Computer system and method for secure password reset of password protection device

Abstract

A computer-implemented method and system providing secure password reset functionality for a password protection device. A request code is received in a password reset computer server to enable a password reset function for a password protection device. The request code is parsed to identify the cryptographic protection device for generating a recovery string including at least the metadata and a unique identifier associated with the cryptographic protection device. A first hash value representing a recovery string is generated for the cryptographic protection device. Then, the first hash value is compared to a second hash value generated by another computer device and representing a second recovery string including at least the metadata and a unique identifier associated with the cryptographic protection device. When the first and second hash values match, a password reset function for the password protection device is enabled.

Description

Technical Field

[0001] The disclosed embodiments generally relate to computer-implemented methods and systems for providing password reset management and, more particularly, to a secure process for resetting passwords in critical devices that does not cause interruption of their power operation during the password reset process. Background Art

[0002] Many power and critical devices require password reset operations, but are placed in situations where traditional password resets are unacceptable (they may not power cycle or factory reset). The problem of securely resetting passwords for critical system devices is often problematic. For example, many of these password-protected devices are not connected to the internet, making it necessary to support secure reset operations in a remote and offline manner. Furthermore, password-protected devices are often used for critical system operations, so system users generally cannot tolerate a power cycle of the device configuration or a forced factory reset to reset the device's password. Therefore, there is a need to provide alternative and improved systems and methods for securely resetting passwords for critical password-protected devices / components. Summary of the Invention

[0003] Additional advantages of the illustrated embodiments will be realized and attained by the devices, systems, and methods particularly pointed out in the written description and claims hereof as well as the appended drawings.

[0004] To achieve these and other advantages, and in accordance with the purposes of the illustrated embodiments, in one aspect, the disclosed embodiments relate to a computer-implemented secure password reset system and process for providing a secure method of resetting a device password to restore access to a system without causing power cycling or other types of system downtime. Preferably, the process includes two phases, namely, enrollment and recovery. Both the enrollment and recovery processes preferably utilize a PC-based application that is configured and operated to act as an intermediary between a compatible password-protected device and a password recovery system. In certain illustrated embodiments, in order to securely reset the password on a device, the device is first preferably authenticated (to ensure that it is the correct device) (e.g., the device serial number and a pre-shared salt may be used for the authentication). Additionally, the user associated with the device is authenticated (e.g., to ensure that the correct user recovers the password). Additionally, the user seeking a device password reset is first authenticated, which may include logging into a password recovery system (e.g., a software module on a portable computer device) to provide valid login credentials.

[0005] In a further optional aspect, a computer-implemented method and system for providing a secure password reset function for a password-protected device is disclosed. A request code for enabling a password reset function for a password-protected device is received at a password reset computer server. The request code is parsed to identify the password-protected device and used to generate a recovery string that includes at least metadata and a unique identifier associated with the password-protected device. A first hash value representing the recovery string is generated for the password-protected device. The first hash value is compared with a second hash value, where the second hash value is generated by another computer device and represents a second recovery string that includes at least metadata and a unique identifier associated with the password-protected device. When the first and second hash values ​​match, the password reset function for the password-protected device is enabled. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] So that those skilled in the art to which the subject disclosure pertains will readily understand how to make and use the apparatus and methods of the subject disclosure without undue experimentation, preferred illustrative embodiments thereof will be described in detail below with reference to certain drawings, in which:

[0007] Figure 1 An example communication network is shown for use with one or more of the illustrated embodiments;

[0008] Figure 2 An example network device / node is shown for use with one or more of the illustrated embodiments;

[0009] Figure 3 is an exemplary network diagram depicting a password reset system according to the illustrated embodiment;

[0010] Figure 4 Depicted is a diagram showing a method for providing a Figure 3 A diagram of the password reset system that generates the registration code of the registered device;

[0011] Figure 5 Depicts generating a request code and a recovery string to pass a Figure 3 The password reset system enables password reset for password-protected devices;

[0012] Figure 6 Depicted is a diagram showing a method for generating a Figure 3 A flowchart of a computer process for registering a device's registration code with a password reset system; and

[0013] Figure 7 Depicted is a diagram illustrating a method for generating a request code and a recovery string to pass a request code according to the illustrated embodiment. Figure 3 A flowchart of the computer process for resetting passwords for password-protected devices enabled by the password reset system. DETAILED DESCRIPTION

[0014] The illustrated embodiments will now be described more fully with reference to the accompanying drawings, wherein like reference numerals represent similar structural / functional features. The illustrated embodiments are not limited in any way to what is shown, as the illustrated embodiments described below are merely exemplary and, as those skilled in the art will appreciate, may be embodied in various forms. Therefore, it should be understood that any structural and functional details disclosed herein should not be interpreted as limiting, but merely as a basis for the claims and as a representation to teach those skilled in the art to use the discussed embodiments in various ways. Furthermore, the terms and phrases used herein are not intended to be limiting, but rather to provide an understandable description of the illustrated embodiments.

