Boot authentication

Patent metadata

Field	Value
Publication number	US-11200065-B2
Application number	US-201716481693-A
Country	US
Kind code	B2
Filing date	Dec 15, 2017
Priority date	Dec 15, 2017
Publication date	Dec 14, 2021
Grant date	Dec 14, 2021

Abstract

Examples associated with boot authentication are described. One example includes initiating a power on self-test (POST) phase of a boot of a system. Prior to initiating a driver execution environment phase of the POST phase, a network stack may be loaded for a network port. An encrypted key may be retrieved from a trusted component of the system. Boot of the system may be permitted to proceed upon establishing a connection with an authentication server, and authenticating the system to the authentication server based on the encrypted key.

First claim

What is claimed is:

1. A non-transitory computer-readable medium storing processor executable instructions that when executed control a processor to:
initiate a power on self-test (POST) phase of a boot of a system; and
prior to initiating a driver execution environment phase of the POST phase and prior to completion of the POST phase:
load a network stack for a network port;
retrieve an encrypted key from a trusted component of the system; and
permit the boot of the system to proceed upon establishing a connection with an authentication server and authenticating the system to the authentication server based on the encrypted key.

2. The non-transitory computer-readable medium of claim 1 , where authenticating the system to the authentication server is completed during a pre-POST phase of the boot of the system by a motherboard controller of the system.

3. The non-transitory computer-readable medium of claim 1 , where authenticating the system to the authentication server is completed during the POST phase of the boot of the system prior to availability of a random access memory (RAM) of the system.

4. The non-transitory computer-readable medium of claim 1 , where instructions associated with loading the network stack are loaded into a central processing unit (CPU) cache.

5. The non-transitory computer-readable medium of claim 1 , where the trusted component of the system is a trusted platform module.

6. The non-transitory computer-readable medium of claim 1 , where the instructions further control the processor to:
load instructions for operating an I/O port associated with communicating with an authentication token; and
permit the boot of the system to proceed upon successfully authenticating the system based on the authentication token.

7. The non-transitory computer-readable medium of claim 1 , where the instructions further control the processor to:
load instructions for operating an I/O port associated with communicating with an authentication token; and
permit the loading of the network stack upon successfully authenticating the system based on the authentication token.

8. The non-transitory computer-readable medium of claim 1 , wherein authenticating the system to the authentication server based on the encrypted key comprises:
transmitting the encrypted key to the authentication server; and
receiving a response from the authentication server indicating whether the authentication server has validated the encrypted key.

9. The non-transitory computer-readable medium of claim 1 , wherein authenticating the system to the authentication server based on the encrypted key comprises:
generating a secret based on the encrypted key;
transmitting the generated secret to the authentication server; and
receiving a response from the authentication server indicating whether the authentication server has validated the generated secret.

10. The non-transitory computer-readable data storage medium of claim 1 , wherein the processor is to permit the boot of the system to proceed upon establishing the connection with the authentication server and authentication of the system by:
continuing and completing the POST phase of the boot of the system.

11. The non-transitory computer-readable data storage medium of claim 10 , wherein continuing and completing the POST phase of the boot of the system comprises:
proceeding to initiate the driver execution environment phase of the POST phase.

12. A device comprising:
a network port;
a trusted component storing an encrypted key;
a startup module to control, during a startup of the device, a basic input/output system (BIOS) of the device to initiate a power on self-test (POST) process; and
a network authentication module to, prior to entering a driver execution environment phase of the POST process and prior to completion of the POST process, load a network stack for the network port, to retrieve the encrypted key from the trusted component, and to initiate a security procedure for the device if the network authentication module fails to authenticate the device to a trusted authentication server using the encrypted key.

13. The device of claim 12 , where the security procedure of the device is prevention of device startup.

14. The device of claim 12 , where the security procedure is to erase data stored on the device if the network authentication module fails to authenticate the device to a trusted authentication server after one of a predefined number of authentication attempts, and a predefined period of time.

15. The device of claim 12 , where the security procedure is to alert the trusted authentication server of a failed authentication attempt by sending information about a location of the device to the trusted authentication server.

16. The device of claim 12 , comprising a multifactor authentication module to, prior to initiation of a driver execution environment phase of the POST process, load instructions for operating an I/O port associated with an authentication token, and initiate a security procedure of the device if the multifactor authentication module fails to authenticate the device based on the authentication token.

17. The device of claim 12 , where the network authentication module operates prior to initiation of the CPU cache.

18. A device comprising:
a network port;
a universal serial bus (USB) port;
a trusted component storing an encrypted key;
an network authentication module to load a network stack for the network port, to retrieve the encrypted key from the trusted component, to initiate a first authentication process between the device and a trusted authentication server using the encrypted key via the network port, and to initiate a security procedure for the device when the first authentication process fails;
a USB authentication module to load a USB stack for the USB port, to retrieve the encrypted key from the trusted component, to initiate a second authentication process between the device and a trusted USB endpoint attached to the device via the USB port, and to initiate a security procedure for the device when the second authentication process fails;
a startup module to control, during a startup of the device, a basic input/output system (BIOS) of the device to initiate a power on self-test (POST) process, where the POST process includes initiating the network authentication module to complete the first authentication process prior to completion of the POST process, initiating the USB authentication module when the first authentication process succeeds, and entering a driver execution environment phase of the POST process when the second authentication process succeeds.

19. The device of claim 18 where the USB authentication module communicates with the trusted USB endpoint plugged into the USB port, and the trusted USB endpoint contains an authentication token to be validated by the USB authentication module as a part of the second authentication process.

Assignees

• Hewlett Packard Development Co

Inventors

• Seiler Peter
• Kinney Michael
• Nguyen Vinh Anh
• Romero Aaron

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F9/4401 Primary

  Bootstrapping (security arrangements therefor G06F21/57) · CPC title

• G06F21/572

  Secure firmware programming, e.g. of basic input output system [BIOS] · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06F21/575

  Secure boot · CPC title