Secure Escrow Service

• US 20140093084A1
• Filed: 02/14/2013
• Published: 04/03/2014
• Est. Priority Date: 09/30/2012
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: De Atley, Dallas B., Hauck, Jerrold V., Adler, Mitchell D.
• Granted Patent: US 9,106,411 B2
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method of restoring confidential information items of a first device to a second device by using a set of servers. The method generates a public and private key pair and ties the private key to the hash of executable code of the servers at the time of generating the public and private keys. The method receives the encrypted confidential information items in a secure object which is encrypted with a user-specific key and the public key. The method only provides the confidential information to the second device when the second device provides the same user-specific key as the key that encrypts the secure object and the hash of the executable code of the servers at the time of accessing the private key to decrypt the secure object matches the hash of the executable code running on the servers at the time of generating the private key.

Claims

1. A method of restoring a set of confidential information items of a first device to a second device using a set of servers, the method comprising:

generating a public and private key pair;

storing the private key and a corresponding access control on the set of servers, the access control allowing access to the private key only to executable code having a same hash value as a hash value of executable code running on the set of server at a time of generating the public and private key pair;

receiving a request to restore the set of confidential information items to the second device, the request comprising a first secure object, the first secure object comprising a second secure object encrypted with said private key, the second object comprising a recovery key encrypted with a first user-specific key, the recovery key encrypting the confidential information requested by the second device, the first user-specific key generated by the first device based on answers to a set of user-specific questions;

decrypting the first secure object using the private key to access the second secure object, the private key accessible only when a hash value of the executable code running on the set of servers at a time of accessing the private key matches the first hash of the executable code running on the set of servers at the time of generating the private key;

receiving a second user-specific key from the second device, the second user-specific key generated based on a same set of user-specific questions used to generate the first user-specific key by the first device;

generating a progressively increasing timeout each time the second user-specific key received from the second device does not match the first user-specific key;

repeating said receiving the second user-specific key and said generating the progressively increasing timeout as long as the second user-specific key received from the second device does not match the first user-specific key;

decrypting the second secure object with the second user-specific key to get the recovery key when the second user-specific key received from the second device matches the first user-specific key; and

sending the recovery key to the second device after the second secure object is decrypted.

2. The method of claim 1, wherein the set of servers is a first set of servers in a plurality of set of servers, the method further comprising:

assigning each device in a plurality of devices to one set of servers in the plurality of set of servers, the plurality of devices comprising the first and second devices;

ignoring a request by the second device to restore a set of confidential information items of a device in the plurality of devices when the request is received by a set of servers other than the first set of servers; and

processing the request by the second device to restore a set of confidential information items of a device in the plurality of devices when the request is received by the first set of servers.

3. The method of claim 1 further comprising:

generating a common key recognizable by all servers in the set of servers;

associating an access control to the common key, the access control allowing access to the common key only to executable code having a same hash value as a hash value of the executable code running on the set of servers at the time of generating the common key; and

ignoring a request to restore a set of confidential information items to a device when a hash value of the executable code running on the set of servers at the time of receiving the request does not match the hash value of the executable code running on the set of servers at the time of generating the common key.

4. The method of claim 1 further comprising:

setting a maximum number for the servers in the set of servers; and

ignoring a request to restore a set of confidential information items to a device when a number of HSMs in the set of servers exceeds the maximum number.

5. The method of claim 1, wherein the requested set of confidential information comprises a set of class keys of encrypting a set of passwords.

6. The method of claim 1, wherein the requested set of confidential information comprises a set of passwords, each password in the set of passwords is associated with a class key, wherein the class keys are encrypted by the recovery key.

7. The method of claim 1, wherein the recovery key is a device dependent key that is generated by the first device.

8. The method of claim 1, wherein the first secure object is stored in a network storage, wherein the request to restore the set of confidential information items to the second device is received from the network after the network receives a request from the second device to restore the set of confidential information item of the first device to the second device.

9. The method of claim 1, wherein (i) encryption of the recovery key by the first user-specific key to create a second secure object and (ii) encryption of the second secure object by the public key of the set of servers to create the first secure object are done by the first device.

10. The method of claim 9, wherein the first secure object is sent by the first device to a network for storage, wherein the network sends the request to restore the set of confidential information items to the second device and the first secure object to the set of servers after the network receives the request from the second user device.

11. A method of ensuring integrity of a set of secure servers that provide confidential information items to a plurality of devices, the method comprising:

generating a common key recognizable by all servers in the set of servers;

associating an access control to the common key, the access control allowing access to the common key only to executable code having a same hash value as a hash value of the executable code running on the set of servers at the time of generating the common key; and

ignoring a request to send a set of confidential information items to a device when a hash value of the executable code running on the set of servers at the time of receiving the request does not match the hash value of the executable code running on the set of servers at the time of generating the common key.

12. The method of claim 11 further comprising:

setting a maximum number for the servers in the set of servers; and

ignoring a request to restore a set of confidential information items to a device when a number of servers in the set of servers exceeds the maximum number.

