Multi-ring encryption approach to securing a payload using hardware modules
View Patent ↗Disclosed are systems and methods of employing a multi-ring encryption approach to secure a data payload. Each ring of encryption may be encrypted from a key derived from a password, such that each subsequent ring of protection is protected by a key derived from the key used to encrypt the previous ring of protection. Further, hardware-based encryption may be employed in one or more of the rings of protection to bind the encrypted payload to the hardware. Such systems and methods may be used to reduce the ability to parallelize an attack on encrypted data while also permitting password-related data to be synchronized across a network.
1. A method of synchronizing a password to decrypt an encrypted payload, comprising:
receiving a second encryption key at a computer system, wherein the second encryption key is a derivative of a first encryption key;
receiving a first encrypted payload at the computer system, wherein the first encrypted payload was previously encrypted using the first encryption key, wherein the first encryption key is a derivative of a user password, and wherein the first encrypted payload is not able to be decrypted by the computer system without the user password, wherein the first encrypted payload is encrypted by a first processor of the computer system;
encrypting, by a trusted platform module of the computer system, the first encrypted payload using the second encryption key to create a second encrypted payload, wherein the trusted platform module comprises a cryptographic processor distinct from the first processor and secure storage;
receiving the user password at the computer system;
deriving a first decryption key from the user password using a first key derivation function;
deriving a second decryption key from the first encryption key using a second key derivation function;
decrypting the second encrypted payload using the second encryption key to create the first encrypted payload; and
decrypting the first encrypted payload using the first encryption key to create an unencrypted payload.
2. The method of claim 1 , wherein the first encrypted payload and the second encryption key are deleted from the computer system after the second encrypted payload is created.
3. The method of claim 1 , wherein the first encryption key equals the first decryption key and the second encryption key equals the second decryption key.
4. The method of claim 1 , further comprising authorizing a hardware or firmware encryption module using the second encryption key, or a derivative of the second encryption key.
5. The method of claim 4 , wherein the hardware or firmware encryption module additionally uses an internal encryption key or a key loaded from external storage, wherein the key loaded from external storage was previously exported from the hardware or firmware encryption module.
6. The method of claim 1 , wherein the first key derivation function uses a password salt.
7. The method of claim 1 , wherein user password is received at a stage before an operating system kernel begins to load.
8. A system for synchronizing a password to decrypt an encrypted payload, comprising:
a memory;
one or more processing units, communicatively coupled to the memory, wherein the memory stores instructions to configure the one or more processing units to:
receive a second encryption key at a computer system, wherein the second encryption key is a derivative of a first encryption key;
receive a first encrypted payload at the computer system, wherein the first encrypted payload was previously encrypted using the first encryption key, wherein the first encryption key is a derivative of a user password, and wherein the first encrypted payload is not able to be decrypted by the computer system without the user password, wherein the first encrypted payload is encrypted by a first processor of the computer system;
encrypt, by a trusted platform module of the computer system, the first encrypted payload using the second encryption key to create a second encrypted payload, wherein the trusted platform module comprises a cryptographic processor distinct from the first processor and secure storage;
receive the user password at the computer system;
derive a first decryption key from the user password using a first key derivation function;
derive a second decryption key from the first encryption key using a second key derivation function;
decrypt the second encrypted payload using the second encryption key to create the first encrypted payload; and
decrypt the first encrypted payload using the first encryption key to create an unencrypted payload.
9. The system of claim 8 , wherein the first encrypted payload and the second encryption key are deleted from the computer system after the second encrypted payload is created.
10. The system of claim 8 , wherein the first encryption key equals the first decryption key and the second encryption key equals the second decryption key.
11. The system of claim 8 , wherein the instructions further configure the one or more processing units to authorize a hardware or firmware encryption module using the second encryption key, or a derivative of the second encryption key.
12. The system of claim 11 , wherein the hardware or firmware encryption module additionally uses an internal encryption key or a key loaded from external storage, wherein the key loaded from external storage was previously exported from the hardware or firmware encryption module.
13. The system of claim 8 , wherein the first key derivation function uses a password salt.
14. The system of claim 8 , wherein user password is received at a stage before an operating system kernel begins to load.
15. A non-transitory computer readable medium comprising computer executable instructions stored thereon to cause one or more processing units to:
receive a second encryption key at a computer system, wherein the second encryption key is a derivative of a first encryption key;
receive a first encrypted payload at the computer system, wherein the first encrypted payload was previously encrypted using the first encryption key, wherein the first encryption key is a derivative of a user password, and wherein the first encrypted payload is not able to be decrypted by the computer system without the user password, wherein the first encrypted payload is encrypted by a first processor of the computer system;
encrypt, by a trusted platform module of the computer system, the first encrypted payload using the second encryption key to create a second encrypted payload, wherein the trusted platform module comprises a cryptographic processor distinct from the first processor and secure storage;
receive the user password at the computer system;
derive a first decryption key from the user password using a first key derivation function;
derive a second decryption key from the first encryption key using a second key derivation function;
decrypt the second encrypted payload using the second encryption key to create the first encrypted payload; and
decrypt the first encrypted payload using the first encryption key to create an unencrypted payload.
16. The non-transitory computer readable medium of claim 15 , wherein the first encrypted payload and the second encryption key are deleted from the computer system after the second encrypted payload is created.
17. The non-transitory computer readable medium of claim 15 , wherein the first encryption key equals the first decryption key and the second encryption key equals the second decryption key.
18. The non-transitory computer readable medium of claim 15 , further comprising computer executable instructions for causing the one or more processing units to authorize a hardware or firmware encryption module using the second encryption key, or a derivative of the second encryption key.
19. The non-transitory computer readable medium of claim 18 , wherein the hardware or firmware encryption module additionally uses an internal encryption key or a key loaded from external storage, wherein the key loaded from external storage was previously exported from the hardware or firmware encryption module.
20. The non-transitory computer readable medium of claim 15 , wherein the first key derivation function uses a password salt.
21. The non-transitory computer readable medium of claim 15 , wherein user password is received at a stage before an operating system kernel begins to load.