System and method for recovery key management
A system and method for managing the recovery key of a computer system is disclosed. The computer system includes a security layer, and the recovery key is stored locally to a memory location on the computer system, including, as examples, flash memory on the motherboard of the computer system or a USB port on the computer system. In operation, when it becomes necessary for the computer system to authenticate the recovery key, the recovery key may be retrieved from the local memory. The retrieval and storage of the recovery key may be managed by a remote administrator. The recovery key may be stored in a hidden partition in the storage location, and the recovery key may be cryptographically wrapped to add an additional layer of security.
1. A method for providing security to the configuration of an information handling system, comprising:
providing a security layer,
monitoring a hardware configuration of the information handling system by the security layer, wherein the security layer includes a device within the information handling system that authenticates a key;
storing the key to a storage location local to the information handling system;
determining, by a BIOS, if a configuration change to the information handling system has occurred by comparing a first hash code to a second hash code, wherein the first hash code represents a previous hardware or software configuration of the information handling system and the second hash code represents a current hardware or software configuration of the information handling system;
setting a flag in the BIOS indicative of the configuration change;
requesting, by the security layer, a new key based, at least in part, on the flag; and
booting the information handling system based, at least in part, on an authentication of the new key.
2. The method for providing security to the configuration of an information handling system of claim 1 , wherein the security layer is configured according to the Trusted Platform Module specification.
3. The method for providing security to the configuration of an information handling system of claim 1 , wherein the storage location is directly coupled to the motherboard of the information handling system.
4. The method for providing security to the configuration of an information handling system of claim 3 , wherein the storage location is flash memory.
5. The method for providing security to the configuration of an information handling system of claim 1 , wherein the storage location is coupled to the information handling system through a USB port.
6. The method for providing security to the configuration of an information handling system of claim 5 , wherein the USB port is external to the computer system.
7. The method for providing security to the configuration of an information handling system of claim 5 , wherein the USB port is internal to the computer system.
8. The method for providing security to the configuration of an information handling system of claim 1 , wherein the step of storing the key to the storage location comprises the step of storing the key to a designated partition on the storage location.
9. The method for providing security to the configuration of an information handling system of claim 8 , further comprising the step of:
hiding the designated partition following the step of storing the key to the designated partition.
10. The method for providing security to the configuration of an information handling system of claim 1 , wherein the step of storing the key to the storage location comprises the step of cryptographically wrapping the key prior to storage of the key to the storage location.