Secure credential unlock using trusted execution environments

US9015490B2 · kind B2 · utility

Assignee

• MICROSOFT TECHNOLOGY LICENSING, LLC · US

Inventors

• Stefan Thom · Snohomish, US
• Robert Karl Spiger · Seattle, US
• Magnus Bo Gustaf Nyström · Bedford, US
• Himanshu Soni · Bothell, US
• Marc R. Barbour · Woodinville, US
• Nick Voicu · Bellevue, US
• Xintong Zhou · Bellevue, US
• Kirk Shoop · Seattle, US

Key dates

• Filing date: Dec 12, 2013
• Grant date: Apr 21, 2015
• Expiry date: Dec 12, 2033

Classification

• Technology area (CPC H): Electricity
• CPC primary: H04L2209/127
• WIPO field: Computer technology
• WIPO sector: Electrical engineering

Abstract

Computing devices utilizing trusted execution environments as virtual smart cards are designed to support expected credential recovery operations when a user credential, e.g., personal identification number (PIN), password, etc. has been forgotten or is unknown. A computing device generates a cryptographic key that is protected with a PIN unlock key (PUK) provided by an administrative entity. If the user PIN cannot be input to the computing device the PUK can be input to unlock the locked cryptographic key and thereby provide access to protected data. A computing device can also, or alternatively, generate a group of challenges and formulate responses thereto. The formulated responses are each used to secure a computing device cryptographic key. If the user PIN cannot be input to the computing device an entity may request a challenge. The computing device issues a challenge from the set of generated challenges. Upon receiving a valid response back, the computing device can unlock the secured computing device cryptographic key associated with the issued challenge and subsequently provide access to protected data.