Providing low risk exceptional access
A method and system for providing unencrypted access to encrypted data that may be stored on a device, sent as a message, or sent as a real-time communications stream. The method may include using public key cryptography to securely enable accessing the encrypted data stored on a device or communicated by a device. For instance, the method may include using a device vendor's public key to securely enable that vendor to enable only authorized parties to themselves decrypt previously-encrypted device storage, messages, or real-time communications streams.
1. A method for providing access to a third party to a locked communication device, comprising:
generating a data access key, wherein the data access key contains encrypted information relating to a data protection key;
storing the data access key within memory associated with the locked communication device;
reformatting the data access key into a first transportable format comprising a barcode;
transporting the data access key to a vendor, wherein the data access key is decrypted with a private key;
receiving the data protection key back from the vendor in a second transportable format comprising a barcode; and
unlocking, by the third party, the locked communication device with the data protection key.
2. The method of claim 1 , wherein the data access key is generated by wrapping a data protection key of the locked communication device.
3. The method of claim 2 , wherein a public key is used to encrypt and wrap the data protection key of the locked communication device to generate the data access key.
4. The method of claim 2 , wherein a unique encryption key is used to wrap the data protection key of the locked communication device to generate an encrypted data protection key.
5. The method of claim 4 , further comprising wrapping the encrypted data protection key using a public key to generate the data access key.
6. The method of claim 1 , wherein the first transportable format further comprises a number string or a text string.
7. The method of claim 1 , wherein the vendor of the locked communication device recovers the data protection key by decrypting the data access key at the enterprise hardware security module of the vendor which contains a private key used in the decryption.
8. The method of claim 1 , wherein receiving the second transportable format further comprises a number string or a text string.
9. The method of claim 1 , further comprising decoding and extracting the data protection key from the second transportable format using the locked communication device.
10. The method of claim 1 , further comprising extracting the data protection key from the transportable format.
11. The method of claim 1 , further comprising freezing data of the unlocked communication device.
12. The method of claim 1 , wherein the barcode comprises a two-dimensional barcode.
13. The method of claim 1 , wherein the first transportable format further comprises an image.
14. The method of claim 1 , wherein the second transportable format further comprises an image.
15. The method of claim 1 , wherein the first transportable format further comprises an audible transportable format.
16. The method of claim 15 , wherein the audible transportable format comprises an audio file.
17. The method of claim 15 , wherein the audible transportable format comprises a sound.
18. The method of claim 1 , wherein the second transportable format further comprises an audible transportable format.
19. The method of claim 18 , wherein the audible transportable format comprises an audio file.
20. The method of claim 18 , wherein the audible transportable format comprises a sound.