Requiring hardware key at boot-up on normal laptop

Question

I am sure that a question like this already exists and has probably been answered. I just couldn't find any results (probably due to my inability to word my question correctly).

We use laptops at work which require a hardware key (a USB) to boot the computer along with a username/password. It then boots to Windows and a different USB/Username/Password combination is required.

I am already aware on how to implement the second security feature (the windows login requiring USB as well) but can't find any information on implementing a USB requirement to pass through the boot-up process. It's very similar to having a BIOS password, though requires a USB/Username/Password combination and therefore more secure as requiring a physical token.

I am trying to implement this to provide higher than usual BIOS level security. I don't want the machine to be able to be used WITHOUT the physical access token and am not concerned with HDD security (i.e, the OS itself) as I have already implemented significant security onto that already.

i.e if somebody connects an external HDD and tries to boot onto that instead of the build in HDD (which has OS-level security), I want them to require a physical token to do so along with a username and password

The startup process should therefore go like this:

    1. Power on
    2. Insert USB (this is my issue)
    3. Enter Username/Password
    4. Boot to Windows
    5. Insert seperate USB
    6. Enter Windows username/password
    7. Login

Answer 1

There are several FDE (Full-Disk-Encryption) solutions that implement a pre-boot authentication (PBE) layer. I personally only have experience with Sophos SafeGuard Easy. They are used mainly in security aware environments like military or public security.

The replace the standard boot-loader whichs provided by Windows or Linux with their own bootloader. After sucessful authentication the PBA decrypts the volumes and starts the normal bootloader.

There are several authentication methods possible, either with a smart card, a username/password combination or a YubiKey. In the Sophos SGE solution a sync with all domain accounts on the machine is done and you can authenticate with your domain password.

In the YubiKey solution a USB-Stick is used. YubiKey with FDE

The same or another yubikey can then be used for the Windows-Logon with One-Time-Passwords.

For your process a look at the mentioned EgoSecure Solution on the Link provided may be useful.

For preventing boot from an external hard drive, the standard solution would be deactivating boot from USB in the BIOS Settings.