System and method for content protection based on a combination of a user pin and a device specific identifier
Disclosed herein are systems, methods, and non-transitory computer-readable storage media for encryption and key management. The method includes encrypting each file on a computing device with a unique file encryption key, encrypting each unique file encryption key with a corresponding class encryption key, and encrypting each class encryption key with an additional encryption key. Further disclosed are systems, methods, and non-transitory computer-readable storage media for encrypting a credential key chain. The method includes encrypting each credential on a computing device with a unique credential encryption key, encrypting each unique credential encryption key with a corresponding credential class encryption key, and encrypting each class encryption key with an additional encryption key. Additionally, a method of generating a cryptographic key based on a user-entered password and a device-specific identifier secret utilizing an encryption algorithm is disclosed.
1. A method for encrypting content, the method comprising, at a computing device that includes a processor:
receiving a user passcode;
combining at least part of the user passcode with at least part of a unique identifier associated with the computing device to produce a combined value, wherein the unique identifier is directly accessible only to a hardware module within the computing device, and is stored by the hardware module in a manner that prevents software executing by way of the processor from directly accessing the unique identifier;
carrying out an iterative function on the combined value to produce a derived key, wherein a number of iterations performed by the iterative function is based on a speed of the processor; and
encrypting content on the computing device with the derived key.
2. The method of claim 1 , wherein the at least part of the user passcode represents a subset of the user passcode that omits at least a portion, but not all, of the user passcode.
3. The method of claim 1 , wherein the at least part of the unique identifier represents a subset of the unique identifier that omits at least a portion, but not all, of the unique identifier.
4. The method of claim 1 , wherein the user passcode comprises at least one of alphanumeric data, gesture data, stylus data, biometric data, video data, or image data.
5. The method of claim 1 , wherein the number of iterations is further-based on at least one of a class of the computing device or a user-specified security level.
6. The method of claim 1 , wherein the hardware module comprises a second processor that is distinct from the second processor, and the second processor is less powerful than the processor.
7. The method of claim 1 , wherein the iterative function is further based on a target time to complete the iterative function.
8. At least one non-transitory computer readable storage medium configured to store instructions that, when executed by a processor included in a computing device, cause the computing device to encrypt content, by carrying out steps that include:
receiving a user passcode;
combining at least part of the user passcode with at least part of a unique identifier associated with the computing device to produce a combined value, wherein the unique identifier is directly accessible only to a hardware module within the computing device, and is stored by the hardware module in a manner that prevents software executing by way of the processor from directly accessing the unique identifier;
carrying out an iterative function on the combined value to produce a derived key, wherein a number of iterations performed by the iterative function is based on a speed of the processor; and
encrypting content on the computing device with the derived key.
9. The at least one non-transitory computer readable storage medium of claim 8 , wherein the at least part of the user passcode represents a subset of the user passcode that omits at least a portion, but not all, of the user passcode.
10. The at least one non-transitory computer readable storage medium of claim 8 , wherein the at least part of the unique identifier represents a subset of the unique identifier that omits at least a portion, but not all, of the unique identifier.
11. The at least one non-transitory computer readable storage medium of claim 8 , wherein the user passcode comprises at least one of alphanumeric data, gesture data, stylus data, biometric data, video data, or image data.
12. The at least one non-transitory computer readable storage medium of claim 8 , wherein the number of iterations is further-based on at least one of a class of the computing device or a user-specified security level.
13. The at least one non-transitory computer readable storage medium of claim 8 , wherein the hardware module comprises a second processor that is distinct from the second processor, and the second processor is less powerful than the processor.
14. The at least one non-transitory computer readable storage medium of claim 8 , wherein the iterative function is further based on a target time to complete the iterative function.
15. A computing device configured to encrypt content, the computing device comprising:
a processor; and
at least one memory storing instructions that, when executed by the processor, cause the computing device to:
receive a user passcode;
combine at least part of the user passcode with at least part of a unique identifier associated with the computing device to produce a combined value, wherein the unique identifier is directly accessible only to a hardware module within the computing device, and is stored by the hardware module in a manner that prevents software executing by way of the processor from directly accessing the unique identifier;
carry out an iterative function on the combined value to produce a derived key, wherein a number of iterations performed by the iterative function is based on a speed of the processor; and
encrypt content on the computing device with the derived key.
16. The computing device of claim 15 , wherein the at least part of the user passcode represents a subset of the user passcode that omits at least a portion, but not all, of the user passcode.
17. The computing device of claim 15 , wherein the at least part of the unique identifier represents a subset of the unique identifier that omits at least a portion, but not all of the unique identifier.
18. The computing device of claim 15 , wherein the number of iterations is further-based on at least one of a class of the computing device or a user-specified security level.
19. The computing device of claim 15 , wherein the hardware module comprises a second processor that is distinct from the second processor, and the second processor is less powerful than the processor.
20. The computing device of claim 15 , wherein the iterative function is further based on a target time to complete the iterative function.