Unlock and recovery for encrypted devices

Patent metadata

Field	Value
Publication number	US-10078748-B2
Application number	US-201514941246-A
Country	US
Kind code	B2
Filing date	Nov 13, 2015
Priority date	Nov 13, 2015
Publication date	Sep 18, 2018
Grant date	Sep 18, 2018

Abstract

A computing device can perform operations to unlock encrypted volumes of the computing device while the computing device is in a recovery environment. In some examples, the computing device can work in conjunction with a test computing device to unlock the encrypted volumes using an unlock token and a PIN. In other examples, the computing device can perform operations without a test computing device. For example, the computing device can, while in the recovery environment, use credentials associated with a user of the computing device to obtain a recovery password to unlock keys for interpreting the encrypted volumes. In some examples, the computing device can use a shortened recovery password in conjunction with anti-hammering capabilities of a Trusted Platform Module in order to unlock keys for interpreting the encrypted volumes. These and other operations can facilitate secure unlock of volumes of encrypted data on a consumer device.

First claim

What is claimed is:

1. A computing device, comprising:
one or more processors;
a Trusted Platform Module; and
computer-readable media configured to be communicatively coupled to the one or more processors and storing instructions that, based on execution by the one or more processors, configure the computing device, to:
enter a recovery mode on the computing device;
receive credentials associated with accessing a security account;
access the security account using the credentials;
obtain a first recovery password from the security account;
provide the first recovery password to the Trusted Platform Module to perform authentication;
receive, from the Trusted Platform Module in response to successfully authenticating the first recovery password, a second recovery password, wherein the first recovery password is shorter than the second recovery password; and
retrieving one or more keys using the second recovery password to encrypt or decrypt data stored in the computing device.

2. The computing device of claim 1 , wherein the credentials comprise a user ID and password.

3. The computing device of claim 1 , wherein the security account comprises a cloud-based security account.

4. The computing device of claim 3 , further configured to:
detect one or more networks usable to access the cloud-based security account;
present a user interface, via a display of the computing device, to prompt entry of access information associated with logging into the one or more networks;
connect, via the one or more networks, to the cloud-based security account;
submit the credentials into one or more input fields of the cloud-based security account; and
access the cloud-based security account.

5. The computing device of claim 1 , wherein obtaining the first recovery password from the security account comprises identifying the first recovery password from data of the security account.

6. The computing device of claim 1 , further configured to reboot the computing device into another operating mode other than a recovery mode.

7. The computing device of claim 1 , wherein the first recovery password is usable to unlock one or more unlock keys associated with an encrypted partition of the computing device.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Mehta Yogesh A
• Ureche Octavian T
• Shell Scott R
• Basmov Innokentiy
• Novotney Peter
• Walstad Christopher L

Classifications

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• G06F2221/2131

  Lost password, e.g. recovery of lost or forgotten passwords · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title