Device theft protection associating a device identifier and a user identifier

• US 9,565,169 B2
• Filed: 06/08/2015
• Issued: 02/07/2017
• Est. Priority Date: 03/30/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Susan, Mihai Irinel, Andreiu, Bogdan, Shell, Scott R., Bragg, Scott Michael, Chen, Ling Tony
• Primary Examiner(s): Okeke, Izunna
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US14/733,359
• Publication Number:
  US 20160294790A1
• Time in Patent Office: 610 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 9/4405 Initialisation of multiprocessor systems
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

When theft protection of a computing device is initiated, credentials of the user are provided to one or more services that verify the credentials and generate a recovery key. A data value is generated based on the recovery key and an identifier of the computing device (e.g., by applying a cryptographic hash function to the recovery key and the computing device identifier), and the data value is provided to the computing device, which stores the data value at the computing device. When a user is prompted to prove his or her ownership of the device, the owner can prove his or her ownership of the device in different manners by accessing the one or more services via a network (e.g., the Internet), or by providing the recovery key (e.g., obtained using another computing device) to the computing device.

Claims

1. A method implemented in a computing device, the method comprising:

determining that theft protection is to be enabled on the computing device;

sending, to an identity service over a network, user credentials of a user of the computing device;

receiving, from the identity service, a ticket indicating that the user credentials have been verified by the identity service;

sending, to a key service over the network, the ticket;

receiving, from the key service, a data value having been generated by the key service by applying a cryptographic hash function to a combination of a recovery key for the computing device and a device identifier that identifies the computing device;

saving the data value as an authenticated variable on the computing device by writing the data value to an authenticated variable storage system of the computing device;

receiving user input that is the recovery key of the computing device;

writing the recovery key to the authenticated variable storage system as an unauthenticated variable;

generating an additional data value based on the user input as well as the device identifier that identifies the computing device;

determining whether the data value and the additional data value are the same value; and

changing the computing device to an unprotected state in response to the data value and the additional data value being the same value.

2. The method as recited in claim 1, the recovery key having been generated by the key service.

3. The method as recited in claim 1, further comprising preventing rollback of an operating system of the computing device to a previous version of the operating system that does not support the theft protection.

4. The method as recited in claim 3, the preventing including:

checking whether an operating system version identifier list included in the authenticated variable storage system of the computing device includes an identifier of an operating system being booted on the computing device; and

preventing the operating system from booting on the computing device if the operating system version identifier list includes the identifier of the operating system being booted on the computing device.

5. The method as recited in claim 1, further comprising:

determining that ownership of the computing device is to be verified;

obtaining, in response to access to the key service over the network being available, an indication from the key service whether the user is the owner of the computing device, the indication being based on user credentials input to the computing device;

allowing the user to access the computing device in response to the user being determined to be the owner of the computing device; and

denying the user access to the computing device in response to the user being determined to not be the owner of the computing device.

6. The method as recited in claim 1, the authenticated variable storage system implementing the unified extensible firmware interface specification.

7. The method as recited in claim 1, the combination of the recovery key and the device identifier comprising a concatenation of the recovery key and the device identifier.

8. A computing device comprising:

one or more hardware processors; and

computer-readable storage medium having stored thereon multiple instructions that, responsive to execution by the one or more processors, cause the one or more processors to perform acts including;

determining that theft protection is to be enabled on the computing device;

sending, to an identity service over a network, user credentials of a user of the computing device;

receiving, from the identity service, a data structure indicating that the user credentials have been verified by the identity service;

sending, to a key service over the network, the data structure;

receiving, from the key service, a first data value having been generated by the key service by applying a cryptographic hash function to a combination of a recovery key for the computing device and a device identifier that identifies the computing device;

saving the first data value as an authenticated variable on the computing device by writing the first data value to an authenticated variable storage system of the computing device;

receiving user input that is the recovery key of the computing device;

writing the recovery key to the authenticated variable storage system as an unauthenticated variable;

generating a second data value based on the user input as well as the device identifier that identifies the computing device;

determining whether the first data value and the second data value are the same value; and

changing the computing device to an unprotected state in response to the first data value and the second data value being the same value.

9. The computing device as recited in claim 8, the recovery key having been generated by the key service.

10. The computing device as recited in claim 8, the acts further comprising preventing rollback of an operating system of the computing device to a previous version of the operating system that does not support the theft protection.

11. The computing device as recited in claim 10, the preventing including:

checking whether an operating system version identifier list included in the authenticated variable storage system of the computing device includes an identifier of an operating system being booted on the computing device; and

preventing the operating system from booting on the computing device if the operating system version identifier list includes the identifier of the operating system being booted on the computing device.

12. The computing device as recited in claim 8, the acts further comprising:

determining that ownership of the computing device is to be verified;

obtaining, in response to access to the key service over the network being available, an indication from the key service whether the user is the owner of the computing device, the indication being based on user credentials input to the computing device;

allowing the user to access the computing device in response to the user being determined to be the owner of the computing device; and

denying the user access to the computing device in response to the user being determined to not be the owner of the computing device.

13. The computing device as recited in claim 8, the authenticated variable storage system implementing the unified extensible firmware interface specification.

14. A device comprising:

one or more hardware processors;

an authenticated variable storage system; and

computer-readable storage medium having stored thereon multiple instructions that, responsive to execution by the one or more processors, cause the one or more processors to;

determine that theft protection is to be enabled on the device;

send, to an identity service over a network, user credentials of a user of the device;

receive, from the identity service, a ticket indicating that the user credentials have been verified by the identity service;

send, to a key service over the network, the ticket;

receive, from the key service, a data value having been generated by the key service by applying a cryptographic hash function to a combination of a recovery key for the device and a device identifier that identifies the device;

save the data value as an authenticated variable on the device by writing the data value to the authenticated variable storage system;

receive user input that is the recovery key of the device;

write the recovery key to the authenticated variable storage system as an unauthenticated variable;

generate an additional data value based on the user input as well as the device identifier that identifies the device;

determine whether the data value and the additional data value are the same value; and

change the device to an unprotected state in response to the data value and the additional data value being the same value.

15. The device as recited in claim 14, the recovery key having been generated by the key service.

16. The device as recited in claim 14, the instructions further causing the one or more processors to prevent rollback of an operating system of the device to a previous version of the operating system that does not support the theft protection.

17. The device as recited in claim 16, wherein to prevent rollback includes to:

check whether an operating system version identifier list of the device includes an identifier of an operating system being booted on the device; and

prevent the operating system from booting on the device if the operating system version identifier list includes the identifier of the operating system being booted on the device.

18. The device as recited in claim 17, the operating system version identifier list being included in the authenticated variable storage system.

19. The device as recited in claim 14, the instructions further causing the one or more processors to:

determine that ownership of the computing device is to be verified;

obtain, in response to access to the key service over the network being available, an indication from the key service whether the user is the owner of the computing device, the indication being based on user credentials input to the computing device;

allow the user to access the computing device in response to the user being determined to be the owner of the computing device; and

deny the user access to the computing device in response to the user being determined to not be the owner of the computing device.

20. The device as recited in claim 14, the authenticated variable storage system implementing the unified extensible firmware interface specification.