# US 8,788,842 B2 · System and method for content protection based on a combination of a user PIN and a device specific identifier

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,788,842 B2
- Document ID: US8788842B2
- Status: Granted
- Kind: B2
- Application number: 12/797,587
- Filed: 2010-06-09
- Published: 2011-10-13
- Granted: 2014-07-22
- Earliest claimed: 2010-04-07
- Assignees: Apple Inc.
- Applicants: Michael Lambertus Hubertus Brouwer; Mitchell David Adler
- Inventors: Michael Lambertus Hubertus Brouwer; Mitchell David Adler
- Web page: https://patentgrep.com/patent/US8788842B2

## CPC

- H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)}
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/0869: {involving random numbers or seeds}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)}
- H04L 2209/80: Wireless
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Disclosed herein are systems, methods, and non-transitory computer-readable storage media for encryption and key management. The method includes encrypting each file on a computing device with a unique file encryption key, encrypting each unique file encryption key with a corresponding class encryption key, and encrypting each class encryption key with an additional encryption key. Further disclosed are systems, methods, and non-transitory computer-readable storage media for encrypting a credential key chain. The method includes encrypting each credential on a computing device with a unique credential encryption key, encrypting each unique credential encryption key with a corresponding credential class encryption key, and encrypting each class encryption key with an additional encryption key. Additionally, a method of generating a cryptographic key based on a user-entered password and a device-specific identifier secret utilizing an encryption algorithm is disclosed.

## Claims

### Claim 1

A method carried out at a device, the method comprising:
receiving a user passcode, a device-specific key that is specific to the device, and a known random salt value;
performing a first sequence of operations, wherein, for each operation in the first sequence:
when the operation is a first operation in the first sequence, a hash-based message authentication code (HMAC) output is based on the user passcode and the known random salt value,
when the operation is not the first operation and is not a last operation in the first sequence, the HMAC output is based on the user passcode and a preceding HMAC output,
a first block output is based on an exclusive-or (XOR) of a first current value of the first block output and the HMAC output,
a first intermediate key output is based on a concatenation of a second current value of the first intermediate key output and the first block output, and
when the operation is the last operation in the first sequence, the first intermediate key output is provided as a plurality of blocks on which a second sequence of operations are performed to produce a derived key; and
encrypting content on the device using the derived key.

### Claim 2 (depends on 1)

The method of claim 1, wherein performing the second sequence of operations on the plurality of blocks comprises:
for each operation included in the second sequence:
a second block output is based on an XOR of a third current value of the second block output and a sequence number of the operation of the second sequence,
an encrypted block output is based on an encryption operation performed on an XOR of the third current value of the third current value of the second block output and the device-specific key,
a second intermediate key output is based on an XOR of a fourth current value of the second intermediate key output and the encrypted block output, and
when the operation is a last operation in the second sequence, the second intermediate key output is produced as the derived key.

### Claim 3 (depends on 1)

The method of claim 1, wherein the user passcode and the device-specific key are derived using an encryption algorithm.

### Claim 4 (depends on 1)

The method of claim 1, wherein a number of operations included in the first sequence of operations corresponds to a number of blocks included in the plurality of blocks.

### Claim 5 (depends on 1)

The method of claim 1, wherein each HMAC output comprises a secure hash algorithm.

### Claim 6 (depends on 5)

The method of claim 5, wherein the secure hash algorithm is based on Secure Hash Algorithm 1 (SHA1).

### Claim 7 (depends on 1)

The method of claim 1, wherein the device is a mobile device or a personal computer.

### Claim 8 (depends on 1)

The method of claim 1, wherein a value of the device-specific key is not accessible to applications executing on the device.

### Claim 9

A system configured to access content that is protected by a derived key, the system comprising:
a processor; and
a memory configured to store instructions that, when executed by the processor, cause the system to:
receive a user passcode, a device-specific key that is specific to the system, and a known random salt value;
perform a first sequence of operations, wherein, for each operation in the first sequence:
when the operation is a first operation in the first sequence, a hash-based message authentication code (HMAC) output is based on the user passcode and the known random salt value,
when the operation is not the first operation and is not a last operation in the first sequence, the HMAC output is based on the user passcode and a preceding HMAC output,
a first block output is based on an exclusive-or (XOR) of a first current value of the first block output and the HMAC output,
a first intermediate key output is based on a concatenation of a second current value of the first intermediate key output and the first block output, and
when the operation is the last operation in the first sequence, the first intermediate key output is provided as a plurality of blocks on which a second sequence of operations are performed to produce the derived key; and
decrypt at least a part of the content using the derived key.

