a digital identity value for the user device, wherein the digital identity value for the user device is obtained by applying at least one function to at least one identifier of one or more of: (i) at least one component and (ii) at least one network connection associated with the user device;
providing the token to a multi-factor authentication chip on the hardware device, wherein the multi-factor authentication chip evaluates the token and provides a verification result to the basic input/output system; and
allowing the user device to access the basic input/output system based at least in part on the verification result.
16. The non-transitory processor-readable storage medium of claim 15 , wherein the at least one identifier comprises one or more of: (a) at least one hardware identifier of one or more hardware components associated with the user device, (b) at least one software identifier of one or more software components associated with the user device, and (c) at least one network address identifier of one or more network connections associated with the user device.
17. The non-transitory processor-readable storage medium of claim 15 , wherein the digital identity value for the user device is stored by the multi-factor authentication chip in conjunction with one or more of a fabrication of the multi-factor authentication chip and a registration of the user device to access the basic input/output system.
18. The non-transitory processor-readable storage medium of claim 17 , wherein the multi-factor authentication chip compares the digital identity value from the token received from the basic input/output system with the digital identity value for the user device stored by the multi-factor authentication chip.
19. The non-transitory processor-readable storage medium of claim 15 , wherein the request to access the basic input/output system further comprises one or more of a username of a user of the user device and a password of the user.
20. The non-transitory processor-readable storage medium of claim 15 , wherein the request to access the basic input/output system further comprises a dynamic value provided in conjunction with an evaluation of the request.