System and method for content protection based on a combination of a user pin and a device specific identifier

A non-transitory computer readable storage medium configured to store instructions that, when executed by a hardware module included in a computing device, cause the hardware module to generate a master key, by carrying out steps that include:

• receiving, from a processor included in the computing device, a request to generate the master key, wherein the request includes a password that is associated with a user of the computing device, and the processor is separate and distinct from the hardware module;
• accessing an identifier that is unique to the computing device, wherein the identifier is stored by the hardware module in a manner that prevents software executing by way of the processor from directly accessing the identifier;
• combining the password and the identifier to produce a combined value;
• receiving an indication of a desired security level for the master key;
• carrying out an iterative function on the combined value to produce the master key, wherein a number of iterations associated with the iterative function is based on the desired security level;
• and
• providing the master key to the processor, wherein the master key is utilized by the processor to encrypt the content.

A computing device configured to generate a master key for encrypting content, the computing device comprising:

• a memory that stores the content;
• a processor, wherein the processor is configured to:
• receive, from a user, a first request to encrypt the content, wherein the first request includes a password associated with the user, and
• issuing, to a hardware module included in the computing device, a second request to generate the master key based on the password and an identifier that is unique to the computing device, wherein the identifier is stored by the hardware module in a manner that prevents software executing by way of the processor from directly accessing the identifier;
• and
• the hardware module, wherein the hardware module is separate and distinct from the processor and is configured to carry out steps that include:
• receiving, from the processor, the second request,
• accessing the identifier stored by the hardware module,
• combining the password and the identifier to produce a combined value;
• receiving an indication of a desired security level for the master key;
• carrying out an iterative function on the combined value to produce the master key, wherein a number of iterations associated with the iterative function is based on the desired security level;
• and
• providing the master key to the processor, wherein the master key is utilized by the processor to encrypt the content.