US 8,265,270 B2Granted

Utilizing cryptographic keys and online services to secure devices

AssigneeMicrosoft Corporation

InventorDarko Kirovski

Life of this patent

Estimating the term…

Loading patent…

Abstract

The claimed subject matter in accordance with an aspect provides systems and/or methods that generates, allocates, or utilizes strong symmetric cryptographic keys to secure storage devices. The system can include components that determine whether a storage device with an associated credential cache has been affiliated with the system. The system extracts authentication information included within the credential cache and establishes communications with a web service that utilizes the authentication information to generate and return a set strong symmetric cryptographic keys to the system. The system employs one of the set of strong symmetric cryptographic keys to encrypt or decrypt the storage device to make content persisted on the storage device available and thereafter removes the distributed set of strong symmetric cryptographic keys from the system.

Claims20

Dependent claims

A machine implemented system that facilitates and effectuates at least one of generation, allocation, or utilization of cryptographic keys to secure portable storage devices, comprising:

one or more computer storage media having stored therein one or more computer executable components;
and
one or more processors that execute the one or more computer executable components, the one or more computer executable components comprising:
a component that receives from an interface a notification that a device has been associated with the component, the component locates a credential cache affiliated with the device and extracts a previously established username and password combination, the previously established username and password combination utilized to initiate a communication with a server, the server employing the previously established username and password combination and generating and distributing a set of cryptographic keys related to the previously established username and password combination to the component, the component decrypts a content stored on the device with at least one key from the set of cryptographic keys, makes the content stored on the device available for use, and destroys the received set of cryptographic keys at the component after the content stored on the device is available for use,
in an event that the content is accessible by two or more users, the component authenticates information of the two or more users, the server generating and distributing a distinct set of cryptographic keys to each user, the component requires all sets of cryptographic keys of the two or more users being available to the component within a predetermined time and decrypts the content stored on the device with at least one key from each set of cryptographic keys of the two or more users, any single set of cryptographic keys being unable to decrypt the content stored on the device.

2 more elements

A method comprising:

under control of one or more processors configured with computer-executable instructions:
receiving from an interface a notification that a device has been associated;
locating a credential cache affiliated with the device;
extracting a previously established username and password combination from the credential cache;
utilizing the previously established username and password combination to establish a communication with a server;
receiving a set of cryptographic keys related to the previously established username and password combination from the server;
decrypting a content stored on the device with at least one key from the set of cryptographic keys, the decrypting including:
in an event that the content is accessible by two or more users,
authenticating information of the two or more users;
receiving from the server a distinct set of cryptographic keys to each user,
requiring all set of cryptographic keys of the two or more users being available within a predetermined time;
and
decrypting the content stored on the device with at least one key from each set of cryptographic keys of the two or more users, any single set of cryptographic keys being unable to decrypt the content stored on the device;
making the content stored on the device available for use;
and
destroying the received set of cryptographic keys after the content stored on the device is available for use.

13 more elements

One or more memories having stored therein computer executable instructions that, when executed by one or more processes, direct the one or more processors to perform actions comprising:

receiving from an interface a notification that a device has been associated;
locating a credential cache affiliated with the device;
extracting a previously established username and password combination from the credential cache;
utilizing the previously established username and password combination to establish a communication with a server;
receiving a set of cryptographic keys related to the previously established username and password combination from the server;
decrypting a content stored on the device with at least one key from the set of cryptographic keys, the decrypting including:
in an event that the content is accessible by two or more users,
authenticating information of the two or more users;
receiving from the server a distinct set of cryptographic keys to each user,
requiring all set of cryptographic keys of the two or more users being available within a predetermined time;
and
decrypting the content stored on the device with at least one key from each set of cryptographic keys of the two or more users, any single set of cryptographic keys being unable to decrypt the content stored on the device;
making the content stored on the device available for use;
and
destroying the received set of cryptographic keys after the content stored on the device is available for use.

12 more elements

Dependencies are inferred from the claim text.

Facts

Application: 11/951,021Filed 5 Dec 2007
Published: US 2009/0147949 A111 Jun 2009
Granted: 11 Sep 2012
Term ends: Not estimatedThe source records don’t support an estimate.

Classification3 codes

H04L 9/083
Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely…:…
H04L 9/3226
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…: using…
H04L
Digital communication