13. The method of claim 12 further comprising ignoring a request to restore a set of confidential information items to a device when the number of servers in the set of servers is one.

14. A non-transitory computer readable medium storing a program for restoring a set of confidential information items of a first device to a second device, the program executable by at least one processing unit in each server in a set of servers, the program comprising sets of instructions for:

generating a public and private key pair;

storing the private key and a corresponding access control on the set of servers, the access control allowing access to the private key only to executable code having a same hash value as a hash value of executable code running on the set of server at a time of generating the public and private key pair;

receiving a request to restore the set of confidential information items to the second device, the request comprising a first secure object, the first secure object comprising a second secure object encrypted with said private key, the second object comprising a recovery key encrypted with a first user-specific key, the recovery key encrypting the confidential information requested by the second device, the first user-specific key generated by the first device based on answers to a set of user-specific questions;

decrypting the first secure object using the private key to access the second secure object, the private key accessible only when a hash value of the executable code running on the set of servers at a time of accessing the private key matches the first hash of the executable code running on the set of servers at the time of generating the private key;

receiving a second user-specific key from the second device, the second user-specific key generated based on a same set of user-specific questions used to generate the first user-specific key by the first device;

generating a progressively increasing timeout each time the second user-specific key received from the second device does not match the first user-specific key;

repeating said receiving the second user-specific key and said generating the progressively increasing timeout as long as the second user-specific key received from the second device does not match the first user-specific key;

decrypting the second secure object with the second user-specific key to get the recovery key when the second user-specific key received from the second device matches the first user-specific key; and

sending the recovery key to the second device after the second secure object is decrypted.

15. The non-transitory computer readable medium of claim 14, wherein the set of servers is a first set of servers in a plurality of set of servers, the program further comprising sets of instructions for:

assigning each device in a plurality of devices to one set of servers in the plurality of set of servers, the plurality of devices comprising the first and second devices;

ignoring a request by the second device to restore a set of confidential information items of a device in the plurality of devices when the request is received by a set of servers other than the first set of servers; and

processing the request by the second device to restore a set of confidential information items of a device in the plurality of devices when the request is received by the first set of servers.

16. The non-transitory computer readable medium of claim 14, wherein the program further comprises sets of instructions for:

generating a common key recognizable by all servers in the set of servers;

associating an access control to the common key, the access control allowing access to the common key only to executable code having a same hash value as a hash value of the executable code running on the set of servers at the time of generating the common key; and

ignoring a request to restore a set of confidential information items to a device when a hash value of the executable code running on the set of servers at the time of receiving the request does not match the hash value of the executable code running on the set of servers at the time of generating the common key.

17. The non-transitory computer readable medium of claim 14, wherein the program further comprises sets of instructions for:

setting a maximum number for the servers in the set of servers; and

ignoring a request to restore a set of confidential information items to a device when a number of servers in the set of servers exceeds the maximum number.

18. The non-transitory computer readable medium of claim 14, wherein the requested set of confidential information comprises a set of class keys of encrypting a set of passwords.

19. The non-transitory computer readable medium of claim 18, wherein the requested set of confidential information comprises a set of passwords, each password in the set of passwords is associated with a class key, wherein the class keys are encrypted by the recovery key.

20. The non-transitory computer readable medium of claim 14, wherein the recovery key is a device dependent key that is generated by the first device.

21. The non-transitory computer readable medium of claim 14, wherein the first secure object is stored in a network storage, wherein the request to restore the set of confidential information items to the second device is received from the network after the network receives a request from the second device to restore the set of confidential information item of the first device to the second device.

22. The non-transitory computer readable medium of claim 14, wherein (i) encryption of the recovery key by the first user-specific key to create a second secure object and (ii) encryption of the second secure object by the public key of the set of servers to create the first secure object are done by the first device.

23. The non-transitory computer readable medium of claim 22, wherein the first secure object is sent by the first device to a network for storage, wherein the network sends the request to restore the set of confidential information items to the second device and the first secure object to the set of servers after the network receives the request from the second user device.

24. A non-transitory computer readable medium storing a program for ensuring integrity of a set of secure servers that provide confidential information items to a plurality of devices, the program executable by at least one processing unit of each server in the set of servers, the program comprising sets of instructions for:

generating a common key recognizable by all servers in the set of servers;

associating an access control to the common key, the access control allowing access to the common key only to executable code having a same hash value as a hash value of the executable code running on the set of servers at the time of generating the common key; and

ignoring a request to send a set of confidential information items to a device when a hash value of the executable code running on the set of servers at the time of receiving the request does not match the hash value of the executable code running on the set of servers at the time of generating the common key.

25. The non-transitory computer readable medium of claim 24, the program further comprising sets of instructions for:

setting a maximum number for the servers in the set of servers; and

ignoring a request to restore a set of confidential information items to a device when a number of servers in the set of servers exceeds the maximum number.

26. The non-transitory computer readable medium of claim 25, the program further comprising a set of instructions for ignoring a request to restore a set of confidential information items to a device when the number of servers in the set of servers is one.