Patent Application
20060041932
The present invention is in the field of computer systems. More particularly, the present invention relates to systems and methods to access password-protected data when a corresponding data password has been lost, forgotten, or is otherwise unavailable, and to recover the data password to facilitate recovery of the password-protected data from a digital memory device such as a hard disk drive.
Many different types of computing systems have attained widespread use around the world. These computing systems (computers) include personal computers, servers, mainframes and a wide variety of stand alone and embedded computing devices. For example, personal computer systems are well known in the art. Personal computers (PCs) may be defined as a desktop, floor standing, or portable microcomputer that includes a system unit having a central processing unit (CPU) and associated volatile and non-volatile memory, including random access memory (RAM) and basic input/output system read only memory (BIOS ROM), a system monitor, a keyboard, one or more removable non-volatile media drives such as a diskette drive, compact disk read-only memory (CD ROM) drive or digital versatile disc or digital video disk (DVD) drive, a fixed disk storage drive also known as a “hard drive” or “HDD”, a pointing device such as a mouse, and an optional network interface adapter. One of the distinguishing characteristics of these systems is the use of a motherboard or system planar or backplane to communicatively couple these components together. Examples of such personal computer systems are IBM's ThinkCentre series, ThinkPad series, and Intellistation series.
Computers are used for business, government and personal reasons. Large markets exist to service business, government and personal computer segments by creating and distributing seemingly ever more powerful, versatile and cost-effective computers. Constantly increasing computer power has in turn supported a huge increase over time in the types of software applications available. Software applications commonly perform word processing, spreadsheet, accounting, e-mail, voice over Internet protocol telecommunications, facsimile, and a growing list of simulation, modeling, analysis and tracking functions. For example, businesses often employ a wide variety of computing applications to support critical work activities such as accounting, customer support, engineering and sales. Government entities often use computers to track statistical and project data. Individuals and families often use computers for word processing, homework, research, telecommuting, games, news, stock market information and trading, banking, shopping, shipping, communication in the form of Voice over Internet protocol (VoIP) and email, as well as many other activities. In fact, for many business and personal owners, PCs represent an essential tool for their livelihood.
Corresponding to their variety of uses and users, computers are physically located in wide variety of locations from the physically secure to the home office to airplane and train terminals. Mobile PCs such as laptop computers are designed to be transported over distances, including away from available power supplies, so at any given time they can be in unsecured areas. For this and other reasons, the loss or theft of computers is an all too frequent occurrence.
Because of the utility and widespread use of computers, one of the prominent features of computers is the creation, storage and use of digital data. The vast majority of computer programs create, store and use digital data as part of their functioning. The nature of this data can be fairly trivial, say related to a video game, or alternatively the data can be essential trade secret business information whose value to its owner far outweighs the value of the computer that contains it. Many computers store most of their non-volatile data as hardfiles on hard disk drives (HDDs). For example, business computers, including laptop computers in particular, often contain valuable data stored on HDDs and are transported to many different locations outside of the more secure confines of the business environment. In this manner, valuable and confidential data can be carried in computers to unsecured areas where they are more likely to be lost or stolen. For this reason and others, computers have been created with the capability to password-protect HDD data. Thus, for example, if a computer is stolen, or if an unauthorized individual tries to access the computer, the HDD data will remain secure as long as the data password remains confidential.
Currently, many software applications offer password protection, leading to many users being responsible for a large and increasing number of passwords. As the number of software applications and their associated passwords proliferate, so does the difficulty for the users to keep track of all those passwords, including those associated with data stored in hardfiles on HDDs. On one hand, to manage those passwords some users select the same password, or a small set of passwords that may be discovered or are easily guessed at by unauthorized persons desirous of the data in such a computer. This particular user behavior minimizes the effectiveness of password protection schemes because it increases the likelihood that the password discovered in one context will be used by an unauthorized person in not only that context and but also in many others. On the other hand, some individuals select a variety of more difficult-to-guess passwords, preserving the integrity of the password protection, but this has a down-side as well.
