Technologies for pre-boot biometric authentication

1. A computing device for providing authentication services during a pre-boot process, the computing device comprising:

a manageability hardware controller, wherein the manageability hardware controller comprises a template manager;

a hardware processor; and

one or more memory devices comprising a plurality of instructions that, when executed, cause the computing device to:

mutually authenticate the manageability hardware controller and a secure execution environment of the computing device, wherein the secure execution environment is executed by the hardware processor and isolated from untrusted software of the computing device, and wherein the template manager of the manageability hardware controller is to receive a biometric template from a network source in response to mutual authentication of the manageability hardware controller and the secure execution environment;

request, by the secure execution environment executed by the hardware processor, the biometric template from the manageability hardware controller in response to the mutual authentication of the manageability hardware controller and the secure execution environment;

securely provision the biometric template from the manageability hardware controller to the secure execution environment in response to a request of the biometric template by the secure execution environment, wherein the biometric template is protected from the untrusted software of the computing device; and

perform, by the secure execution environment executed by the hardware processor, a biometric authentication operation on a biometric input with the biometric template during the pre-boot process, wherein the biometric input is received by the secure execution environment from a biometric input device during the pre-boot process, and wherein to perform the biometric authentication operation comprises to determine whether the biometric input matches the biometric template.

2. The computing device of claim 1 , wherein to mutually authenticate the manageability hardware controller and the secure execution environment comprises to:

securely exchange a shared secret key between the manageability hardware controller and the secure execution environment;

securely store the shared secret key by the manageability hardware controller in response to secure exchange of the shared secret key; and

securely store the shared secret key by the secure execution environment in response to the secure exchange of the shared secret key.

3. The computing device of claim 2 , wherein to securely provision the biometric template from the manageability hardware controller to the secure execution environment comprises to protect the biometric template with the shared secret key.

4. The computing device of claim 2 , wherein to securely store the shared secret key by the manageability hardware controller comprises to store the shared secret key in an internal storage of the manageability hardware controller.

5. The computing device of claim 2 , wherein to securely store the shared secret key by the secure execution environment comprises to:

seal the shared secret key with an identity of the secure execution environment to generate a sealed key; and

store the sealed key in a data storage device of the computing device.

6. The computing device of claim 5 , wherein to securely provision the biometric template from the manageability hardware controller to the secure execution environment further comprises to:

unseal, by the secure execution environment, the sealed key with the identity of the secure execution environment to recover the shared secret key; and

protect the biometric template with the shared secret key in response to unsealing of the sealed key.

7. The computing device of claim 1 , wherein to mutually authenticate the manageability hardware controller and the secure execution environment comprises to verify, by the manageability hardware controller, an identity of the secure execution environment.

8. The computing device of claim 1 , wherein to mutually authenticate the manageability hardware controller and the secure execution environment comprises to verify, by the secure execution environment, locality of the manageability hardware controller.

9. The computing device of claim 1 , wherein the one or more memory devices further comprise a plurality of instructions that, when executed, cause the computing device to:

load a runtime environment of the computing device; and

load a component authentication enclave within the runtime environment with secure enclave support of the hardware processor of the computing device, wherein the secure execution environment comprises the component authentication enclave;

wherein to mutually authenticate the manageability hardware controller and the secure execution environment comprises to mutually authenticate the manageability hardware controller and the component authentication enclave.

10. The computing device of claim 9 , wherein the one or more memory devices further comprise a plurality of instructions that, when executed, cause the computing device to:

load a lightweight firmware environment during the pre-boot process; and

load a biometric authentication enclave within the lightweight firmware environment with the secure enclave support of the hardware processor, wherein the secure execution environment comprises the biometric authentication enclave;

wherein to securely provision the biometric template from the manageability hardware controller to the secure execution environment comprises to securely provision the biometric template from the manageability hardware controller to the biometric authentication enclave; and

wherein to perform the biometric authentication operation comprises to perform the biometric authentication operation by the biometric authentication enclave.

11. The computing device of claim 10 , wherein:

the component authentication enclave is associated with a signing identity of an authority of the component authentication enclave; and

the biometric authentication enclave is associated with the signing identity.

12. The computing device of claim 1 , wherein the the one or more memory devices further comprise a plurality of instructions that, when executed, cause the computing device to provide access to a hardware component of the computing device in response to performance of the biometric authentication operation.

13. The computing device of claim 12 , wherein the hardware component comprises an encrypted data storage device.

14. A method for providing authentication services during a pre-boot process, the method comprising:

mutually authenticating, by a computing device, a manageability controller of the computing device and a secure execution environment of the computing device, wherein the secure execution environment is isolated from untrusted software of the computing device;

receiving, by the manageability controller, a biometric template from a network source in response to mutually authenticating the manageability controller and the secure execution environment;

requesting, by the secure execution environment, the biometric template from the manageability controller in response to mutually authenticating the manageability controller and the secure execution environment;

securely provisioning, by the computing device, the biometric template from the manageability controller to the secure execution environment in response to requesting the biometric template by the secure execution environment, wherein the biometric template is protected from the untrusted software of the computing device; and

performing, by the computing device with the secure execution environment, a biometric authentication operation on a biometric input using the biometric template during the pre-boot process, wherein the biometric input is received by the secure execution environment from a biometric input device during the pre-boot process, wherein performing the biometric authentication operation comprises determining whether the biometric input matches the biometric template.

