Remote storage security
AssigneeGoogle Inc.
InventorsMattias Stefan Nissler, William Alexander Drewry, Darren David Krahn
Life of this patent
Estimating the term…
Abstract
Aspects of the subject technology relate to systems and methods for remote storage security. An encryption key is generated based at least on data stored locally by a computing device. The encryption key is bound to a context of the computing device. Data is encrypted using the encryption key. The encrypted data and information associated with the binding of the encryption key are provided for transmission to another computing device.
Claims19
A computer-implemented method, comprising:
- generating, by a first computing device, a first encryption key based at least on data stored locally by the first computing device;
- binding the first encryption key to a context of the first computing device using a binding certificate from a device remote from the first computing device, wherein the binding certificate is generated based on a timestamp associated with the binding and a boot mode associated with the first computing device at a time of creation of the binding certificate;
- encrypting data using the bound first encryption key so that the encrypted data is unusable by encryption keys bound to a context different than the context of the first computing device;
- and
- providing, for transmission to a second computing device, the encrypted data and information associated with the binding.
A system, comprising:
- one or more processors;
- and
- a non-transitory computer-readable medium comprising instructions stored therein, which when executed by the one or more processors, cause the one or more processors to perform operations comprising:
- receiving a binding certificate from a first computing device remote from the system, the binding certificate being generated based on a boot mode associated with the system at a time of creation of the binding certificate;
- generating a first encryption key based at least on data stored locally in the system;
- binding the first encryption key to the binding certificate using a symmetric encryption key embedded in the first computing device, wherein the binding certificate comprises information associated with a context of the system, the context comprising a timestamp associated with the binding certificate;
- encrypting data using the bound first encryption key so that the encrypted data is unusable by encryption keys bound to a context different than the context of the system;
- and
- providing, for transmission to a storage device, the encrypted data and the binding certificate.
A non-transitory machine-readable medium comprising instructions stored therein, which when executed by a machine, cause the machine to perform operations comprising:
- generating, by a first computing device, a nonce;
- providing, for transmission to a second computing device, the generated nonce;
- receiving a binding certificate and an identifier from the second computing device, wherein the binding certificate is generated based on the nonce and a boot mode associated with the first computing device, and wherein the received identifier is based at least on the generated nonce;
- generating, by the first computing device, a first encryption key based at least on data stored locally by the first computing device and the received identifier;
- deriving a symmetric encryption key from a locally stored identifier of the first computing device;
- encrypting the binding certificate using the symmetric encryption key;
- binding the encryption key to a context of the first computing device using the binding certificate;
- encrypting data using the first encryption key so that the encrypted data is unusable by encryption keys bound to a context different than the context of the first computing device;
- and
- providing, for transmission to a storage device, the encrypted data and information associated with the binding.
Dependencies are inferred from the claim text.