# US 9,520,998 B2 · System and method for recovery key management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,520,998 B2
- Document ID: US9520998B2
- Status: Granted
- Kind: B2
- Application number: 14/528,758
- Filed: 2014-10-30
- Published: 2015-02-26
- Granted: 2016-12-13
- Earliest claimed: 2009-04-16
- Assignees: Dell Products L.P.
- Applicants: Dell Products L.P.
- Inventors: Viswanathan Balakrishnan; Santosh Bhadri; Mukund P. Khatri; Kevin T. Marks; Narayanan Subramaniam; Venkatesan Balakrishnan
- Web page: https://patentgrep.com/patent/US9520998B2

## CPC

- H04L 9/0816: {Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use}
- G06F 11/1402: {Saving, restoring, recovering or retrying}
- G06F 21/575: {Secure boot}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3236: {using cryptographic hash functions}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system and method for managing the recovery key of a computer system is disclosed. The computer system includes a security layer, and the recovery key is stored locally to a memory location on the computer system, including, as examples, flash memory on the motherboard of the computer system or a USB port on the computer system. In operation, when it becomes necessary for the computer system to authenticate the recovery key, the recovery key may be retrieved from the local memory. The retrieval and storage of the recovery key may be managed by a remote administrator. The recovery key may be stored in a hidden partition in the storage location, and the recovery key may be cryptographically wrapped to add an additional layer of security.

## Claims

### Claim 1

A method for providing security to the configuration of an information handling system, comprising:
providing a security layer,
monitoring a hardware configuration of the information handling system by the security layer, wherein the security layer includes a device within the information handling system that authenticates a key;
storing the key to a storage location local to the information handling system;
determining, by a BIOS, if a configuration change to the information handling system has occurred by comparing a first hash code to a second hash code, wherein the first hash code represents a previous hardware or software configuration of the information handling system and the second hash code represents a current hardware or software configuration of the information handling system;
setting a flag in the BIOS indicative of the configuration change;
requesting, by the security layer, a new key based, at least in part, on the flag; and
booting the information handling system based, at least in part, on an authentication of the new key.

### Claim 2 (depends on 1)

The method for providing security to the configuration of an information handling system of claim 1, wherein the security layer is configured according to the Trusted Platform Module specification.

### Claim 3 (depends on 1)

The method for providing security to the configuration of an information handling system of claim 1, wherein the storage location is directly coupled to the motherboard of the information handling system.

### Claim 4 (depends on 3)

The method for providing security to the configuration of an information handling system of claim 3, wherein the storage location is flash memory.

### Claim 5 (depends on 1)

The method for providing security to the configuration of an information handling system of claim 1, wherein the storage location is coupled to the information handling system through a USB port.

### Claim 6 (depends on 5)

The method for providing security to the configuration of an information handling system of claim 5, wherein the USB port is external to the computer system.

### Claim 7 (depends on 5)

The method for providing security to the configuration of an information handling system of claim 5, wherein the USB port is internal to the computer system.

### Claim 8 (depends on 1)

The method for providing security to the configuration of an information handling system of claim 1, wherein the step of storing the key to the storage location comprises the step of storing the key to a designated partition on the storage location.

### Claim 9 (depends on 8)

The method for providing security to the configuration of an information handling system of claim 8, further comprising the step of:
hiding the designated partition following the step of storing the key to the designated partition.

### Claim 10 (depends on 1)

The method for providing security to the configuration of an information handling system of claim 1, wherein the step of storing the key to the storage location comprises the step of cryptographically wrapping the key prior to storage of the key to the storage location.