Protecting sensitive information from an authorized device unlock
OwnerErnest Brickellinventor
Life of this patent
Estimating the term…
Abstract
Methods and apparati for auditing uses of cryptographic keys. In a method embodiment of the present invention, a set of audited uses for a cryptographic key is defined; the key is generated inside a protected execution environment of a digital computer; all software and firmware that is usable in the execution environment to access the key is demonstrated to an auditor; and, for each audited use of the key, a non-tamperable audit record describing said use is released.
Claims6
A computing device comprising:
- a first partition in which only applications authorized by a cryptographic verification performed on the computing device can execute;
- a second partition in which applications can execute without the authorization required by the first partition;
- an unlocking component comprising two modules for unlocking the device, a primary unlock module, and an authorized external unlock module;
- and
- coupled to the first and second partitions, a resource protection module configured to prevent protected data of applications authorized to execute in the first partition from being accessed by applications executing in the second partition;
- wherein
- the resource protection module is further configured to prevent protected data of applications authorized to execute in the first partition from being accessed by applications executing in the second partition conditioned upon the device having been unlocked using the authorized external unlock module;
- and
- the authorized external unlock module comprises an unlock verification key and a verification module for verifying a digital signature using the unlock verification key, wherein the verification module is configured to verify the digital signature before issuing a valid unlock command.
Method for unlocking a locked computing device having first and second partitions for executing applications, said method comprising a partition protection technique and first and second unlocking techniques, wherein:
- the partition protection technique prevents applications executing in the second partition from accessing data of applications executing in the first partition;
- the first unlocking technique comprises unlocking the device through entry of a user password which allows access to both partitions;
- the second unlocking technique comprises unlocking the device through an authorized external unlock method which allows access to only the second partition, access to the first partition being denied;
- and
- the authorized external unlock method comprises employing an unlock verification key and a verification module for verifying a digital signature using the unlock verification key, wherein the verification module is configured to verify the digital signature before issuing a valid unlock command.
Dependencies are inferred from the claim text.