System and method for remote reset of password and encryption key
View Patent ↗Data is secured on a device in communication with a remote location using a password and content protection key. The device stores data encrypted using a content protection key, which itself may be stored in encrypted form using the password and a key encryption key. The remote location receives a public key from the device. The remote location uses the public key and a stored private key to generate a further public key. The further public key is sent to the device. The device uses the further public key to generate a key encryption key, which is then used to decrypt the encrypted content protection key. A new content encryption key may then be created.
1. A device, comprising:
at least one memory component for storing data, at least one password, and keys; and
at least one processor configured to:
enable receipt of a public key B=bP from a remote location, wherein P is an elliptic curve point and b is a private key stored at the remote location;
compute and store a public key D=dP in the at least one memory component, wherein d is a random value generated at the device for computing the public key D and then deleted once the public key D is computed;
encrypt a content protection key K for storage by encrypting the content protection key K using a key encryption key L=dB, and storing the content protection key K thus encrypted in the at least one memory component;
delete any unencrypted copies of the content protection key K;
recover the content protection key K without using the password by:
generating a random value r;
computing a public key D′=rD;
transmitting the public key D′ to the remote location;
receiving from the remote location a public key L′=bD′;
computing r −1 L′ to derive the key encryption key L, wherein r −1 is an inverse value of r; and
decrypting, using the key encryption key L thus derived, the content protection key K previously encrypted using L;
decrypt content previously encrypted using the content protection key K using the content protection key K thus recovered;
encrypt the decrypted content using a new content protection key K′; and
protect the new content protection key K′ by encryption.
2. The device of claim 1 , wherein the at least one processor is further configured to encrypt and decrypt data with the content protection key K.
3. The device of claim 1 , wherein the at least one processor is further configured to use the content protection key K to generate one or more further content protection keys for encrypting and decrypting data.
4. The device of claim 1 , wherein the at least one processor is further configured to encrypt the content protection key K using a password, and store the content protection key K thus encrypted in the at least one memory component.
5. The device of claim 4 , wherein the at least one processor is further configured to:
enable receipt of the password as input;
in response to receipt of the password, decrypt the content protection key K encrypted using the password; and
decrypt content previously encrypted using the content protection key K thus decrypted.
6. The device of claim 1 , wherein the at least one processor is further configured to protect the new content protection key K′ by encryption using the key encryption key L.
7. The device of claim 1 , wherein the at least one processor is further configured to protect the new content protection key K′ by encryption using a new key encryption key M.
8. The device of claim 1 , wherein the at least one processor is further configured to protect the new content protection key K′ by encryption using a new password.
9. The device of claim 8 , wherein the at least one processor is further configured to protect the new content protection key K′ by encryption using a new key encryption key M.
10. The device of claim 1 , wherein the at least one memory component comprises:
volatile memory for storing unencrypted data, passwords, and keys; and
non-volatile memory for storing encrypted data and encrypted keys.
11. The device of claim 1 , wherein the device is a mobile communication device.
12. The device of claim 1 , wherein the device is a personal computer.
13. A device, comprising:
at least one memory component for storing data, at least one password, and keys;
at least one processor configured to:
enable receipt of a public key B=bP from a remote location, wherein P is an elliptic curve point and b is a private key stored at the remote location;
compute and store a public key D=dP in the at least one memory component, wherein d is a random value generated at the device for computing the public key D and then deleted once the public key D is computed;
encrypt a content protection key K for storage by:
encrypting the content protection key K using a password, and storing the content protection key K thus encrypted in the at least one memory component; and
encrypting the password using a key encryption key L=dB, and storing the password thus encrypted in the at least one memory component;
delete any unencrypted copies of the content protection key K;
recover the password from the encrypted password stored in the at least one memory component by:
generating a random value r;
computing a public key D′=rD;
transmitting the public key D′ to the remote location;
receiving from the remote location a public key L′=bD′;
computing r −1 L′ to derive the key encryption key L, wherein r −1 is an inverse value of r; and
decrypting, using the key encryption key L thus derived, the password previously encrypted using L;
decrypt the encrypted content protection key K using the password thus recovered;
decrypt content previously encrypted using the content protection key K using the content protection key K thus decrypted;
encrypt the decrypted content using a new content protection key K′; and
protect the new content protection key K′ by encryption.
14. The device of claim 13 , wherein the at least one processor is further configured to encrypt and decrypt data with the content protection key K.
15. The device of claim 13 , wherein the at least one processor is further configured to use the content protection key K to generate one or more further content protection keys for encrypting and decrypting data.
16. The device of claim 13 , wherein the at least one processor is further configured to protect the new content protection key K′ by encryption using a new password.
17. The device of claim 13 , wherein the at least one processor is further configured to encrypt the new password using a new key encryption key M.
18. The device of claim 13 , wherein the at least one memory component comprises:
volatile memory for storing unencrypted data, passwords, and keys; and
non-volatile memory for storing encrypted data and encrypted keys.
19. The device of claim 13 , wherein the device is a mobile communication device.
20. The device of claim 13 , wherein the device is a personal computer.