Last resort safe schema

A computer-implemented method comprising:

• responsive to receiving from a user a public key of the user, using the public key, an authentication value, and a secure platform of an information handling system to generate an asymmetric key pair comprising a secure platform private key, which is kept on the secure platform of the information handling system, and a secure platform public key;
• receiving from the information handling system the secure platform public key and an entity identifier, which is a unique identifier associated with the secure platform private key stored on the secure platform of the information handling system, in which at least the secure platform public key is received in an encrypted form having been encrypted using the public key of the user for encrypting;
• storing, for use for a last resort access process, the authentication value, the entity identifier, the secure platform public key in encrypted form having been encrypted using the public key of the user, and a device identifier associated with at least the information handling system in a last resort access key storage;
• and
• providing to the user the device identifier.

An information handling system comprising:

• one or more processors;
• a secure platform module comprising a secure platform private key, which is part of an asymmetric key pair comprising the secure platform private key and a secure platform public key;
• one or more non-transitory computer-readable media comprising one or more sets of instructions which, when executed by at least one of the one or more processors, by the secure platform module, or a combination thereof, causes steps to be performed comprising:
• receiving from a user a request to start a secure session with an information handling system to gain access to an account via a last resort access process;
• requesting from the user an entity identifier, which is a unique identifier associated with a secure platform private key stored on a secure platform associated with the information handling system, and a client nonce value;
• responsive to receiving from the user the client nonce value and the entity identifier, in which the entity identifier was obtained by the user following authentication to a last resort access keys storage maintained by a provider that was involved in a last resort access initialization process that established an asymmetric key pair comprising the secure platform private key and a secure platform public key, in which an encrypted form of the secure platform public having been encrypted using a public key of the user is stored in the last resort access keys storage, responding with a secure platform nonce value and an authentication challenge code;
• and
• responsive to receiving from the user a session code generated by the provider, the authentication challenge code in an encrypted form having been encrypted using the secure platform public key of the user, and the entity identifier:
• using the session code to authorize usage of secure platform private key corresponding to the entity identifier;
• using the secure platform private key to decrypt the authentication challenge code in encrypted form;
• responsive to the decrypted authentication challenge code matching the authentication challenge code, granting the secure session for the user;
• and
• responsive to the decrypted authentication challenge code not matching the authentication challenge code, denying the secure session for the user.