Key management to protect encrypted data of an endpoint computing device

In a computing system environment, a method of protecting encrypted data of an endpoint computing device, the encrypted data saved in memory and or disk of the endpoint and able to be decrypted with a key located in a trusted platform module at the endpoint computing device, comprising:

• upon a booting of the endpoint, launching a pre-boot phase of operation during which time a pre-boot operating system prevents a user of the endpoint from accessing the encrypted data and the key, the pre-boot phase of operation further including,
• determining whether the encrypted data has been compromised;
• if so, locating the key in the trusted platform module;
• and
• deleting an existence of the key from the trusted platform module.

In a computing system environment, a method of protecting encrypted data of an endpoint computing device, the encrypted data saved in memory and or disk of the endpoint and able to be decrypted with a key located at the endpoint computing device, comprising:

• upon a booting of the endpoint, launching a pre-boot phase of operation during which time a pre-boot operating system prevents a user of the endpoint from accessing the encrypted data and the key and enforces a limited computing connection between the endpoint and one of a specified authentication server networked to the endpoint in the computing system environment, approved networking ports of the endpoint, approved USB devices connected to the endpoint, and approved biometric devices, the pre-boot phase of operation further including,
• determining whether the encrypted data has been compromised;
• and
• if so, disassociating the key from the encrypted data.

An endpoint computing device, comprising:

• a hardware platform including a processor, memory and disk;
• encrypted data configured for storage in the memory and or disk;
• a key stored on the hardware platform to decrypt the encrypted data;
• a policy enforcement module on the hardware platform to carry out predefined security policies between the key and the encrypted data;
• and
• a computing operating system and a pre-boot operating system configured to act on the processor such that upon launching a pre-boot phase of operation the policy enforcement module requires the pre-boot operating system to prevent a user of the endpoint from accessing the encrypted data and the key and requires the disassociation of the key from the encrypted data upon a determination that the encrypted data has been compromised.