Unfortunately, it is often the case that the most obscure and therefore secure passwords are the most difficult to remember. Furthermore, even simple passwords can be forgotten through infrequent use. Occasionally users can maliciously set passwords and fail to release corresponding password protected data which in actuality is owned by another, such as a recent former employer. In all these cases and many others where the password associated with password protected data is not available to the data's owner or a legitimate user, the underlying password-protected data is irretrievably lost. The loss of such password-protected data can have a significant, negative impact on the owner or user of that data. For example, original business data accumulated at considerable expense that becomes lost may require a second expenditure of funds and efforts to recreate that data. For this reason, computer owners such as businesses often avoid password protection of data, especially hard disk drive data, to avoid costly losses, thereby defeating the entire password-protection scheme for HDDs and other storage devices.
There is, therefore, a need for owners and authorized users of computers to recover their password-protected data, when the password protecting that data is lost, forgotten or otherwise becomes unavailable, and the corresponding password-protected data would otherwise be inaccessible.
The problems identified above and other problems associated with forgotten, lost or otherwise unavailable passwords, are in large part addressed by systems and methods of the present invention to access password-protected stored data when the corresponding password has become lost, forgotten, or otherwise unavailable, and to recover the data password to facilitate recovery of the password-protected data from a digital memory device such as a hard disk drive.
Some embodiments of the present invention provide methods for recovering a data password used to password-protect data stored in a data storage device such as a hard disk drive. The data password is encrypted to form an encrypted password. Both the data password and the encrypted password are stored on the storage device. When a need arises to recover the data password, the encrypted password is retrieved from the data storage device by a program, e.g. BIOS. The decryption key is used to decrypt the password on another computer such as a secure computer coupled with the user computer via a computer network or by the user computer to derive the data password.
Some embodiments of the present invention provide methods for recovering a data password used to password-protect data stored in a hard disk drive communicatively coupled with a user computer. The user computer receives both a data password, e.g., from an authorized person using the computer (user), and an encryption key. The encryption key is stored in a limited-access, non-volatile memory in the user computer such as a trusted platform module (TPM). The encryption key is used to encrypt the data password, both of which are stored on the hard disk drive. When the data password becomes lost, forgotten or otherwise unavailable, the user computer retrieves the encrypted password from the hard disk drive and initiates decryption of the encrypted password to derive the data password. The decryption can occur in the user computer or in another computer. The previously lost, forgotten or unavailable data password can then be used to access the password-protected data.
Some embodiments of the present invention provide an apparatus to recover a data password used to password-protect data stored in a data storage device such as a hard disk drive. An encryption module encrypts the data password to form an encrypted password. A recovery module stores the encrypted password on the hard disk drive and later retrieves the encrypted password from the hard disk drive and transmits the encrypted password to a decryption module. The decryption module decrypts the encrypted password with one or more decryption keys to derive the data password.
Some embodiments of the present invention provide computer-readable media for implementing methods for recovering a data password used to password-protect data stored in a hard disk drive communicatively coupled with a computer. The computer-readable media provides an encryption key to a user computer so that the user computer can encrypt a data password for storage on a hard disk drive. The computer-readable media also provides the decryption key to the user computer to decrypt the data password when prompted by the user.
Some embodiments contemplate a limited-access, non-volatile memory resident in a user computer to store at least one encryption key generally unknown to computer users, e.g., an encryption key specified by the user computer's manufacturer or vendor. The encryption key is used to encrypt a data password selected by the user. Both the password and the encrypted password are stored on a storage device such as a hard disk drive. If the user's data password becomes unavailable, the user initiates a data recovery software application through a request for assistance or running of the data recovery software application. The data recovery software application can reside in another computer such as a secure computer or within the user computer. The encrypted password is recovered from the storage device, for example, with a known Identify Device command issued from the BIOS, causing the encrypted password to be returned from the storage device. The encrypted password is then decrypted with the decryption key by the user computer or another computer.
