# US 10,872,042 B2 · Backup system with multiple recovery keys

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,872,042 B2
- Document ID: US10872042B2
- Status: Granted
- Kind: B2
- Application number: 15/889,192
- Filed: 2018-02-05
- Published: 2018-08-09
- Granted: 2020-12-22
- Earliest claimed: 2015-05-31
- Assignees: Apple Inc.
- Applicants: Apple Inc.
- Inventors: Michael D. Ford; Jerrold V. Hauck; Matthew G. Watson; Mitchell D. Adler; Dallas B. De Atley; James Wilson
- Web page: https://patentgrep.com/patent/US10872042B2

## CPC

- G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)}
- G06F 11/1448: {Management of the data involved in backup or backup restore}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 9/006: {involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/0822: {using key encryption key}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- G06F 2201/80: Database-specific techniques
- G06F 2212/1052: Security improvement
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Some embodiments provide, for a particular device in a set of related devices, a method for backing up data synchronized between the set of related devices. The method stores the backup data encrypted with a set of data encryption keys. The method also stores the set of data encryption keys encrypted with a master recovery key. The method also stores several copies of master recovery key data, each copy of the master recovery key data encrypted with a public key of a different one of the related devices. The backup data is only recoverable by accessing a private key of any one of the related devices.

## Claims

### Claim 1

A method for recovering a set of backup data for installation on a device, the method-comprising:
receiving input of user-entered data used to generate a public/private escrow key pair associated with a particular device of a set of related devices;
transmitting data that proves possession of the private escrow key to a set of secure servers that store a plurality of secure escrow objects for the set of related devices, each of the secure escrow objects comprising a private recovery key of a different device encrypted with a public key of the secure servers and the public escrow key associated with the device;
when the user-entered data that is used to generate the public/private escrow key pair is correct, receiving the private recovery key of the particular device from the set of secure servers; and
using the received private recovery key to access one of a plurality of master recovery objects stored with the backup data, each of the master recovery objects comprising a master recovery key for accessing the backup data encrypted with a public recovery key of a different one of the related devices.

### Claim 2 (depends on 1)

The method of claim 1, wherein receiving the private recovery key comprises:
receiving a recovery object comprising the private recovery key encrypted with the public escrow key; and
decrypting the recovery object with the private escrow key to recover the private recovery key.

### Claim 3 (depends on 1)

The method of claim 1, wherein the device is one of the related devices after re-installation of an operating system of the device.

### Claim 4 (depends on 1)

The method of claim 1, wherein receiving input of the user-entered data comprises input of a device passcode for the device, the method further comprising:
identifying the devices in the set of related devices; and
automatically selecting one of the related devices most likely to have a same passcode as the device passcode input for the device according to a set of heuristics,
wherein the private escrow key is identified as the escrow key for decrypting a particular one of the secure escrow objects corresponding to the automatically selected device.

### Claim 5 (depends on 1)

The method of claim 1, wherein transmitting the data that proves possession of the private escrow key comprises:
setting up a secure channel with the set of secure servers; and
transmitting the data to the set of secure servers via the secure channel,
wherein the private recovery key is received from the set of secure servers via the secure channel, wherein the set of secure servers and the secure channel prevent a centralized entity that stores the backups from being able to acquire the private recovery key.

### Claim 6 (depends on 1)

The method of claim 1, wherein the set of secure servers comprises a set of hardware security modules that store the private keys of the secure servers and a set of proxy servers that store the secure escrow objects, wherein the set of hardware security modules performs decryption of the secure escrow object.

### Claim 7 (depends on 1)

The method of claim 1, wherein:
when the user-entered data that is used to generate the public/private escrow key pair is incorrect, the set of secure servers decrements a number of available attempts to access a particular secure escrow object that the device attempted to access; and
when the number of available attempts reaches zero, the particular secure escrow object is made inaccessible.

### Claim 8

A non-transitory machine readable medium storing a program which when executed by at least one processing unit recovers a set of backup data for installation on a device, the program comprising sets of instructions for:
receiving input of user-entered data used to generate a public/private escrow key pair associated with a particular device of a set of related devices;
transmitting data that proves possession of the private escrow key to a set of secure servers that store a plurality of secure escrow objects for the set of related devices, each of the secure escrow objects comprising a private recovery key of a different device encrypted with a public key of the secure servers and the public escrow key associated with the device;
when the user-entered data that is used to generate the public/private escrow key pair is correct, receiving the private recovery key of the particular device from the set of secure servers; and
using the received private recovery key to access one of a plurality of master recovery objects stored with the backup data, each of the master recovery objects comprising a master recovery key for accessing the backup data encrypted with a public recovery key of a different one of the related devices.

