Pre-Boot Authentication (PBA) and Single Sign On (SSO) using Full Disk Encryption?

J

John2000

Weaksauce
Joined
Sep 12, 2010
Messages
90
Hi,

I just wonder how disks that support Pre-Boot Authentication (PBA) and Single Sign On (SSO) work? This is a feature that is combined with Full Disk Encryption (FDE) (also called Self Encrypting Disk or SED), and is apparently becoming more and more common, especially on SSD:s. See some background info here:

http://info.softexinc.com/bid/56163...l-Hard-Drives-with-ATA-BIOS-Password-Security

http://blog.wave.com/allen/from-vir...-you-don’t-know-about-self-encrypting-drives/

As I understand it there is a protected shadow Master Boot Record (MBR), with an associated special partition holding the PBA software. The PBA software will upon boot-up prompt the user for credentials (username/password), and when valid user credentials has been entered, the real MBR will be become visible and the drive will boot as normal. In some way, the PBA software also interacts with the OS, and can provide the credentials that were entered to the OS, so that the user does not have to enter them again to log on to the OS (hence the term Single Sign On).

What I wonder is:

1. Does the PBA software come pre-installed on disks that support this feature? Or is the user free to install whatever PBA software is desired?

2. Does the PBA software pass the credentials that the user entered to the OS? In that case how is that done? And if not, how can Single Sign On work otherwise?

Does anyone know? Thanks in advance!
 
If you are looking for instant-on request for credentials, and after the OS will be loaded then Truecrypt is what you are looking for. If you are looking for something that will include both the encrypted data and the keys to the encryption physically residing on the same piece of hardware, that kind of defeats the purpose. If you are running Windows and just want basic encryption, use bitlocker for basic encryption of your data with no pre-boot password needed (if you have a TPM chip on your server) and just log into windows. If you have no TPM you can require a PIN before boot. You can also just put the key on a USB stick (not recommended, see my comment above about defeating the purpose).
 
Thanks for the response. However, Truecrypt and Bitlocker are software based encryption solutions.

The encryption solution I'm talking about is hardware based, and handled by the drive itself, i.e. so called Self Encrypting Drives (SED). It is supported by for example the Intel 520 and OCZ Vertex 4 SSD disks.

Such SED drives that comply with the Opal specification also support having a Pre-Boot Authentication (PBA) software on a special secure shadow MBR/partition, that will authenticate the user upon before boot up. Such solutions should also support Single Sign On (SSO) according to the Opal standard (i.e. the solution only requires the user to provide credentials during PBA Authentication, and does not require the user to enter Windows credentials after that when the system boots up). The questions is how this works in practice, hence the reason for question 1 & 2 in my original post. So therefore I wonder if you or anyone else knows that?
 
The way it works is, when the drive starts up, it tells the bios it needs a password. When the drive is supplied the password, it uses that password to decrypt the encryption key that is stored on disk. That is then used to decrypt the data.

On more enterprise systems, you can get it so they don't store the key on the drive itself.

Storing the encryption key on the disk is why the whole disk erase is so fast, it only blanks out that stored encryption key, since then the data shouldn't be recoverable.
 
@patrickdk:

No, that's not the way it works with PBA using the Opal standard (which is the standard used by practically all SED/FDE drives). See the documents I referred to in my original post. Also see the Opal specification documents published by the Trusted Computing Group (TCG) here:

http://www.trustedcomputinggroup.org/developers/storage/

The way it works instead is that when the computer boots up, the only thing that is visible to the host is the shadow MBR/partition (which is a 128 MB read-only storage space). That shadow MBR contains the PBA software, which is executed by the computer. The PBA software prompts the user for credentials (and/or checks e.g. any TPM if present). Based on that it authenticates the user to the drive using security commands according to the Opal specification. If authentication succeeds, the PBA software can send commands to the drive to make the real MBR visible, and to unlock the Read/Write blocking for sectors on the drive. The computer can then boot from the real MBR as normal, and also read/write to any blocks on the drive as normal.
 
You must log in or register to reply here.
Back
Top