System and method for content protection based on a combination of a user pin and a device specific identifier

Patent metadata

Field	Value
Publication number	US-9288047-B2
Application number	US-201414299375-A
Country	US
Kind code	B2
Filing date	Jun 9, 2014
Priority date	Apr 7, 2010
Publication date	Mar 15, 2016
Grant date	Mar 15, 2016

Abstract

Disclosed herein are systems, methods, and non-transitory computer-readable storage media for encryption and key management. The method includes encrypting each file on a computing device with a unique file encryption key, encrypting each unique file encryption key with a corresponding class encryption key, and encrypting each class encryption key with an additional encryption key. Further disclosed are systems, methods, and non-transitory computer-readable storage media for encrypting a credential key chain. The method includes encrypting each credential on a computing device with a unique credential encryption key, encrypting each unique credential encryption key with a corresponding credential class encryption key, and encrypting each class encryption key with an additional encryption key. Additionally, a method of generating a cryptographic key based on a user-entered password and a device-specific identifier secret utilizing an encryption algorithm is disclosed.

First claim

What is claimed is:

1. A method for generating a master key for encrypting content stored by a computing device, the method comprising:
at a hardware module included in the computing device, wherein the hardware module is separate and distinct from a processor included in the computing device:
receiving, from the processor, a request to generate the master key, wherein the request includes a user password;
accessing an identifier that is unique to the computing device, wherein the identifier is stored by the hardware module in a manner that prevents software executing by way of the processor from directly accessing the identifier;
combining the password and the identifier to produce a combined value;
receiving an indication of a desired security level for the master key;
carrying out an iterative function on the combined value to produce the master key, wherein a number of iterations associated with the iterative function is based on the desired security level; and
providing the master key to the processor, wherein the master key is utilized by the processor to encrypt the content.

2. The method of claim 1 , wherein the identifier is accessible only to the hardware module within the computing device.

3. The method of claim 1 , wherein the request specifies a number of iterations to be performed on the combined value by the iterative function.

4. The method of claim 3 , wherein the iterative process includes a Password-Based Key Derivation Function 2 (PBKDF2).

5. The method of claim 3 , wherein the iterative process includes a Hash-based Message Authentication Code Secure Hash Algorithm 1 (HMAC-SHA1).

6. The method of claim 1 , wherein the identifier is larger than the user password.

7. A non-transitory computer readable storage medium configured to store instructions that, when executed by a hardware module included in a computing device, cause the hardware module to generate a master key, by carrying out steps that include:
receiving, from a processor included in the computing device, a request to generate the master key, wherein the request includes a password that is associated with a user of the computing device, and the processor is separate and distinct from the hardware module;
accessing an identifier that is unique to the computing device, wherein the identifier is stored by the hardware module in a manner that prevents software executing by way of the processor from directly accessing the identifier;
combining the password and the identifier to produce a combined value;
receiving an indication of a desired security level for the master key;
carrying out an iterative function on the combined value to produce the master key, wherein a number of iterations associated with the iterative function is based on the desired security level; and
providing the master key to the processor, wherein the master key is utilized by the processor to encrypt the content.

8. The non-transitory computer readable storage medium of claim 7 , wherein the steps further include:
providing the master key to the processor for encrypting content stored on the computing device.

9. The non-transitory computer readable storage medium of claim 7 , wherein the identifier is accessible only to the hardware module within the computing device.

10. The non-transitory computer readable storage medium of claim 7 , wherein the request specifies a number of iterations to be performed on the combined value by the iterative function.

11. The non-transitory computer readable storage medium of claim 10 , wherein the iterative process includes a Password-Based Key Derivation Function 2 (PBKDF2).

12. The non-transitory computer readable storage medium of claim 10 , wherein the iterative process includes a Hash-based Message Authentication Code Secure Hash Algorithm 1 (HMAC-SHA1).

13. A computing device configured to generate a master key for encrypting content, the computing device comprising:
a memory that stores the content;
a processor, wherein the processor is configured to:
receive, from a user, a first request to encrypt the content, wherein the first request includes a password associated with the user, and
issuing, to a hardware module included in the computing device, a second request to generate the master key based on the password and an identifier that is unique to the computing device, wherein the identifier is stored by the hardware module in a manner that prevents software executing by way of the processor from directly accessing the identifier; and

the hardware module, wherein the hardware module is separate and distinct from the processor and is configured to carry out steps that include:
receiving, from the processor, the second request,
accessing the identifier stored by the hardware module,
combining the password and the identifier to produce a combined value;
receiving an indication of a desired security level for the master key;
carrying out an iterative function on the combined value to produce the master key, wherein a number of iterations associated with the iterative function is based on the desired security level; and
providing the master key to the processor, wherein the master key is utilized by the processor to encrypt the content.

14. The computing device of claim 13 , wherein:
the hardware module is further configured to provide the master key to the processor, and
the processor is further configured to encrypt the content using the master key.

15. The computing device of claim 13 , wherein the hardware module is an only component included in the computing device that is capable of accessing the identifier.

16. The computing device of claim 13 , wherein the second request specifies a number of iterations to be performed on the combined value by the iterative function comprises an iterative process that is performed on the combined value.

17. The computing device of claim 13 , wherein the identifier is larger than the user password.

Assignees

• Apple Inc

Inventors

• Brouwer Michael Lambertus Hubertus
• Adler Mitchell David

Classifications

• H04L9/3231

  Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861) · CPC title

• H04L9/0863 Primary

  involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067) · CPC title

• H04L9/0861 Primary

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title