15. The method of claim 14 , wherein mutually authenticating the manageability controller and the secure execution environment comprises:

securely exchanging a shared secret key between the manageability controller and the secure execution environment;

securely storing the shared secret key by the manageability controller in response to securely exchanging the shared secret key; and

securely storing the shared secret key by the secure execution environment in response to securely exchanging the shared secret key.

16. The method of claim 15 , wherein securely provisioning the biometric template from the manageability controller to the secure execution environment comprises protecting the biometric template with the shared secret key.

17. The method of claim 14 , further comprising:

loading, by the computing device, a runtime environment of the computing device; and

loading, by the computing device, a component authentication enclave within the runtime environment using secure enclave support of a processor of the computing device, wherein the secure execution environment comprises the component authentication enclave;

wherein mutually authenticating the manageability controller and the secure execution environment comprises mutually authenticating the manageability controller and the component authentication enclave.

18. The method of claim 17 , further comprising:

loading, by the computing device, a lightweight firmware environment during the pre-boot process; and

loading, by the computing device, a biometric authentication enclave within the lightweight firmware environment using the secure enclave support of the processor, wherein the secure execution environment comprises the biometric authentication enclave;

wherein securely provisioning the biometric template from the manageability controller to the secure execution environment comprises securely provisioning the biometric template from the manageability controller to the biometric authentication enclave; and

wherein performing the biometric authentication operation comprises performing the biometric authentication operation by the biometric authentication enclave.

19. The method of claim 18 , wherein:

the component authentication enclave is associated with a signing identity of an authority of the component authentication enclave; and

the biometric authentication enclave is associated with the signing identity.

20. One or more non-transitory, computer-readable storage media comprising a plurality of instructions stored thereon that, in response to being executed, cause a computing device to:

mutually authenticate a manageability controller of the computing device and a secure execution environment of the computing device, wherein the secure execution environment is isolated from untrusted software of the computing device;

receive, by the manageability controller, a biometric template from a network source in response to mutually authenticating the manageability controller and the secure execution environment;

request, by the secure execution environment, the biometric template from the manageability controller in response to mutually authenticating the manageability controller and the secure execution environment;

securely provision the biometric template from the manageability controller to the secure execution environment in response to requesting the biometric template by the secure execution environment, wherein the biometric template is protected from the untrusted software of the computing device; and

perform, with the secure execution environment, a biometric authentication operation on a biometric input using the biometric template during the pre-boot process, wherein the biometric input is received by the secure execution environment from a biometric input device during the pre-boot process, and wherein to perform the biometric authentication operation comprises to determine whether the biometric input matches the biometric template.

21. The one or more non-transitory, computer-readable storage media of claim 20 , wherein to mutually authenticate the manageability controller and the secure execution environment comprises to:

securely exchange a shared secret key between the manageability controller and the secure execution environment;

securely store the shared secret key by the manageability controller in response to securely exchanging the shared secret key; and

securely store the shared secret key by the secure execution environment in response to securely exchanging the shared secret key.

22. The one or more non-transitory, computer-readable storage media of claim 21 , wherein to securely provision the biometric template from the manageability controller to the secure execution environment comprises to protect the biometric template with the shared secret key.

23. The one or more non-transitory, computer-readable storage media of claim 20 , further comprising a plurality of instructions stored thereon that, in response to being executed, cause the computing device to:

load a runtime environment of the computing device; and

load a component authentication enclave within the runtime environment using secure enclave support of a processor of the computing device, wherein the secure execution environment comprises the component authentication enclave;

wherein to mutually authenticate the manageability controller and the secure execution environment comprises to mutually authenticate the manageability controller and the component authentication enclave.

24. The one or more non-transitory, computer-readable storage media of claim 23 , further comprising a plurality of instructions stored thereon that, in response to being executed, cause the computing device to:

load a lightweight firmware environment during the pre-boot process; and

load a biometric authentication enclave within the lightweight firmware environment using the secure enclave support of the processor, wherein the secure execution environment comprises the biometric authentication enclave;

wherein to securely provision the biometric template from the manageability controller to the secure execution environment comprises to securely provision the biometric template from the manageability controller to the biometric authentication enclave; and

wherein to perform the biometric authentication operation comprises to perform the biometric authentication operation by the biometric authentication enclave.

25. The one or more non-transitory, computer-readable storage media of claim 24 , wherein:

the component authentication enclave is associated with a signing identity of an authority of the component authentication enclave; and

the biometric authentication enclave is associated with the signing identity.