Multifactor access authenticator
A computer implemented method includes receiving, at device that includes a locked basic input/output system (BIOS), a support service generated one-time code based on a private key and a support service counter, validating the device one-time code based on a public key associated with the private key and a device counter, and unlocking the BIOS of the device using the device one-time code.
1 . A computer implemented method comprising:
receiving, at a device that includes a locked basic input/output system (BIOS), a device one-time code generated by a support service based on a private key and a support service counter;
validating the device one-time code based on a public key associated with the private key and a device counter; and
unlocking the BIOS of the device using the device one-time code.
2 . The method of claim 1 wherein the public key and private key comprise elliptic curve cryptography credentials.
3 . The method of claim 1 wherein the device one-time code is time limited.
4 . The method of claim 1 wherein the support service counter and the device counter comprises time stamps.
5 . The method of claim 1 wherein receiving the one-time code comprises:
registering the device with the support service based on a device serial number and machine type;
receiving the public key from the support service;
storing the public key on a security chip of the device; and
providing the one-time code to firmware of the device.
6 . The method of claim 5 wherein the device one-time code is generated by the firmware of the device.
7 . The method of claim 6 wherein the firmware of the device performs the validating of the device one-time code and the unlocking of the BIOS.
8 . The method of claim 1 and further comprising:
providing a device serial number and machine type to the support service via a mobile app;
receiving at the mobile app, the device one-time code; and wherein receiving the device one-time code at the device comprises receiving the device one-time code from a user of the mobile app.
9 . A device comprising:
a processor,
a lockable basic input/output system (BIOS) configured to boot the processor;
firmware configured to execute cryptography functions; and
a security chip coupled to the firmware to provide the firmware a public key to validate, via the firmware cryptography functions, a received one-time code generated with use of a private key based on registration of the device with a support server to enable the firmware to unlock the BIOS.
10 . The device of claim 9 and further comprising a device counter synchronized with a support service counter and used by the firmware along with the received one time-code to enable the firmware to unlock the BIOS.
11 . The device of claim 10 wherein the support service counter and the device counter comprises time stamps.
12 . The device of claim 9 wherein the public key and private key comprise elliptic curve credentials.
13 . The device of claim 9 wherein the received one-time code is time limited.
14 . A device comprising:
a processor, and
a memory device coupled to the processor and having a program stored thereon for execution by the processor to perform operations comprising:
receiving, at a device that includes a locked basic input/output system (BIOS), a device one-time code generated by a support service based on a private key and a support service counter;
validating the device one-time code based on a public key associated with the private key and a device counter; and
unlocking the BIOS of the device using the device one-time code.
15 . The device of claim 14 wherein the public key and private key comprise elliptic curve credentials and the device one-time code is time limited.
16 . The device of claim 14 wherein receiving the one-time code comprises:
registering the device with the support service based on a device serial number and machine type;
receiving the public key from the support service;
storing the public key on a security chip of the device; and
providing the one-time code to firmware of the device.
17 . The device of claim 14 wherein the operations further comprise:
providing a device serial number and machine type to the support service via a mobile app;
receiving at the mobile app, the device one-time code; and wherein receiving the device one-time code at the device comprises receiving the device one-time code from a user of the mobile app.
18 . A non-transitory machine-readable storage device having instructions for execution by a processor of a machine to cause the processor to perform operations to perform a method, the operations comprising:
receiving, at a device that includes a locked basic input/output system (BIOS), a device one-time code generated by a support service based on a private key and a support service counter;
validating the device one-time code based on a public key associated with the private key and a device counter, and
unlocking the BIOS of the device using the device one-time code.