System and method for verifying first time use of an information handling system
An information handling system includes a basic input/output system that checks for a first-time password in NVRAM, and prompts a user for a password when the first-time password is present. A processor compares the password to the first-time password, deletes the first-time password from the NVRAM when the password matches the first-time password, and boots the information handling system when the password matches the first-time password.
1. An information handling system, comprising:
a processor;
a non-volatile random access memory (NVRAM); and
a basic input/output system (BIOS) including instructions that when executed on the processor:
begin a power-on self test (POST) for the information handling system;
during the POST, the BIOS to:
check for a first-time password in the NVRAM, wherein the first-time password being present indicates that the information handling system is being booted to a first time; and
in response to the first-time password being present:
prompt a user for a password;
compare the password to the first-time password; and
in response to the password matching the first-time password:
delete the first-time password from the NVRAM; and
continue the POST and boot the information handling system.
2. The information handling system of claim 1 , wherein the first-time password is set in the factory and stored in the NVRAM.
3. The information handling system of claim 1 , wherein the first-time password is provided to the end user separate from the information handling system.
4. The information handling system of claim 3 , wherein the password is provided after the end user verifies an identifier of the information handling system matches an identifier of an information handling system ordered by the end user.
5. The information handling system of claim 1 , wherein the BIOS further includes instructions to:
receive the first-time password and a signature from a signing server; and
verify the signature prior to writing the password to the NVRAM.
6. The information handling system of claim 5 , wherein verifying the signature includes:
decrypting the signature for the signing server to obtain a decrypted hash; and
comparing the decrypted hash to a calculated hash of the password.
7. The information handling system of claim 6 , wherein the BIOS further includes a public key for a signing server and decrypting the signature includes decrypting the signature using the public key.
8. The information handling system of claim 6 , wherein the BIOS further includes instructions to reject the password when the decrypted hash does not match the calculated hash.
9. The information handling system of claim 1 , wherein the BIOS further comprises instructions to prevent booting the information handling system if the password does not match the first-time password.
10. The information handling system of claim 1 , wherein the information handling system includes a tamper detection device to detect physical tampering with the information handling system.
11. A method of booting an information handling system for the first time, comprising:
beginning, by a basic input/output system (BIOS), a power-on self test (POST) for the information handling system;
during the POST:
checking for a first-time password stored in a non volatile random access memory (NVRAM), wherein the first-time password being present indicates that the information handling system is being booted to a first time; and
in response to the first-time password being present:
obtaining a password from a user;
comparing the password to the first-time password; and
in response to the password matching the first-time password:
deleting the first-time password from the NVRAM; and
continuing the POST and booting the information handling system.
12. The method of claim 11 , wherein the first-time password is set in the factory and stored in the NVRAM.
13. The method of claim 11 , further comprising providing the password to the end user separate from the information handling system.
14. The method of claim 13 , wherein the password is provided after the end user verifies an identifier of the information handling system matches an identifier of an information handling system ordered by the end user.
15. The method of claim 11 , further comprising preventing booting of the information handling system if the password does not match the first-time password.
16. The method of claim 11 , further comprising writing the first-time password to the NVRAM after verifying a signature and password from a signing server.
17. A method of setting a first-time password, comprising:
receiving a first-time password and a signature;
decrypting the signature to obtain a decrypted hash;
determining a calculated hash of the first-time password;
comparing the calculated hash to the decrypted hash;
writing the first-time password to NVRAM when the calculated hash matches the decrypted hash;
retaining the first-time password in the NVRAM during an NVRAM clear operation, wherein the first-time password in the NVRAM is only deleted in response to an end user entering a password that matches the first-time password during a power-on self test (POST) for the information handling system.
18. The method of claim 17 , wherein decrypting the signature includes decrypting the signature with a public key of a signing server.
19. The method of claim 17 , further comprising rejecting the password of the calculated hash does not match the decrypted hash.
20. The method of claim 17 , further comprising requiring an end user to enter the first-time password before booting for the first-time.