[0015] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Although any methods and materials similar or equivalent to those described herein can also be used in the practice or testing of the illustrated embodiments, exemplary methods and materials are now described.

[0016] It must be noted that, as used herein and in the appended claims, the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. Thus, for example, reference to "a stimulus" includes a plurality of such stimuli and reference to "a signal" includes reference to one or more signals and equivalents thereof known to those skilled in the art, and so forth.

[0017] It should be understood that the illustrated embodiments discussed below are preferably software algorithms, programs or codes residing on a computer usable medium having control logic for enabling execution on a machine having a computer processor. The machine typically includes a memory configured to provide an execution output of the computer algorithm or program according to the illustrated embodiments.

[0018] As used herein, the term "software" is meant to be synonymous with any code or program that can be executed in a processor of a host computer, regardless of whether the implementation is in hardware, firmware, or as a software computer product available on a disk, memory storage device, or for download from a remote machine. The embodiments described herein include such software to implement the above equations, relationships, and algorithms. Based on the above embodiments, those skilled in the art will understand further features and advantages of the illustrated embodiments. Therefore, the illustrated embodiments are not limited to what has been specifically shown and described, except as indicated by the appended claims.

[0019] Turning descriptively now to the drawings, in which like reference numerals represent like elements throughout the several views, Figure 1An exemplary communication network 100 is depicted in which the embodiments shown below may be implemented. It should be understood that the communication network 100 is a geographically distributed collection of nodes interconnected by communication links and segments for transmitting data between end nodes, such as personal computers, workstations, smart phone devices, tablets, televisions, sensors and / or other devices, such as cars. Many types of networks are available, ranging from local area networks (LANs) to wide area networks (WANs). LANs typically connect nodes via dedicated, proprietary communication links located in the same common physical location, such as a building or campus. On the other hand, WANs typically connect geographically dispersed nodes via long-distance communication links, such as public carrier telephone lines, optical paths, synchronous optical networks (SONET), synchronous digital hierarchy (SDH) links, or power line communications (PLC).

[0020] Figure 1 is a schematic block diagram of an example communication network 100, which schematically includes nodes / devices 101-108 (e.g., sensor 102, password management device 103, smart phone device 105, password reset system / server (e.g., computer server) 106, router 107, switch 108, database, etc.) interconnected by various communication methods. For example, link 109 can be a wired link or can include a wireless communication medium, where certain nodes communicate with other nodes based on, for example, distance, signal strength, current operating status, location, etc. In addition, as those skilled in the art will understand, each device can communicate data packets (or frames) 142 with other devices using a predefined network communication protocol (e.g., various wired protocols and wireless protocols, etc.) where appropriate. In this case, the protocol consists of a set of rules that define how nodes interact with each other. Those skilled in the art will understand that any number of nodes, devices, links, etc. can be used in a computer network, and the view shown here is for simplicity. In addition, although the embodiments are shown here with reference to a general network cloud, the description here is not limited thereto and can be applied to hardwired networks.

[0021] As will be understood by those skilled in the art, various aspects of the illustrated embodiments may be embodied as systems, methods, or computer program products. Thus, various aspects of the illustrated embodiments may take the form of entirely hardware embodiments, entirely software embodiments (including firmware, resident software, microcode, etc.), or embodiments combining software and hardware aspects, which are generally referred to herein as "devices," "devices," "modules," or "systems." Furthermore, various aspects of the illustrated embodiments may take the form of computer program products embodied in one or more computer-readable media having computer-readable program code embodied thereon. Any combination of one or more computer-readable media may be utilized. A computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include the following: an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer-readable storage medium may be any tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable signal medium may include a propagated data signal with computer-readable program code embodied therein, such as in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including but not limited to electromagnetic, optical, or any suitable combination thereof. A computer-readable signal medium may be any computer-readable medium that is not a computer-readable storage medium and that can convey, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device.