Other objects and advantages of the invention will become apparent upon reading the following detailed description and upon reference to the accompanying drawings in which, like references may indicate similar elements:
The following is a detailed description of example embodiments of the invention depicted in the accompanying drawings. The example embodiments are in such detail as to clearly communicate the invention. However, the amount of detail offered is not intended to limit the anticipated variations of embodiments, but on the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the present invention as defined by the appended claims. The written and detailed descriptions herein are designed to enable one of ordinary skill in the art to practice such embodiments.
Generally speaking, systems and methods for securely accessing password-protected data without the password are contemplated. Embodiments employ at least one encryption method such as the use of an encryption key to encrypt the user selected password. In some embodiments described herein, multiple keys are generated and used. In some embodiments a user computer is provided with an encryption key through a computer network, such as one internal to a corporation's information technology (IT) department, the Internet, an intranet, an extranet, etc., with a copy of the encryption key stored on a separate computer or on a removable, non-volatile storage media. In other embodiments the user computer receives the encryption key loaded into the user computer by the computer manufacturer, computer vendor or corporate IT personnel with a copy of the encryption and decryption keys stored on a separate computer or a compact disk read-only memory (CD ROM) or other removable and non-volatile media. Note that the embodiments are not limited to a CD ROM, in fact the present invention also contemplates substitution of the CD ROM and drive with any removable, non-volatile memory and drive, including digital versatile disk read-only memory also known as digital video disk read-only memory (DVD ROM), etc. In still other embodiments the user computer receives the encryption key on a CD ROM to be loaded into the user computer in conjunction with the user's password selection to implement this method on the user's computer.
In many embodiments, the encryption key is stored in secure, non-volatile memory, such as a trusted platform module (TPM), accessible only to the user computer's basic input-output system (BIOS) code, which is modified to implement embodiments of the present invention. At the prompting of known password-setting HDD software running on the user's computer, the user creates a password for the HDD data associated with one or more hardfiles stored on the computer's hard disk drive (HDD). In accordance with some embodiments of the present invention, a modified BIOS transmits the password to a non-volatile storage in the user computer, such as a TPM, which stores the encryption key and uses the encryption key to encrypt the password, then transmits the encrypted password back to the BIOS. The BIOS then stores both the unaltered data password and the encrypted password onto the HDD. The encrypted password is stored in separate location from the data password which is accessible to software running on the computer, e.g., BIOS, via a hardfile command such as the Identify Device command. In normal operation the user's computer prompts the user for their data password in order to compare against the HDD-stored data password to authenticate the user and provide authenticated access to the corresponding password-protected data. In normal operation, if the password becomes lost, forgotten, or is otherwise unavailable, the password-protected data would likewise become irretrievably lost. However, in embodiments of the present invention, if the password becomes lost, forgotten, or is otherwise unavailable, a password recovery program is initiated. The password recovery program retrieves the encrypted password from the HDD, e.g., with an Identify Device Command. The encrypted password is decrypted by the possessor of the decryption key and provided to the user. The user can then access the password-protected data with the password as before and no data is lost, a significant improvement of the prior art in which all data would be lost.
While specific embodiments will be described herein with reference to particular configurations of computers, HDDs and non-volatile memory, those of skill in the art will realize that embodiments of the present invention may advantageously be implemented with other substantially equivalent circuit configurations and elements.
Turning to the drawings,
The user computer 102 is communicatively coupled with a data storage device (data storage) 104 for mass, non-volatile, data storage. In many embodiments the recovery module 103 in the user computer 102 is also communicatively coupled with data storage 104 for storing and retrieving encrypted passwords, as described below. The recovery module 103 facilitates recovery of a data password associated with password-protected data stored in the data storage 104 that has become lost, forgotten or otherwise unavailable. In several embodiments, data storage 104 is a hard disk drive (HDD). The HDD 104 can be integrated into the physical housing of the user computer 102 such as with many currently-available laptop and desktop computers, but this is not required. Furthermore, the embodiments are not limited to HDDs, but will function with any data storage device employed with the user computer 102 that is capable of storing password-protected data.
