System and method for recovery key management

Patent metadata

Field	Value
Publication number	US-9520998-B2
Application number	US-201414528758-A
Country	US
Kind code	B2
Filing date	Oct 30, 2014
Priority date	Feb 6, 2009
Publication date	Dec 13, 2016
Grant date	Dec 13, 2016

Abstract

A system and method for managing the recovery key of a computer system is disclosed. The computer system includes a security layer, and the recovery key is stored locally to a memory location on the computer system, including, as examples, flash memory on the motherboard of the computer system or a USB port on the computer system. In operation, when it becomes necessary for the computer system to authenticate the recovery key, the recovery key may be retrieved from the local memory. The retrieval and storage of the recovery key may be managed by a remote administrator. The recovery key may be stored in a hidden partition in the storage location, and the recovery key may be cryptographically wrapped to add an additional layer of security.

First claim

What is claimed is:

1. A method for providing security to the configuration of an information handling system, comprising:
providing a security layer,
monitoring a hardware configuration of the information handling system by the security layer, wherein the security layer includes a device within the information handling system that authenticates a key;
storing the key to a storage location local to the information handling system;
determining, by a BIOS, if a configuration change to the information handling system has occurred by comparing a first hash code to a second hash code, wherein the first hash code represents a previous hardware or software configuration of the information handling system and the second hash code represents a current hardware or software configuration of the information handling system;
setting a flag in the BIOS indicative of the configuration change;
requesting, by the security layer, a new key based, at least in part, on the flag; and
booting the information handling system based, at least in part, on an authentication of the new key.

2. The method for providing security to the configuration of an information handling system of claim 1 , wherein the security layer is configured according to the Trusted Platform Module specification.

3. The method for providing security to the configuration of an information handling system of claim 1 , wherein the storage location is directly coupled to the motherboard of the information handling system.

4. The method for providing security to the configuration of an information handling system of claim 3 , wherein the storage location is flash memory.

5. The method for providing security to the configuration of an information handling system of claim 1 , wherein the storage location is coupled to the information handling system through a USB port.

6. The method for providing security to the configuration of an information handling system of claim 5 , wherein the USB port is external to the computer system.

7. The method for providing security to the configuration of an information handling system of claim 5 , wherein the USB port is internal to the computer system.

8. The method for providing security to the configuration of an information handling system of claim 1 , wherein the step of storing the key to the storage location comprises the step of storing the key to a designated partition on the storage location.

9. The method for providing security to the configuration of an information handling system of claim 8 , further comprising the step of:
hiding the designated partition following the step of storing the key to the designated partition.

10. The method for providing security to the configuration of an information handling system of claim 1 , wherein the step of storing the key to the storage location comprises the step of cryptographically wrapping the key prior to storage of the key to the storage location.

Assignees

• Dell Products Lp

Inventors

• Balakrishnan Viswanathan
• Bhadri Santosh
• Khatri Mukund P
• Marks Kevin T
• Subramaniam Narayanan
• Balakrishnan Venkatesan

Classifications

• G06F21/575 Primary

  Secure boot · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/3236

  using cryptographic hash functions · CPC title

• G06F11/1402

  Saving, restoring, recovering or retrying · CPC title

• H04L9/0816 Primary

  Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use · CPC title