### Claim 10 (depends on 9)

The system of claim 9, wherein a value of the device-specific key is not accessible to applications executing on the system.

### Claim 11 (depends on 9)

The system of claim 9, wherein the device-specific key is unique with respect to device-specific keys for other systems.

### Claim 12 (depends on 9)

The system of claim 9, wherein a number of operations included in the first sequence of operations corresponds to a number of blocks included in the plurality of blocks.

### Claim 13 (depends on 9)

The system of claim 9, wherein performing the second sequence of operations on the plurality of blocks comprises:
for each operation included in the second sequence:
a second block output is based on an XOR of a third current value of the second block output and a sequence number of the operation of the second sequence,
an encrypted block output is based on an encryption operation performed on an XOR of the third current value of the third current value of the second block output and the device-specific key,
a second intermediate key output is based on an XOR of a fourth current value of the second intermediate key output and the encrypted block output, and
when the operation is a last operation in the second sequence, the second intermediate key output is produced as the derived key.

### Claim 14

A non-transitory computer-readable storage medium configured to store instructions that, when executed by a processor included in a computing device, cause the computing device to carry out steps that include:
receiving a user passcode, a device-specific key that is specific to the computing device, and a known random salt value;
performing a first sequence of operations, wherein, for each operation in the first sequence:
when the operation is a first operation in the first sequence, a hash-based message authentication code (HMAC) output is based on the user passcode and the known random salt value,
when the operation is not the first operation and is not a last operation in the first sequence, the HMAC output is based on the user passcode and a preceding HMAC output,
a first block output is based on an exclusive-or (XOR) of a first current value of the first block output and the HMAC output,
a first intermediate key output is based on a concatenation of a second current value of the first intermediate key output and the first block output, and
when the operation is the last operation in the first sequence, the first intermediate key output is provided as a plurality of blocks on which a second sequence of operations are performed to produce a derived key; and
encrypting content on the computing device using the derived key.

### Claim 15 (depends on 14)

The non-transitory computer-readable storage medium of claim 14, wherein encrypting the content on the computing device comprises encrypting at least one of a file, a folder, a keychain, a file system, a partition, and a block.

### Claim 16 (depends on 14)

The non-transitory computer-readable storage medium of claim 14, wherein the device-specific key is unique relative to device-specific keys for other computing devices.

### Claim 17 (depends on 14)

The non-transitory computer-readable storage medium of claim 14, wherein performing the second sequence of operations on the plurality of blocks comprises:
for each operation included in the second sequence:
a second block output is based on an XOR of a third current value of the second block output and a sequence number of the operation of the second sequence,
an encrypted block output is based on an encryption operation performed on an XOR of the third current value of the third current value of the second block output and the device-specific key,
a second intermediate key output is based on an XOR of a fourth current value of the second intermediate key output and the encrypted block output, and
when the operation is a last operation in the second sequence, the second intermediate key output is produced as the derived key.

### Claim 18

A method for accessing content that is protected by a derived key, wherein the method is carried out at a computing device, and the method comprises:
receiving a user passcode, a device-specific key that is specific to the computing device, and a known random salt value;
performing a first sequence of operations, wherein, for each operation in the first sequence:
when the operation is a first operation in the first sequence, a hash-based message authentication code (HMAC) output is based on the user passcode and the known random salt value,
when the operation is not the first operation and is not a last operation in the first sequence, the HMAC output is based on the user passcode and a preceding HMAC output,
a first block output is based on an exclusive-or (XOR) of a first current value of the first block output and the HMAC output,
a first intermediate key output is based on a concatenation of a second current value of the first intermediate key output and the first block output, and
when the operation is the last operation in the first sequence, the first intermediate key output is provided as a plurality of blocks on which a second sequence of operations are performed to produce the derived key; and
decrypting at least a part of the content using the derived key.

### Claim 19 (depends on 18)

The method of claim 18, wherein performing the second sequence of operations on the plurality of blocks comprises:
for each operation included in the second sequence:
a second block output is based on an XOR of a third current value of the second block output and a sequence number of the operation of the second sequence,
an encrypted block output is based on an encryption operation performed on an XOR of the third current value of the third current value of the second block output and the device-specific key,
a second intermediate key output is based on an XOR of a fourth current value of the second intermediate key output and the encrypted block output, and
when the operation is a last operation in the second sequence, the second intermediate key output is produced as the derived key.

### Claim 20 (depends on 18)

The method of claim 18, wherein a number of operations included in the first sequence of operations corresponds to a number of blocks included in the plurality of blocks.

### Claim 21 (depends on 18)

The method of claim 18, wherein a value of the device-specific key is not accessible to applications executing on the computing device.