The recovery module 103 in the user computer 102 is communicatively coupled with a non-volatile, secure, storage device (secure storage device) 106. In some embodiments the secure storage device 106 is a trusted platform module (TPM), however, any non-volatile storage apparatus will also suffice. For example, Flash memory or electrically erasable programmable read-only memory (EEPROM) can also be used to implement the secure storage device 106. In many embodiments, the secure storage device 106 contains an encryption module 107. The embodiments are not limited to any particular type of encryption. With at least one encryption key, the encryption module 107 encrypts the data password to form an encrypted password. The encryption module 107 transmits the encrypted password to the recovery module 103 for storage in the data storage 104 as described below.
In some embodiments, the secure storage device 106 receives the encryption key from a secure computer 108 via a computer network 110. In other embodiments, the secure storage device 106 receives the encryption key more directly from a secure computer 108 maintained by a manufacturer of the user computer 102, a vendor of the user computer 102, corporate IT personnel, or others, without the use of a separate computer network 110. In further embodiments, the computer network 110 includes a Preboot eXecution Environment (PXE) capability such as that offered by Intel Corporation, Santa Clara, Calif., but PXE is not required.
The secure computer 108 contains a decryption module 109 for decrypting the encrypted password to derive the data password. The recovery module 103 retrieves the encrypted password from data storage 104 and transmits the encrypted password to the decryption module 109 in the secure computer 108. The decryption module 109 has access to a copy of the encryption key used by the encryption module 107 to encrypt the data password as well as the decryption key to be used to decrypt the encrypted password (in some embodiments, the encryption key and the decryption key may be the same.). In some embodiments the encryption and decryption keys are stored in a database and associated with a particular user, user computer 102 and/or storage device 104. As described elsewhere herein, with both the encrypted password and the decryption key present in the decryption module 109, the decryption module 109 algorithmically decrypts the encrypted password to derive the data password.
In several embodiments, the computer network 110 having PXE functionality transmits the encryption key from the secure computer 108 through the computer network 110 to the user computer 102. The user computer 102 stores the encryption key into the secure storage device 106 under control of BIOS software running in the user computer 102. The encryption module uses the encryption key in the secure storage device 106 to encrypt a data password to form an encrypted password for storage on the HDD 104 as is described in more detail with regard to
Referring to
In the embodiment shown in
In some embodiments, a CD ROM inserted into the CD ROM drive 208 contains the encryption and decryption keys. The CD ROM drive 208 transmits the encryption key to the BIOS associated with the recovery module 203 in the user computer 202, which stores the encryption key into the secure storage device 206 under control of the BIOS software in the user computer 202. The encryption key in the secure storage device 206 can encrypt a data password for storage on the HDD 204 as is described in more detail with regard to
Referring to
The TPM 306 includes an encryption module 308 to encrypt the data password. In some embodiments, the encryption module 308 employs an asymmetric encryption algorithm 330 with a public encryption key to encrypt the data password. The TPM 306 transmits the encrypted data password to the recovery module 302. The recovery module 302 stores the encrypted data password on the HDD 304. When prompted by the user or others as described herein, the recovery module 302 retrieves the encrypted password from the HDD 304. In some embodiments an identify device command is used to retrieve the encrypted data password.
