System and method for recovery key management
A system and method for managing the recovery key of a computer system is disclosed. The computer system includes a security layer, and the recovery key is stored locally to a memory location on the computer system, including, as examples, flash memory on the motherboard of the computer system or a USB port on the computer system. In operation, when it becomes necessary for the computer system to authenticate the recovery key, the recovery key may be retrieved from the local memory. The retrieval and storage of the recovery key may be managed by a remote administrator. The recovery key may be stored in a hidden partition in the storage location, and the recovery key may be cryptographically wrapped to add an additional layer of security.
1. A method for managing a security layer of a computer system, wherein the computer system includes a security layer that requires authentication of a key, comprising:
identifying a change to a configuration of the computer system;
determining if a configuration change to the computer system has occurred since the last boot based on a hash analysis, wherein the hash analysis compares a first hash code representing a previous hardware or software configuration of the computer system and a second hash code representing a current hardware or software configuration of the computer system;
requesting a new key for authentication of the computer system based on the determination of the configuration change; and
providing the new key through a storage location associated with the computer system, wherein providing the new key comprises receiving a memory mapping command to hide a partition of the storage location comprising the new key.
2. The method for managing the security layer of the computer system of claim 1 , wherein the partition is designated for storage of the new key.
3. The method for managing the security layer of the computer system of claim 1 , wherein the step of providing the new key comprises the step of providing the new key through a remote administrator.
4. The method for managing the security layer of the computer system of claim 1 , wherein the step of providing the new key comprises the step of cryptographically unwrapping the new key before providing the new key for authentication.
5. The method for managing the security layer of the computer system of claim 1 , wherein the storage location is flash memory internal to the computer system.
6. The method for managing the security layer of the computer system of claim 1 , further comprising:
setting a flag indicative of the determination of the configuration change; and
wherein the new key is requested based, at least in part, on the flag.
7. The method for managing the security layer of the computer system of claim 1 , wherein the flag is a BIOS flag.
8. The method for managing the security layer of the computer system of claim 1 , further comprising authenticating the new key.
9. A system for managing a security layer of a computer system, comprising:
at least one processor; and
a non-transitory memory coupled to the at least one processor, wherein the non-transitory memory includes one or more software components that, when executed by the at least one processor, cause the at least one processor to:
identify a change to a configuration of the computer system;
determine if a configuration change to the computer system has occurred since the last boot based on a hash analysis, wherein the hash analysis compares a first hash code representing a previous hardware or software configuration of the computer system and a second hash code representing a current hardware or software configuration of the computer system;
request a new key for authentication of the computer system based on the determination of the configuration change; and
provide the new key through a storage location associated with the computer system, wherein providing the new key comprises receiving a memory mapping command to hide a partition of the storage location comprising the new key.
10. The system for managing a security layer of a computer system of claim 9 , wherein the partition of the storage location is designated for storage of the new key.
11. The system for managing a security layer of a computer system of claim 9 , wherein the step of providing the new key comprises the step of providing the new key through a remote administrator.
12. The system for managing a security layer of a computer system of claim 9 , wherein the step of providing the new key comprises the step of cryptographically unwrapping the new key before providing the new key for authentication.
13. The system for managing a security layer of a computer system of claim 9 , wherein the storage location is flash memory internal to the computer system.
14. The system for managing a security layer of a computer system of claim 9 , wherein the one or more software components further cause the at least one processor to:
set a flag indicative of the determination of the configuration change; and
wherein the new key is requested based, at least in part, on the flag.
15. The system for managing a security layer of a computer system of claim 9 , further comprising authenticating the new key.
16. A non-transitory computer readable medium storing one or more software components that, when executed, cause a processor to:
identify a change to a configuration of the computer system;
determine if a configuration change to the computer system has occurred since the last boot based on a hash analysis, wherein the hash analysis compares a first hash code representing a previous hardware or software configuration of the computer system and a second hash code representing a current hardware or software configuration of the computer system; and
request a new key for authentication of the computer system based on the determination of the configuration change; and
provide the new key through a storage location associated with the computer system, wherein providing the new key comprises receiving a memory mapping command to hide a partition of the storage location comprising the new key.
17. The non-transitory computer-readable medium of claim 16 , the partition of the storage location is designated for storage of the new key.
18. The non-transitory computer-readable medium of claim 16 , wherein the step of providing the new key comprises the step of providing the new key through a remote administrator.
19. The non-transitory computer-readable medium of claim 16 , wherein the step of providing the new key comprises the step of cryptographically unwrapping the new key before providing the new key for authentication.
20. The non-transitory computer-readable medium of claim 16 , wherein the one or more software components, when executed, further cause the processor to:
set a flag indicative of the determination of the configuration change; and
wherein the new key is requested based, at least in part, on the flag.