Patent Application
20250013751
The present invention relates in general to the field of computers and similar technologies, and in particular to software utilized in this field. Still more particularly, it 5 relates to a method, system, and computer-usable medium for making and using fully encrypted operating system installation media.
To ensure greater levels of computer security, it may be desirable to encrypt installation media for installing an operating system on a computer. Using existing approaches, a vendor of an operating system encrypts an installation image (e.g., in an ISO file) before delivering the installation image to its customer. Such approach requires that the customer decrypt the media and write the decrypted installation image to optical media in order to install the operating system. Such process may be cumbersome for the customer as technicians may lack the technical expertise or necessary equipment.
In accordance with the teachings of the present disclosure, certain disadvantages and problems associated with existing approaches to making and using encrypted installation media for operating systems have been reduced or eliminated.
In accordance with embodiments of the present disclosure, a computer-implementable method may include booting an information handling system from a boot image stored on a non-transitory computer-readable storage medium, prompting, by the boot image, for a password for an encrypted volume of the non-transitory computer-readable storage medium, loading, by the boot image, a kernel stored within the encrypted volume, passing, by the boot image, the password to a specialized module stored within the encrypted volume, decrypting, by the specialized module, the encrypted volume using the password, and causing, by the specialized module, execution of an operating system installation image stored within the encrypted volume to install the operating system on the information handling system.
In accordance with embodiments of the present disclosure, a system may include a processor and a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to a data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for generating a second non-transitory computer-readable storage medium comprising a program of instructions configured for, when read and executed by a processing device: booting an information handling system from a boot image stored on the non-transitory computer-readable storage medium; prompting, by the boot image, for a password for an encrypted volume of the non-transitory computer-readable storage medium; loading, by the boot image, a kernel stored within the encrypted volume; passing, by the boot image, the password to a specialized module stored within the encrypted volume; decrypting, by the specialized module, the encrypted volume using the password; and causing, by the specialized module, execution of an operating system installation image stored within the encrypted volume to install the operating system on the information handling system.
In accordance with embodiments of the present disclosure, a non-transitory, computer-readable storage medium embodying computer program code is disclosed, the computer program code comprising computer executable instructions configured for: booting an information handling system from a boot image stored on a non-transitory computer-readable storage medium; prompting, by the boot image, for a password for an encrypted volume of the non-transitory computer-readable storage medium; loading, by the boot image, a kernel stored within the encrypted volume; passing, by the boot image, the password to a specialized module stored within the encrypted volume; decrypting, by the specialized module, the encrypted volume using the password; and causing, by the specialized module, execution of an operating system installation image stored within the encrypted volume to install the operating system on the information handling system.
Technical advantages of the present disclosure may be readily apparent to one having ordinary skill in the art from the figures, description and claims included herein. The objects and advantages of the embodiments will be realized and achieved at least by the elements, features, and combinations particularly pointed out in the claims.
It is to be understood that both the foregoing general description and the following detailed description are explanatory examples and are not restrictive of the claims set forth in this disclosure.
A more complete understanding of the example, present embodiments and certain advantages thereof may be acquired by referring to the following description taken in conjunction with the accompanying drawings, in which like reference numbers indicate like features, and wherein:
For the purposes of this disclosure, an information handling system may include any instrumentality or aggregate of instrumentalities operable to compute, classify, process, transmit, receive, retrieve, originate, switch, store, display, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, entertainment, or other purposes. For example, an information handling system may be a personal computer, a consumer electronic device, a mobile device such as a tablet or smartphone, a connected “smart device,” a network appliance, a network storage device, or any other suitable device and may vary in size, shape, performance, functionality, and price. The information handling system may include volatile and/or non-volatile memory, and one or more processing resources such as a central processing unit (CPU) or hardware or software control logic. Additional components of the information handling system may include one or more storage systems, one or more communications ports for communicating with networked devices, external devices, and various input and output (I/O) devices, such as a keyboard, a mouse, and a video display. The information handling system may also include one or more buses operable to transmit communication between the various hardware components.
For the purposes of this disclosure, computer-readable media may include any instrumentality or aggregation of instrumentalities that may retain data and/or instructions for a period of time. Computer-readable media may include, without limitation, storage media such as a direct access storage device (e.g., a hard disk drive or floppy disk), a sequential access storage device (e.g., a tape disk drive), compact disk, CD-ROM, DVD, random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and/or flash memory; as well as communications media such as wires, optical fibers, microwaves, radio waves, and other electromagnetic and/or optical carriers; and/or any combination of the foregoing.
In some embodiments, storage system 106 may include one or more interfaces for removable storage media, such as, for example, an optical disc drive for reading and/or writing optical storage media (e.g., compact disc, Digital Versatile Disc, BluRay disc, etc.) and/or a port (e.g., Universal Serial Bus port) for reading to and/or writing from an external flash drive (e.g., a Universal Serial Bus “thumb drive”).