Once the recovery module 302 has the encrypted password back from the HDD 304, the recovery module 302 transmits the encrypted password to the decryption module 310. The decryption module 310 has a copy of the decryption key used decrypt the data password. As described elsewhere herein, with the encrypted password and the decryption key present in the decryption module 310, the decryption module 310 algorithmically decrypts the encrypted password to derive the data password. In some embodiments, the data password is transmitted to the display 312 after authentication is confirmed with the authentication module 320. The display 312 provides an authenticated user with a visual indication of what the data password is. In other embodiments, the data password is transmitted to a display 312 without confirmation of authentication from the authentication module 320 because the user is self-authenticated, such as in the case of a stand alone PC. Self-authentication is supported because the user had original possession of the CD ROM containing the decryption key which correlates to subsequent possession of the CD ROM for password recovery.
Authentication of the user is performed in the authentication module 320 in conjunction with input from a person requesting the data password and/or access to the password-protected data. Various forms and combinations of authentication can be employed such as user identification 322, biometric identification 324 and/or user password identification 326. In authentication employing user identification 322, the user is asked to show a form of identification such as a driver's license. In authentication employing biometric identification, a biometric measurement is taken and compared against a database entry for that person, for example, a retina scan is taken for this purpose. In authentication using a password identification, a separate password is sought. For example, the person seeking access may need to know the user's mother's maiden name, etc. In further embodiments, a corporate IT person is shown the data password in addition to, or instead of, the user. In other embodiments the data password is not displayed, e.g., on display 312.
Referring to
Continuing to block 404 from block 402, the encryption key is stored in a secure place. In
Continuing to block 408 from block 406, the encryption key received by the user computer 102, 202, is stored by the BIOS into a secure location accessible by the BIOS. Preferably, the secure location is only accessibly to the BIOS, but less secure locations suffice in some alternative embodiments. In
Referring to
Continuing to block 508 from block 506, the BIOS in the user computer 102, 202, directs both the unencrypted and encrypted data passwords to be stored on the HDD 104, 204. The unencrypted or original data password is stored with the hardfile on the HDD 104, 204 to control access to the hardfile by the user having the password as has been done prior to the present invention. According to some embodiments, the encrypted password is stored into an area of the HDD 104, 204 responsive to the Identify Device command, i.e., when invoked, the Identify Device command will return the encrypted password to the user computer 102, 202. This is particularly useful when access to all or part of the HDD is otherwise prevented, e.g., when too many attempts to access the password-protected hardfiles with incorrect password(s) have occurred or if the password is lost, forgotten, etc. . . . Flow chart 500 terminates at block 508.
Referring to
Continuing to block 604 from block 602, password recovery mode is initiated. In some of the embodiments illustrated by
Continuing from block 604 to block 605, the user is authenticated. Embodiments employ one or more methods to authenticate a user. For example, user identification, e.g., a driver's license, biometric identification, e.g., a retina scan, and/or password identification, e.g., mother's maiden name, are used to authenticate a user as described with respect to
Referring to
Having completed blocks 702 and 704 in
The recovered password can be used to recover the password-protected data (block 708). In
Some embodiments of the invention are implemented as a program product for use with a computer system such as, for example, the system 100 shown in
In general, the routines executed to implement the embodiments of the invention, may be part of an operating system or a specific application, component, program, module, object, or sequence of instructions. The computer program of the present invention typically is comprised of a multitude of instructions that will be translated by the native computer into a machine-readable format and hence executable instructions. Also, programs are comprised of variables and data structures that either reside locally to the program or are found in memory or on storage devices. In addition, various programs described hereinafter may be identified based upon the application for which they are implemented in a specific embodiment of the invention. However, it should be appreciated that any particular program nomenclature that follows is used merely for convenience, and thus the invention should not be limited to use solely in any specific application identified and/or implied by such nomenclature.
It will be apparent to those skilled in the art having the benefit of this disclosure that the present invention contemplates systems and methods to access password-protected stored data when the associated data password has become lost, forgotten, or is otherwise unavailable, and to recover the data password and data protected by the password from a digital memory device such as a hard disk drive. It is understood that the forms of the invention shown and described in the detailed description and the drawings are to be taken merely as examples. It is intended that the following claims be interpreted broadly to embrace all the variations of the example embodiments disclosed herein.
