Account Recovery Protocol Using Distributed Secret Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password recovery procedures introduce security vulnerabilities as they often require users to remember multiple login credentials and rely on insecure methods for account recovery, such as social authentication and simple security questions.
Innovation Solution
A system and method for account recovery protocol (ARP) that uses a password manager to generate cryptographic keys for both authentication and data encryption, distributing recovery knowledge among trusted entities using Shamir's Secret Sharing to ensure secure account access without storing the master password, thus enhancing security and privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password recovery procedures are used, then account recovery is enabled, but security vulnerabilities are introduced
Solution Approach 1:
The patent applies segmentation by dividing the master password into multiple secret shares distributed among different trusted entities (e.g., family members, friends, or security questions). Each entity holds only a portion of the recovery key, and collectively they can reconstruct the full master password for account recovery. This prevents any single entity from having complete control over the recovery process, thereby reducing security vulnerabilities while maintaining recovery capability.
2Ease of operation
If the master password is stored by the service provider, then account recovery is simplified, but user privacy and security are compromised
Solution Approach 1:
The patent extracts the master password storage function from the service provider by implementing a distributed recovery key system. Instead of the service provider storing and managing the master password, the system extracts this sensitive information and distributes it among trusted entities outside the service provider's control. This allows users to recover their accounts without the service provider needing to store or access their master passwords, thereby maintaining user privacy while simplifying the recovery process.
3Ease of operation
If simple security questions are used for account recovery, then recovery ease is improved, but security against attacks is weakened
Solution Approach 1:
The patent applies composite materials by combining multiple types of recovery mechanisms into a single robust system. Instead of relying on simple security questions alone, the system integrates distributed secret sharing, multiple trusted entities, and verifiable recovery procedures. This composite approach maintains ease of operation through a unified recovery process while significantly strengthening security against attacks by requiring collaboration from multiple entities with different types of recovery information.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
The present disclosure relates to receiving a request for recovery of an account associated with a user, sending a CAPTCHA challenge to a user device associated with the user, receiving an answer to the CAPTCHA challenge and a confirmation code wrapped by an encryption key derived from a provisional master password, sending a notification of the request for recovery to one or more trusted entities associated with the user, and receiving a confirmation of the request from one or more of the trusted entities. The confirmation includes a recovery token associated with the particular trusted entity and an encrypted confirmation code.