Secure credential unlock using trusted execution environments
Computing devices utilizing trusted execution environments as virtual smart cards are designed to support expected credential recovery operations when a user credential, e.g., personal identification number (PIN), password, etc. has been forgotten or is unknown. A computing device generates a cryptographic key that is protected with a PIN unlock key (PUK) provided by an administrative entity. If the user PIN cannot be input to the computing device the PUK can be input to unlock the locked cryptographic key and thereby provide access to protected data. A computing device can also, or alternatively, generate a group of challenges and formulate responses thereto. The formulated responses are each used to secure a computing device cryptographic key. If the user PIN cannot be input to the computing device an entity may request a challenge. The computing device issues a challenge from the set of generated challenges. Upon receiving a valid response back, the computing device can unlock the secured computing device cryptographic key associated with the issued challenge and subsequently provide access to protected data.
1. A method performed on a computing device that includes a trusted platform module (“TPM”), the method comprising:
generating, by the computing device, an authentropy;
generating, by the TPM, a virtual smart card key;
locking, by the TPM, the virtual smart card key;
encrypting, by the TPM, the authentropy with the virtual smart card key;
storing, by the TPM, the encrypted authentropy and the locked virtual smart card key in the TPM; and
protecting a user key based on the authentropy.
2. The method of claim 1 where the locking is based on a personal identification number (“PIN”) of a user.
3. The method of claim 1 where the generating the authentropy is performed by the computing device or by a user.
4. The method of claim 1 where the virtual smart card key is configured for use in accessing to the authentropy.
5. The method of claim 2 further comprising removing, subsequent to the locking, the PIN from the computing device.
6. The method of claim 1 further comprising receiving a PIN unlock key (“PUK”).
7. The method of claim 6 further comprising:
storing, by the TPM in the TPM, the authentropy encrypted with an unblock key; and
storing, by the TPM in the TPM, the unblock key locked with the PUK.
8. A system comprising a computing device and program code that are together configured for performing actions, the computing device comprising a trusted platform module (“TPM”), the actions comprising:
generating, by the computing device, an authentropy;
generating, by the TPM, a virtual smart card key;
locking, by the TPM, the virtual smart card key;
encrypting, by the TPM, the authentropy with the virtual smart card key;
storing, by the TPM, the encrypted authentropy and the locked virtual smart card key in the TPM; and
protecting a user key based on the authentropy.
9. The system of claim 8 where the locking is based on a personal identification number (“PIN”) of a user.
10. The system of claim 8 where the generating the authentropy is performed by the computing device or by a user.
11. The system of claim 8 where the virtual smart card key is configured for use in accessing to the authentropy.
12. The system of claim 9 , the actions further comprising removing, subsequent to the locking, the PIN from the computing device.
13. The system of claim 8 , the actions further comprising receiving a PIN unlock key (“PUK”).
14. The system of claim 13 , the actions further comprising:
storing, by the TPM in the TPM, the authentropy encrypted with an unblock key; and
storing, by the TPM in the TPM, the unblock key locked with the PUK.
15. A system comprising a computing device and program code that are together configured for performing actions, the computing device comprising a trusted platform module (“TPM”), the actions comprising:
generating, by the computing device, an authentropy;
generating, by the TPM, a virtual smart card key;
locking, by the TPM, the virtual smart card key;
encrypting, by the TPM, the authentropy with the virtual smart card key;
storing, by the TPM, the encrypted authentropy and the locked virtual smart card key in the TPM; and
protecting a user key based on the authentropy.
16. The system of claim 15 where the locking is based on a personal identification number (“PIN”) of a user.
17. The system of claim 15 where the generating the authentropy is performed by the computing device or by a user.
18. The system of claim 15 where the virtual smart card key is configured for use in accessing to the authentropy.
19. The system of claim 16 , the actions further comprising removing, subsequent to the locking, the PIN from the computing device.
20. The system of claim 15 , the actions further comprising:
receiving a PIN unlock key (“PUK”);
storing, by the TPM in the TPM, the authentropy encrypted with an unblock key; and
storing, by the TPM in the TPM, the unblock key locked with the PUK.