Unlock and recovery for encrypted devices
A computing device can perform operations to unlock encrypted volumes of the computing device while the computing device is in a recovery environment. In some examples, the computing device can work in conjunction with a test computing device to unlock the encrypted volumes using an unlock token and a PIN. In other examples, the computing device can perform operations without a test computing device. For example, the computing device can, while in the recovery environment, use credentials associated with a user of the computing device to obtain a recovery password to unlock keys for interpreting the encrypted volumes. In some examples, the computing device can use a shortened recovery password in conjunction with anti-hammering capabilities of a Trusted Platform Module in order to unlock keys for interpreting the encrypted volumes. These and other operations can facilitate secure unlock of volumes of encrypted data on a consumer device.
1. A method at a testing device, the method comprising:
receiving, from a consumer device, information associated with the consumer device;
sending, to an authentication service, the information to verify the consumer device;
receiving, from the authentication service, a signed unlock token associated with unlocking the consumer device; and
transmitting, to the consumer device, the signed unlock token for storage in an unencrypted location of the consumer device while the consumer device is in a recovery mode.
2. The method of claim 1 , wherein the information associated with the consumer device includes at least one of device identification information or original equipment manufacturer (OEM) information.
3. The method of claim 1 , wherein the signed unlock token includes device identification information or original equipment manufacturer (OEM) information, and an unlock type.
4. The method of claim 1 , further comprising causing the consumer device to unlock an encrypted location of the consumer device with the signed unlock token.
5. The method of claim 1 , further comprising causing the consumer device to reboot.
6. The method of claim 5 , further comprising:
receiving a personal identification (PIN);
causing the consumer device to access the unencrypted location of the consumer device;
determining that the PIN corresponds to a valid PIN; and
causing, in response to determining that the PIN corresponds to the valid PIN, the consumer device to unlock a key stored in a Trusted Platform Module (TPM), the key configured for use in decrypting information stored on the consumer device.
7. The method of claim 1 , further comprising:
causing the consumer device to present a user interface including a prompt for a personal identification (PIN) on a display associated with the consumer device;
receiving the PIN via the user interface; and
determining whether the PIN corresponds to a valid PIN.
8. The method of claim 7 , further comprising:
determining that the PIN does not correspond to the valid PIN;
incrementing a count of an input counter;
determining whether the count has exceeded a threshold value; and
preventing, in response to determining that the count has exceeded the threshold value, an unlock module of the testing device from receiving additional inputs for a set period of time.
9. The method of claim 8 , further comprising:
determining that the set period of time has ended;
presenting the user interface including a second prompt for a second PIN; and
resetting the count of the input counter.
10. The method of claim 1 , the unencrypted location comprising an Extensible Firmware Interface (EFI) System Partition.
11. A non-transitory computer readable medium comprising instructions that, when executed by a processor of a testing device, cause the processor to:
receive, from a consumer device, information associated with the consumer device;
send, to an authentication service, the information to verify the consumer device;
receive, from the authentication service, a signed unlock token associated with unlocking the consumer device; and
transmit, to the consumer device, the signed unlock token for storage in an unencrypted location of the consumer device while the consumer device is in a recovery mode.
12. The non-transitory computer readable medium of claim 11 , wherein the information associated with the consumer device includes at least one of device identification information or original equipment manufacturer (OEM) information.
13. The non-transitory computer readable medium of claim 11 , wherein the signed unlock token includes device identification information or OEM information, and an unlock type.
14. The non-transitory computer readable medium of claim 11 , further comprising instructions that, when executed by the processor, cause the processor to cause the consumer device to unlock an encrypted location of the consumer device with the signed unlock token.
15. The non-transitory computer readable medium of claim 11 , further comprising instructions that, when executed by the processor, cause the processor to cause the consumer device to reboot.
16. The non-transitory computer readable medium of claim 15 , further comprising instructions that, when executed by the processor, cause the processor to:
receive a personal identification (PIN);
cause the consumer device to access the unencrypted location of the consumer device;
determine that the PIN corresponds to a valid PIN; and
cause, in response to determining that the PIN corresponds to the valid PIN, the consumer device to unlock a key stored in a Trusted Platform Module (TPM), the key configured for use in decrypting information stored on the consumer device.
17. The non-transitory computer readable medium of claim 11 , further comprising instructions that, when executed by the processor, cause the processor to:
cause the consumer device to present a user interface on a display associated with the consumer device to prompt for a personal identification (PIN);
receive the PIN via the user interface; and
determine whether the PIN corresponds to a valid PIN.
18. The non-transitory computer readable medium of claim 17 , further comprising instructions that, when executed by the processor, cause the processor to:
determine that the PIN is not the valid PIN;
increment a count of an input counter;
determine whether the count has exceeded a threshold value; and
prevent, in response to determining that the count has exceeded the threshold value, an unlock module of the testing device from receiving additional inputs for a set period of time.
19. The non-transitory computer readable medium of claim 18 , further comprising instructions that, when executed by the processor, cause the processor to:
determine that the set period of time has ended;
present the user interface to prompt for a second PIN; and
reset the count of the input counter.
20. A testing system, comprising:
a memory comprising instructions;
a processor communicatively coupled to the memory and configured to execute the instructions to:
receive, from a consumer device, information associated with the consumer device;
send, to an authentication service, the information to verify the consumer device;
receive, from the authentication service, a signed unlock token associated with unlocking the consumer device; and
transmit, to the consumer device, the signed unlock token for storage in an unencrypted location of the consumer device while the consumer device is in a recovery mode.