Detection and remediation of unauthorized boot of storage media

An apparatus, comprising:

• a cryptographic key for decrypting content to be read from a storage media;
• a control circuit configured to, upon a boot of a server:
• dynamically generate a new boot authentication code using a prescribed method;
• determine a reconstituted boot authentication code, the reconstituted boot authentication code reconstituted from an initial boot authentication code that was previously generated using the prescribed method;
• compare the new and reconstituted boot authentication codes;
• based on a determination that the new and reconstituted boot authentication codes do not match, take a corrective action;
• reconstitute the reconstituted boot authentication code from secrets derived from the initial boot authentication code;
• delete the secrets after reconstituting the reconstituted boot authentication code from the secrets;
• and
• delete the reconstituted boot authentication code after comparing the new and reconstituted boot authentication codes.

A method, comprising:

• providing a cryptographic key for decrypting content to be read from a storage media;
• dynamically generating a new boot authentication code using a prescribed method;
• determining a reconstituted boot authentication code, the reconstituted boot authentication code reconstituted from an initial boot authentication code that was previously generated using the prescribed method;
• compare the new and reconstituted boot authentication codes;
• based on a determination that the new and reconstituted boot authentication codes do not match, taking a corrective action;
• generating the initial boot authentication code using the prescribed method;
• generating a plurality of secrets derived from the initial boot authentication code;
• storing one or more the plurality of secrets locally in encrypted form or remotely from the apparatus;
• and
• deleting the initial boot authentication code and any of the plurality of secrets that are unencrypted and local to the apparatus.

A method, comprising:

• providing a cryptographic key for decrypting content to be read from a storage media;
• dynamically generating a new boot authentication code using a prescribed method;
• determining a reconstituted boot authentication code, the reconstituted boot authentication code reconstituted from an initial boot authentication code that was previously generated using the prescribed method;
• compare the new and reconstituted boot authentication codes;
• based on a determination that the new and reconstituted boot authentication codes do not match, taking a corrective action;
• reconstituting the reconstituted boot authentication code from secrets derived from the initial boot authentication code;
• deleting the secrets after reconstituting the reconstituted boot authentication code from the secrets;
• and
• deleting the reconstituted boot authentication code after comparing the new and reconstituted boot authentication codes.