In operation, information handling system 100 or a similar information handling system may be configured to generate storage media having an encrypted installation image for installation of an operating system, as described in greater detail below. Further, information handling system 100 or a similar information handling system may be configured to read storage media having an encrypted installation image for installation of an operating system (e.g., operating system 116) and install the operating system from such storage media, as described in greater detail below.
At step 202, information handling system 100 may store an installation image for an operating system in an encrypted storage volume (e.g., a Linux Unified Key Setup (LUKS) volume) of computer-readable media (e.g., an optical disc or external flash drive). At step 204, information handling system 100 may also store a boot image for the computer-readable media. As described in greater detail below, such boot image may include necessary instructions for enabling another information handling system to boot from the computer-readable media, including instructions for detecting the existence of the encrypted storage volume and instructions for prompting for a password to decrypt the encrypted storage volume. In some embodiments, such boot image may be a Grand Unified Boot Loader (GRUB) image. After step 204, method 200 may end.
Although
Method 200 may be implemented using CPU 102 and/or any other system operable to implement method 200. In some embodiments, method 200 may be implemented partially or fully in software and/or firmware embodied in computer-readable media.
After the computer-readable media with the boot image and the encrypted storage volume having the installation image for the operating system is created, a vendor of the operating system may deliver the computer-readable media to a customer, and also deliver a password for decryption of the encrypted storage volume in a different manner than delivery of the computer-readable media. For example, the computer-readable media and password may be delivered in different physical parcels, or the computer-readable media may be physically delivered via parcel while the password is delivered electronically (e.g., via electronic mail).
At step 302, in response to the computer-readable media being coupled to an appropriate interface (e.g., optical media placed in an optical disc drive, external flash drive coupled to a Universal Serial Bus port, etc.) of an information handling system 100 (e.g., a different information handling system 100 than that used to create the computer-readable media) and powering on of the information handling system, CPU 102 may boot from the boot image stored on the computer-readable media. At step 304, the boot image may load into CPU 102 and may execute to detect that the encrypted volume is also present on the computer-readable media and in response, prompt for a password for decryption.
At step 306, in response to receipt of the correct password (e.g., via an I/O device 104), the boot image, executing on CPU 102, may read the kernel and initial ramdisk from within the encrypted volume and boot a condensed operating system used for installation. At step 308, the boot image may pass the password to the condensed operating system via a kernel command line argument.
At step 310, following boot of the kernel of the condensed operating system, a specialized module of the condensed operating system stored within the initial ramdisk may execute on CPU 102. In some embodiments, such specialized module may begin execution as a udev module completes execution. At step 312, the specialized module may detect the encrypted volume on the computer-readable media and decrypt the encrypted volume using the password passed to it via the kernel command line. After decryption, at step 314 the condensed operating system may detect the installation image stored within the encrypted volume.
At step 316, after the condensed operating system has completed boot, the installation image may execute on CPU 102 and install operating system 116 on information handling system 100 in accordance with the contents of the installation image. At step 318, after completion of installation in accordance with the contents of the installation image, the installation image may cause information handling system 102 to reboot and boot to the newly-installed operating system 116. Such reboot may also render the encrypted volume on the computer-readable media inaccessible unless the correct password is again entered. After completion of step 318, method 300 may end.
Although
Method 300 may be implemented using CPU 102 and/or any other system operable to implement method 300. In some embodiments, method 300 may be implemented partially or fully in software and/or firmware embodied in computer-readable media.
As used herein, when two or more elements are referred to as “coupled” to one another, such term indicates that such two or more elements are in electronic communication or mechanical communication, as applicable, whether connected indirectly or directly, with or without intervening elements.
This disclosure encompasses all changes, substitutions, variations, alterations, and modifications to the exemplary embodiments herein that a person having ordinary skill in the art would comprehend. Similarly, where appropriate, the appended claims encompass all changes, substitutions, variations, alterations, and modifications to the exemplary embodiments herein that a person having ordinary skill in the art would comprehend. Moreover, reference in the appended claims to an apparatus or system or a component of an apparatus or system being adapted to, arranged to, capable of, configured to, enabled to, operable to, or operative to perform a particular function encompasses that apparatus, system, or component, whether or not it or that particular function is activated, turned on, or unlocked, as long as that apparatus, system, or component is so adapted, arranged, capable, configured, enabled, operable, or operative.
All examples and conditional language recited herein are intended for pedagogical objects to aid the reader in understanding this disclosure and the concepts contributed by the inventor to furthering the art, and are construed as being without limitation to such specifically recited examples and conditions. Although embodiments of the present disclosure have been described in detail, it should be understood that various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the disclosure.