### Claim 9 (depends on 8)

The non-transitory machine readable medium of claim 8, wherein the set of instructions for receiving the private recovery key comprises sets of instructions for:
receiving a recovery object comprising the private recovery key encrypted with the public escrow key; and
decrypting the recovery object with the private escrow key to recover the private recovery key.

### Claim 10 (depends on 8)

The non-transitory machine readable medium of claim 8, wherein the device is one of the related devices after re-installation of an operating system of the device.

### Claim 11 (depends on 8)

The non-transitory machine readable medium of claim 8, wherein the input of the user-entered data comprises input of a device passcode for the device, the program further comprising sets of instructions for:
identifying the devices in the set of related devices; and
automatically selecting one of the related devices most likely to have a same passcode as the device passcode input for the device according to a set of heuristics,
wherein the private escrow key is identified as the escrow key for decrypting a particular one of the secure escrow objects corresponding to the automatically selected device.

### Claim 12 (depends on 8)

The non-transitory machine readable medium of claim 8, wherein the set of instructions for transmitting the data that proves possession of the private escrow key comprises sets of instructions for:
setting up a secure channel with the set of secure servers; and
transmitting the data to the set of secure servers via the secure channel,
wherein the private recovery key is received from the set of secure servers via the secure channel, wherein the set of secure servers and the secure channel prevent a centralized entity that stores the backups from being able to acquire the private recovery key.

### Claim 13 (depends on 8)

The non-transitory machine readable medium of claim 8, wherein the set of secure servers comprises a set of hardware security modules that store the private keys of the secure servers and a set of proxy servers that store the secure escrow objects, wherein the set of hardware security modules performs the decryption of the secure escrow object.

### Claim 14 (depends on 8)

The non-transitory machine readable medium of claim 8, wherein:
when the user-entered data that is used to generate the public/private escrow key pair is incorrect, the set of secure servers decrements a number of available attempts to access a particular secure escrow object that the device attempted to access; and
when the number of available attempts reaches zero, the particular secure escrow object is made inaccessible.

### Claim 15

A device comprising:
a set of processing units; and
a non-transitory machine readable medium storing a program which when executed by at least one of the processing units recovers a set of backup data for installation on the device, wherein the backup data is stored for a set of related devices by one of the related devices, the program comprising sets of instructions for:
receiving input of user-entered data used to generate a public/private escrow key pair associated with a particular one of the related devices;
transmitting data that proves possession of the private escrow key to a set of secure servers that store a plurality of secure escrow objects for the set of related devices, each of the secure escrow objects comprising a private recovery key of a different device encrypted with a public key of the secure servers and the public escrow key associated with the device;
when the user-entered data that is used to generate the public/private escrow key pair is correct, receiving the private recovery key of the particular device from the set of secure servers; and
using the received private recovery key to access one of a plurality of master recovery objects stored with the backup data, each of the master recovery objects comprising a master recovery key for accessing the backup data encrypted with a public recovery key of a different one of the related devices.

### Claim 16 (depends on 15)

The device of claim 15, wherein the set of instructions for receiving the private recovery key comprises sets of instructions for:
receiving a recovery object comprising the private recovery key encrypted with the public escrow key; and
decrypting the recovery object with the private escrow key to recover the private recovery key.

### Claim 17 (depends on 15)

The device of claim 15, wherein the input of the user-entered data comprises input of a device passcode for the device, the program further comprising sets of instructions for:
identifying the devices in the set of related devices; and
automatically selecting one of the related devices most likely to have a same passcode as the device passcode input for the device according to a set of heuristics,
wherein the private escrow key is identified as the escrow key for decrypting a particular one of the secure escrow objects corresponding to the automatically selected device.

### Claim 18 (depends on 15)

The device of claim 15, wherein the set of instructions for transmitting the data that proves possession of the private escrow key comprises sets of instructions for:
setting up a secure channel with the set of secure servers; and
transmitting the data to the set of secure servers via the secure channel,
wherein the private recovery key is received from the set of secure servers via the secure channel, wherein the set of secure servers and the secure channel prevent a centralized entity that stores the backups from being able to acquire the private recovery key.

### Claim 19 (depends on 15)

The device of claim 15, wherein the set of secure servers comprises a set of hardware security modules that store the private keys of the secure servers and a set of proxy servers that store the secure escrow objects, wherein the set of hardware security modules performs decryption of the secure escrow object.

### Claim 20 (depends on 15)

The device of claim 15, wherein:
when the user-entered data that is used to generate the public/private escrow key pair is incorrect, the set of secure servers decrements a number of available attempts to access a particular secure escrow object that the device attempted to access; and
when the number of available attempts reaches zero, the particular secure escrow object is made inaccessible.