[0022] The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, fiber optic cable, RF, etc., or any suitable combination of the foregoing. The computer program code for performing the operations of various aspects of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, Smalltalk, C++, Python, etc., and traditional procedural programming languages ​​such as the "C" programming language or similar programming languages. The program code may be executed entirely on the user's computer as a stand-alone software package, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0023] Aspects of the illustrated embodiments are described below with reference to flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the illustrated embodiments. It will be understood that each block of the flowcharts and / or block diagrams and combinations of blocks in the flowcharts and / or block diagrams may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a computer device, a special-purpose computer, or other programmable data processing device to produce a machine such that instructions executed by the processor of the computer or other programmable data processing device create a means for implementing the functions / actions specified in one or more blocks of the flowcharts and / or block diagrams.

[0024] These computer program instructions may also be stored in a computer-readable medium that can direct a computer, other programmable data processing device, or other apparatus to operate in a specific manner such that the instructions stored in the computer-readable medium generate and maintain an inventory asset database that includes instructions for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0025] Computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operating steps to be executed on the computer, other programmable apparatus, or other device, thereby producing a computer-implemented process, so that the instructions executed on the computer or other programmable apparatus provide a process for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0026] Figure 2is a schematic block diagram of an example network computing device 200 (e.g., password management device 103, password reset system / server 106, etc.) that (or components thereof) can be used with one or more embodiments described herein (e.g., as one of the nodes shown in network 100) to provide a computer-implemented secure password reset system and process to provide a secure method of resetting a device password for restoring access to the system without causing device power cycling or other types of system downtime. As described above, in various embodiments, these various devices are configured to communicate with each other in any suitable manner, such as via communication network 100.

[0027] Device 200 is intended to represent any type of computer system capable of carrying out the teachings of the various illustrated embodiments. Device 200 is only one example of a suitable system and is not intended to suggest any limitation as to the scope of use or functionality of the illustrated embodiments described herein.

[0028] It should be understood and appreciated that the computing device 200 can operate with many other general-purpose or special-purpose computing system environments or configurations. Examples of well-known computing systems, environments, and / or configurations suitable for the computing device 200 include, but are not limited to, personal computer systems, server computer systems, thin clients, fat clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, network PCs, minicomputer systems, and distributed data processing environments including any of the above systems or devices. The computing device 200 can be described in the general context of computer system-executable instructions, such as program modules, executed by a computer system. Generally, program modules can include routines, programs, objects, components, logic, data structures, etc. that perform specific tasks or implement specific abstract data types. The computing device 200 can be implemented in a distributed data processing environment where tasks are performed by remote processing devices linked via the communication network 100. In a distributed data processing environment, program modules can be located in local and remote computer system storage media, including memory storage devices.

[0029] The components of the device 200 may include, but are not limited to, one or more processors or processing units 216, a system memory 228, and a bus 218 that couples various system components, including the system memory 228, to the processor 216. The bus 218 represents one or more of any of a variety of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and not limitation, such architectures include an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus. The computing device 200 typically includes various computer system readable media.

[0030] The system memory 228 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 230 and / or cache memory 232. The computing device 200 may also include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, a storage system 234 may be provided for reading from and writing to a non-removable, non-volatile magnetic medium (not shown, and commonly referred to as a "hard drive"). Although not shown, a disk drive for reading from and writing to a removable, non-volatile disk may be provided, as well as an optical drive for reading from or writing to a removable, non-volatile optical disk (e.g., CD-ROM, DVD-ROM or other optical media). In this case, each may be connected to the bus 218 via one or more data media interfaces. As will be further depicted and described below, the memory 228 may include at least one program product having a set (e.g., at least one) program module (240) configured to perform the functions of the embodiments in the illustrated embodiment, such as for providing a secure method for resetting a password for a device to restore access to the system without causing a device power cycle or other type of system downtime. By way of example and not limitation, a program / utility 240 having a set (e.g., at least one) program module 215 (e.g., an asset inventory module), as well as an operating system, one or more application programs, other program modules, and program data may be stored in the memory 228. Each of the operating system, one or more application programs, other program modules, and program data, or some combination thereof, may include an implementation of a network environment. The program modules 215 generally perform the functions and / or methods of the illustrated embodiments described herein.

[0031] The device 200 may also communicate with one or more external devices 214, such as a keyboard, pointing device, display 224, etc.; one or more devices that enable a user to interact with the computing device 200; and / or any device that enables the computing device 200 to communicate with one or more other computing devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface 222. In addition, the device 200 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet), via a network adapter 220. As shown, the network adapter 220 communicates with other components of the computing device 200 via a bus 218. It should be understood that, although not shown, other hardware and / or software components may be used in conjunction with the device 200. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archiving storage systems.

[0032] Figure 1 and Figure 2 It is intended to provide a brief, general description of an illustrative and / or suitable example environment in which the embodiments described below may be implemented. Figure 1 and 2 The examples of suitable environments are not intended to limit the structure, scope of use, or functionality of the illustrated embodiments. A particular environment should not be construed as constituting any dependency or requirement on any one or combination of components shown in the exemplary operating environment. For example, in some cases, one or more elements of the environment may be deemed unnecessary and omitted. In other cases, one or more other elements may be deemed necessary and added.

[0033] With the exemplary communication network 100 ( Figure 1 ) and computing device 200( Figure 2 ) are generally shown and discussed above, a description of certain illustrated embodiments will now be provided. It should be understood and appreciated that implementation Figure 1-7 One or more exemplary embodiments of components of the present invention relate to a computer-implemented secure password reset system and process for providing a secure method of resetting a device password to restore access to the system without causing device power cycling or other types of system downtime. Figure 3 , depicts a simplified exemplary embodiment of a password management system 350, which includes a password management device 103 configured and operable to be communicatively coupled to a password protection device 300 for resetting the password of the device 300 to restore access to the device 300 and / or the system of which the device 300 is a component, without causing device power cycling or other types of system downtime. It should be understood and appreciated that, according to the illustrated embodiment, the password protection device 300 includes a variety of types of password protection devices, and, according to the illustrated embodiment, preferably includes a local protocol-compatible device (e.g., a MODBUS-compatible device), such as a circuit breaker component device that is a component of the overall system. For example, as known to those skilled in the art, Modbus is a serial communication protocol for transmitting information between electronic devices. However, it should be understood and appreciated that the password protection device 300 according to the illustrated embodiment should not be construed as being limited to, for example, a MODBUS-compatible device, as it may include any suitable password protection device 300 that is communicatively coupled to the password management device 103 for enabling the password reset functionality according to the illustrated embodiment.

[0034] With respect to the password management device 103, it is preferably a portable computer device (e.g., a PC-based laptop device) that is configured and operative to act as an intermediary between the password protection device 103 and the password recovery system / server 106 (e.g., via a password recovery utility or programmable real-time unit (PRU) (240)). Figure 3As shown, the password management device 103 is configured and operable to communicatively couple to a remotely located password reset system / server 106 (e.g., a computer server) via a communication network 100. The communication network 100 preferably includes, but is not limited to, connection security such as: TLS 1.2 / HTTPS connections; LDAP / Active Directory authentication; role-based authorization (local); and Java Web Token (JWT) bearer tokens. With respect to the password reset server 106, it preferably comprises a computer network server device, preferably coupled to a secure storage / database 310, which may include, but is not limited to, a hardware security module (HSM) / trusted platform module (e.g., YubiHSM) for providing RSA private key cryptography. According to the illustrated embodiment, the server 106 is preferably a file-based SQL server (e.g., a relational database management system (RDBMS)).

[0035] As referenced below Figure 6 and 7 Further describing, according to the illustrated embodiment, the password management system 350 provides a secure process for resetting the password of the password-protected device 300, which preferably includes two stages, namely registration (600, Figure 6 ) and reset(700, Figure 7 As described herein, the registration and reset process preferably utilizes a computer device 103 (e.g., a PC-based application with a password recovery utility or PRU) to act as an intermediary between a compatible password protection device 300 and a remote password reset system / server 106 (e.g., a cloud-based password recovery system (PRS)).

[0036] In operation, in order to securely reset a password on the password-protecting device 300, certain security authentication steps are preferably performed, including authentication of the password-protecting device 300 to ensure that it is the correct device. For example, the serial number of the device 300 and a pre-shared salt may be used for this authentication. In addition, the customer / user of the password management device 103 is preferably authenticated to ensure that the correct customer / user is recovering a password. For example, a customer service center representative may authenticate the customer / user caller before approving a registration or recovery request for the password-protecting device 300. Furthermore, the aforementioned authentication by the customer service center representative may include the customer / user of the password management device 103 logging into the password reset server 106 using valid login credentials.

[0037] Now with respect to the aforementioned registration phase, in order to join the password management system 350, preferably, the password protection device 300 is first registered for use by the password management system 350. To register the password protection device 300, the user of the password management device 103 preferably communicates with the password protection device 300 via the PRU of the device 103. The user then preferably instructs the PRU of the device 103 to process the registration, after which the PRU of the device 103 preferably provides a confirmation code to the user. As described below with reference to Figure 4 and Figure 6 Further describing, registration of the device 300 includes generating a registration code 410, which preferably includes: a device type 415 identifier; a device serial number 420; a device firmware version 425; a device unique code (e.g., salt) 430; and, in some embodiments, a CRC-16 (checksum) 435. During the registration phase, the generated registration code 410 is provided to the password reset server 106, which parses and indexes the registration code 410, such as Figure 4 shown and referenced below Figure 6 6. It should be understood and appreciated that this can be accomplished in near real time if the password management device 103 is connected to the password reset server 106 via a network; otherwise, this step is performed by physically exchanging files between the password management device 103 and the password reset server 106 (e.g., via a USB memory stick). The user of the password management device 103 then preferably contacts customer service associated with the system 350 to provide the aforementioned confirmation code. After successful authentication with the customer service of the system 350, the registration of the device 300 is approved. The user of the device 103 then preferably confirms the registration using the device 103's PRU (e.g., by sending a confirmation back to the device 300). The password-protected device 300 is then registered with the password reset server 106. Note that a factory reset of the device 300 will require re-registration—this is because, upon a factory reset, the password-protected device 300 generates a unique code (e.g., a "secret salt") for secure password recovery operations. This unique code (e.g., salt) value is preferably pseudo-randomly generated. Preferably, the unique code (eg, salt) value should be securely stored on the password protection device 300 (preferably via a TPM or other similar secure storage component / process).

[0038] Regarding the aforementioned password reset phase, once the password-protected device 300 has been registered / enrolled (as briefly described above), the password reset system 350 can be enabled to reset the password of the device 300. Preferably, in order to reset the password, the target password-protected device 300 is preferably placed in recovery mode, which may require physical access to the device 300. Note that this varies depending on the device type. For example, it may include a button sequence executed on the password-protected device 300 that is less prone to accidental activation. With respect to password-protected devices 300 without physical buttons, this may involve a specific local communication sequence.

[0039] Once the password reset mode is activated in the password protection device 300, the user of the password management device 103 preferably utilizes the PRU of the password management device 103 to communicate with the password protection device 300. The user of the password management device 103 then preferably instructs the PRU of the device 103 to process the password reset request, whereupon the PRU of the device 103 provides a confirmation code to the user. As described above, it should be understood and appreciated that this can be accomplished in near real time if the password management device 103 is connected to the password reset server 106 via a network, otherwise, this step is performed by physically exchanging files between the password management device 103 and the password reset server 106 (e.g., via a USB memory stick). The user of the password management device 103 then preferably utilizes the PRU of the device 103 to confirm the restoration (sending the confirmation back to the password protection device 300). Upon receiving this confirmation, the password protection device 300 preferably resets the administrative (or other high-privileged user) password to a default or blank state.

[0040] It should be understood and appreciated that in order to enable the password reset mode for the password-protected device 300, the password-protected device 300 is preferably placed in a recovery / reset mode. The specific process of how the password-protected device 300 enters the recovery / reset mode depends on the device capabilities. For example, entering the recovery / reset mode may involve ambiguous physical device interactions (e.g., pressing two buttons simultaneously, etc.).

[0041] As referenced below Figure 5 and 7 As further described, the password reset of the device 300 by the password management device 103 includes generating a device request code 510, which preferably includes: a device type 515 identifier; a device serial number 520; a firmware version of the device 425; a request ID 530 (to prevent replay attacks); and in some embodiments, a CRC-16 (checksum) 535. Note that the device request code 510 does not include a unique identifier associated with the device 300 (e.g., a salt) (430), which is provided in the aforementioned device request code 510 for registering the password-protected device 300 with the password management system. And as will be referenced below Figure 5 and7 To further describe, once the password management device 103 (preferably via its PRU) has generated the recovery request code 510 to provide to the password reset server 106, it preferably generates a device recovery string 570 (which includes a unique identifier 576 (e.g., a salt) associated with the device 300). This device recovery string 570 is then used to generate a preferably SHA-256 hash 580 of the device recovery string 570. As described below, this hash 580 is then compared to a hash 560 of the server recovery string 550 generated by the password reset server 106 in response to receiving the aforementioned device request code 510. Note that, like the device recovery string 570, the generated server recovery string 550 includes a unique identifier 556 (e.g., a salt) associated with the device 300, and this unique identifier 556 is provided to the password reset server 106 via the received registration code 410 associated with the password-protected device 300. If hashes 560 and 580 are equal, password management device 103 (preferably via its PRU) enables password protection device 300 to reset its password without causing a device power cycle or other type of system downtime.

[0042] Having provided a brief description of the operation of certain illustrated embodiments above, and referring now to Figure 4 and 6 (and continue to refer to Figure 1-3 ), a computer-implemented process 600 for registering / enrolling a password-protecting device 300 with the password management system 350, and in particular, its password reset server 106, is now described. Beginning at step 602, the password-protecting device 300 is registered / enrolled with the password reset server 106 by first operatively connecting the password-protecting device 300 to the password management device 103 (preferably via the PRU of the device 103, as described above). The password management device 103 then retrieves the unique identifier 430 associated with the device 300 (e.g., a salt, or a password-protecting random string) to generate a registration code 410 for the password-protecting device 300, which includes metadata related to certain attributes of the password-protecting device 300 and the unique identifier 430 associated with the password-protecting device 300. Figure 4As shown in the illustrated embodiment of , in some embodiments, the metadata may include a device type 415 identifier; a device serial number 420; a firmware version of the device 425; and in some embodiments a CRC-16 (checksum) 435 (to facilitate further security). Once the registration code 410 is generated, at step 604, it is securely provided to the password reset server 106, as described above (e.g., wirelessly via the secure communication channel 100, or by physical means (e.g., a physical memory such as a USB memory key). At step 606, once the registration code 410 is entered into the password reset server 106, the password reset server 106 is operable and configured to parse the registration code 410 to identify at least the metadata (420, 422) and the unique identifier (430) associated with the password-protected device 300, respectively. Next, at step 608, the device 300 preferably stores and indexes the parsed registration code 410 in a secure database 310 associated with the password reset server 106. Figure 4 As shown, the password reset server 106 is operable and configured to store a plurality (n) of registration codes 410 for a plurality (n) of password protection devices 300. As described above, the registration / enrollment process for the password protection devices 300 may also include interaction between the user / customer of the password management device 103 and a customer service agent of the password management system 350 to preferably authenticate / verify the user / customer of the password management device 103 attempting to enroll / register the password protection device 300.

[0043] Having provided a description of the registration / enrollment process 600 according to certain illustrative embodiments above, reference is now made to Figure 5 and 7 (and continue to refer to Figure 1-3 ) provides, and now describes a computer-implemented process 700 for resetting the password of the password protection device 300 according to certain illustrative embodiments.

[0044] Beginning at step 702, when a password reset is required for a preferably registered / registered password-protected device 300 (as described above with reference to process 600) (e.g., the password of the device 300 is lost and / or inaccessible), the password-protected device 300 is then operatively connected to the password management device 103 (preferably via the PRU of the device 103, as described above), after which the password management device 103 retrieves certain metadata (e.g., device type 515, device serial number 520, firmware version 525) from the password-protected device 300 in order to generate a device request code 510 for the password-protected device 300. Figure 5As shown, the generated device request code 510 may also preferably include a request ID 530 (to prevent / mitigate replay attacks) and a checksum value 535 (for increased security). It should be understood and appreciated that the generated device request code 510 does not include the unique identifier 430 associated with the password protection device 300. Next, at step 704, the generated device request code 510 is sent from the password management device 103 to the password reset server 106, preferably via a secure communication channel 100 or via a secure storage device (e.g., a USB memory key).

[0045] At step 706, once the device request code 510 is input into the password reset server 106, the password reset server 106 is operable and configured to parse the device request code 510 to retrieve the aforementioned device 300 metadata (e.g., 515, 520, and 525) to identify matching metadata stored in the database 310 associated with the server 106, thereby identifying a matching device 300 registered / registered with the password reset server 106 via process 600. If a registered device 300 is found in the database 310, then at step 708, the password reset server 106 retrieves the unique ID (430) from the database 300 and then uses the unique ID in a server recovery string 550 generated by the password reset server 106, which preferably includes metadata for the password-protected device (e.g., device serial number 552), the aforementioned request ID 554 (included in the device request code 510), the aforementioned unique ID 556 associated with the device 300 (e.g., salt), and in some embodiments, a checksum value 558. Once the server recovery string 550 for the device request code 510 is generated, the password reset server 106 generates a hash 560 of the server recovery string 510 .

[0046] At step 710, the password management device 103 generates a device recovery string 570, which preferably includes metadata about the password-protected device (e.g., the device serial number 552), the aforementioned request ID 574 (included in the device request code 510), the aforementioned unique ID 576 associated with the device 300, and, in some embodiments, a checksum value 578. Once this device recovery string 570 is generated for the device request code 510, the password management device 103 generates a hash 580 of the device recovery string 580. Proceeding to step 712, the hash 560 of the server recovery string 550 is then provided to the password management device 103 from the password reset server 106 (preferably via a communication channel or other suitable means). Upon receiving the hash 560 of the server recovery string 550 at the password management device 103, at step 714, the device 300 is configured and operable to compare the hash 560 of the server recovery string 550 with the hash 580 of the device recovery string 570 and, if a match is determined, initiate a password reset for the device 300. Preferably, to reset the password, the target password-protected device 300 is preferably placed in recovery mode, which may require physical access to the device 300. Note that this varies depending on the device type, but typically involves a button sequence executed on the password-protected device 300 that is less prone to accidental activation. For password-protected devices 300 without physical buttons, this may involve a specific local communication sequence.

[0047] With respect to certain illustrated embodiments described above, it should be understood that the various non-limiting embodiments described herein may be used individually, in combination, or in selective combinations for specific applications. Furthermore, some of the various features of the above-described non-limiting embodiments may be used without corresponding features of other described embodiments. Therefore, the foregoing description should be considered merely illustrative of the principles, teachings, and exemplary embodiments of the present invention and not as a limitation thereof.

[0048] It should be understood that the above-described arrangements are merely illustrative of the application of the principles of the illustrated embodiments. Without departing from the scope of the illustrated embodiments, those skilled in the art may devise numerous modifications and alternative arrangements, and the appended claims are intended to cover these modifications and arrangements.

Claims

1. A computer-implemented method for enabling a secure password reset function for a password-protected device having a unique identifier, comprising: generating, from a computer device, a request code for the password-protected device, the request code including at least metadata related to certain attributes of the password-protected device, whereby the request code does not include a unique identifier; sending the request code from the computer device to a computer server located remotely from the password-protected device; receiving, in the computer device, a first hash value from the computer server, wherein the first hash value is generated in the computer server by parsing the request code to identify a cryptographically protected device registered with the computer server to generate a first hash value for a recovery string, the recovery string including at least the metadata and the retrieved unique identifier associated with the identified cryptographically protected device; generating, by the computer device, a second hash value for a second recovery string, the second recovery string including at least the metadata and a unique identifier associated with the cryptographically protected device; as well as A password reset function for the password-protected device is enabled by determining whether the first and second hash values ​​match.

2. The computer-implemented method of claim 1 , wherein: The computer device is operably coupled to the password protection device.

3. The computer-implemented method of claim 2 , further comprising: generating, in the computer device, a registration code for the password-protected device, the registration code comprising at least metadata related to certain attributes of the password-protected device and a unique identifier related to the password-protected device; sending a registration code from the computer device to the computer server; parsing the registration code in the computer server to respectively identify at least the metadata and the unique identifier associated with the password-protected device; as well as The metadata and a unique identifier associated with the password-protected device are stored in a memory associated with the computer server for use in registering the password-protected device with the computer server.

4. The computer-implemented method of claim 3, wherein: The computer device sends the request code and the registration code to a password reset computer through a communication network, and the computer server sends the first hash value to the first computer device through the communication network.

5. The computer-implemented method of claim 4, wherein: The unique identifier is a cryptographically random string of characters.

6. A computer-implemented method of enabling a secure password reset function for a password-protected device having a unique identifier, comprising: generating, in a first computer device, a registration code for the password-protected device, the registration code comprising at least metadata related to certain attributes of the password-protected device and a unique identifier associated with the password-protected device; sending a registration code from the first computer device to the computer server; parsing the registration code in the computer server to respectively identify at least the metadata and the unique identifier associated with the password-protected device; and storing metadata and a unique identifier associated with the password-protected device in a memory associated with the computer server for registering the password-protected device with the computer server; When a user initiates a password reset request for the password-protected device, generating a request code for the password-protected device in the first computer device, the request code including at least metadata related to certain attributes of the password-protected device, and whereby the request code does not include a unique identifier; sending the request code from the first computer device to a computer server located remotely from the first computer device; parsing the request code in the computer server to identify a cryptographically protected device registered with the computer server to generate a first hash value for a recovery string including at least the metadata and the retrieved unique identifier associated with the identified cryptographically protected device; generating, in the first computer device, a second hash value for a second recovery string, the second recovery string including at least the metadata and a unique identifier associated with the cryptographically protected device; sending the first hash value from the computer server to the first computer device; as well as The first and second hash values ​​are compared, whereby a password reset function for the password-protected device is enabled if the first and second hash values ​​match.

7. The computer-implemented method of claim 6, wherein: The first computer device sends the request code and the registration code to a password reset computer through a communication network, and the computer server sends the first hash value to the first computer device through the communication network.

8. A computer-implemented method for enabling a secure password reset function for a password-protected device having a unique identifier, comprising: In a first computer device operatively coupled to the password-protected device, in response to receiving a password reset request for the password-protected device, generating a request ID for the password-protected device and a request code for the password-protected device, the request code including at least the request ID and metadata associated with certain attributes of the password-protected device, whereby the request code does not include a unique identifier associated with the password-protected device; Enter the request code into the password reset computer device; parsing the input request code in the password reset computer device to identify the password-protected device associated with the request code based on metadata retrieved from the parsed request code, and retrieving a unique identifier associated with the identified password-protected device stored in a memory coupled to the password reset computer device; generating, in the password reset computer device, a first recovery string comprising at least 1) the metadata, 2) the request ID, and 3) the retrieved unique identifier associated with the identified password-protected device, and generating a first hash value for the first recovery string; generating, in the first computer device, a second recovery string comprising at least 1) the metadata, 2) the request ID, and 3) a unique identifier associated with the cryptographically protected device, and generating a second hash value for the second recovery string; inputting the first hash value into the first computer device so that the first computer device compares the first and second hash values ​​with each other; as well as Based on the compared first hash value being determined to match the second hash value, a password reset function for the password-protected device is enabled by the first computer device.

9. The computer-implemented method of claim 8, wherein: The password protection device is a circuit breaker component.

10. The computer-implemented method of claim 8, wherein: The unique identifier is a cryptographically random string of characters.

11. The computer-implemented method of claim 10, wherein: The password protection device is operable to generate the password-complaint random string as a SALT.

12. The computer-implemented method of claim 8, wherein: The request code and the recovery string each include a cyclic redundancy check (CRC) checksum.

13. The computer-implemented method of claim 8, wherein: The metadata includes information describing one or more of: 1) a serial number; 2) a device type; and 3) a firmware version associated with the password-protected device.

14. The computer-implemented method of claim 8, wherein: The first computer device is a computer device separate from the password protection device.

15. The computer-implemented method of claim 14, wherein: The first computer device is a laptop computer device.

16. The computer-implemented method of claim 8, wherein: The first computer device sends the request code to the password reset computer through an unsecured communication network.

17. The computer-implemented method of claim 16, wherein: The password reset computer device is a remotely located computer server operatively coupled to other password protected devices.

18. The computer-implemented method of claim 8, wherein: Enabling a password reset function for the password-protected device does not include changing the unique identifier of the password-protected device.

19. The computer-implemented method of claim 8, further comprising starting a timer in the first computer device when generating the request code, whereby a password reset function is not permitted upon expiration of the timer.

20. The computer-implemented method of claim 8, further comprising: generating, in the first computer device, a registration code for the password-protected device, the registration code comprising at least metadata related to certain attributes of the password-protected device and a unique identifier related to the password-protected device; Entering a registration code into the password reset computer device; parsing a registration code in a password-resetting computer device to respectively identify at least metadata and a unique identifier associated with the password-protected device; as well as The metadata and a unique identifier associated with the password protection device are stored in a memory associated with the password reset computer device for use in registering the password protection device with the password reset computer.

Images