FIELD

The present application relates to technically inventive, non-routine solutions that are necessarily rooted in computer technology and that produce concrete technical improvements.

BACKGROUND

Decryption keys can be used to decrypt encrypted storage areas of devices. However, as recognized herein, there are no sufficiently secure ways to ensure that these decryption keys are protected from tech-savvy hackers between manufacture of the device and use of the device by an end-user. This presents a computer-related, technological problem.

SUMMARY

Accordingly, in one aspect a method includes generating a key based on one or more of at least one hardware component identifier for hardware of a device and at least one piece of firmware code of the device. The method also includes storing the key at a hypertext transfer protocol secure (HTTPS)-based storage area, using the key to encrypt storage of the device, and providing the device to a third party with the storage encrypted. The third party may be an end-user, for example.

In some examples, the method may include generating the key based on both of the at least one hardware component identifier for hardware of a device and the at least one piece of firmware code of the device. Furthermore, in some examples the key may also be generated based on trusted platform module (TPM) data. The key may include a hash of the at least one hardware component identifier, the at least one piece of firmware code, the TPM data, and/or a salt.

In some implementations, the method may include using the key to encrypt storage of the device during manufacturing of the device.

Also in some implementations, the HTTPS-based storage area may be a HTTPS-based cloud storage area that may be located on a server that is different from the device.

Additionally, if desired the method may include facilitating booting of the device using an extensible firmware interface (EFI) file and/or an IMG file. The EFI file and/or IMG file may be stored at a server different from the device, where the server may be accessible to the device via HTTPS communication. Also note that the booting of the device may in some examples be an initial booting of the device subsequent to the device being provided to the third party.

Still further, in some examples the method may include authenticating a person associated with the third party subsequent to at least partially facilitating the booting and, responsive to authenticating the person, transmitting the key to the device using HTTPS communication. In other examples, the method may include authenticating a person associated with the third party subsequent to at least partially facilitating the booting, verifying identity and integrity of the device using the EFI file and/or IMG file responsive to authenticating the person, and transmitting the key to the device using HTTPS communication responsive to the verifying.

In another aspect, a device includes at least one processor and storage accessible to the at least one processor. The storage includes instructions executable by the at least one processor to receive a boot command and, responsive to receipt of the boot command, boot the device using Internet communication. The instructions are also executable to receive input of authentication credentials, transmit the authentication credentials to a server, communicate with the server to verify an identity of the device, and communicate with the server to decrypt at least one storage area of the device.

In some examples, the instructions may be executable to boot the device using an extensible firmware interface (EFI) file maintained by a hypertext transfer protocol secure (HTTPS) service and/or using an IMG file maintained by the HTTPS service. Also in some examples, the instructions may be executable to communicate with the server to verify integrity of the device and to communicate with the server to decrypt the at least one storage area of the device using a key generated based on at least one hardware component identifier for hardware of the device and/or at least one piece of firmware code of the device.

In another aspect, at least one computer readable storage medium that is not a transitory signal includes instructions executable by at least one processor of a first device to store a decryption key at a storage area accessible via Internet communication and to facilitate booting of a second device based on Internet communication with the second device. The booting is facilitated using an extensible firmware interface (EFI) file and/or an IMG file. The instructions are also executable to transmit the decryption key to the second device subsequent to at least partially facilitating the booting of the second device.

The details of present principles, both as to their structure and operation, can best be understood in reference to the accompanying drawings, in which like reference numerals refer to like parts, and in which:

