Systems and methods for cryptographically verifying a user of a computing device at the bootloader level

A computing device comprising:

• one or more hardware processors configured to:
• load a boot authentication controller into a memory of the computing device in response to a boot process of the computing device initializing firmware for one or more components of the computing device after the computing device is powered on;
• restrict access to the computing device based on execution of the boot authentication controller preventing an operating system (OS) from loading into the memory;
• determine a level-of-access from a plurality of different levels-of-access that a particular user has on the computing device from an encoded value that is received by the boot authentication controller and that is dynamically generated by an authentication server in response to verifying that the particular user is authorized to access the computing device with the level-of-access, wherein the encoded value comprises a time-based code and an identifier corresponding to a location at which to access a custom OS image that is configured to provide the OS with the level-of-access from a plurality of different custom OS images;
• customize the OS with the level-of-access specified in the encoded value by:
• decoding the encoded value using a decryption key configured on the boot authentication controller for a corresponding encryption key of the authentication server that was used to encode the encoded value, wherein decoding the encoded value comprises extracting the time-based code and the identifier;
• retrieving the custom OS image from the location associated with the identifier after verifying validity of the time-based code;
• and
• configuring a customized OS on the computing device using the custom OS image;
• and
• boot the computing device with the customized OS that provides the level-of-access based on said customizing.

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a computing device, cause the computing device to perform operations comprising:

• loading a boot authentication controller into a memory of the computing device in response to a boot process of the computing device initializing firmware for one or more components of the computing device after the computing device is powered on;
• restricting access to the computing device based on execution of the boot authentication controller preventing an operating system (OS) from loading into the memory;
• determining a level-of-access from a plurality of different levels-of-access that a particular user has on the computing device from an encoded value that is received by the boot authentication controller and that is dynamically generated by an authentication server in response to verifying that the particular user is authorized to access the computing device with the level-of-access, wherein the encoded value comprises a time-based code and an identifier corresponding to a location at which to access a custom OS image that is configured to provide the OS with the level-of-access from a plurality of different custom OS images;
• customizing the OS with the level-of-access specified in the encoded value by:
• decoding the encoded value using a decryption key configured on the boot authentication controller for a corresponding encryption key of the authentication server that was used to encode the encoded value, wherein decoding the encoded value comprises extracting the time-based code and the identifier;
• retrieving the custom OS image from the location associated with the identifier after verifying validity of the time-based code;
• and
• configuring a customized OS on the computing device using the custom OS image;
• and
• booting the computing device with the customized OS that provides the level-of-access based on said customizing.