Secure Credential Recovery via Server-Mediated Key Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users often face difficulties in recovering security credentials, such as passwords or PINs, which can lead to unrecoverable access to data and functionality on computing devices, especially when these credentials are forgotten.
Innovation Solution
A method and system that encrypts security credentials using a first encryption key from a server, generates and communicates a first decryption key and a second encryption key to the user, decrypts the credential, communicates it to the user, and re-encrypts it using the second key, allowing for secure recovery and potential changes to the credential.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security credentials are stored locally on the computing device, then access control and security are improved, but recovery of forgotten credentials becomes difficult or impossible
Solution Approach 1:
A server acts as an intermediary between the computing device and the user for credential recovery. The server stores encrypted credentials and provides decryption keys to authorized users, enabling recovery without compromising local storage security. The server mediates the recovery process by verifying user identity and securely delivering decryption keys.
Solution Approach 2:
The credential storage system is segmented into multiple components: local encrypted storage on the computing device, server-side key management, and separate decryption key storage. This segmentation allows the credential to remain securely stored locally while enabling external recovery through the server infrastructure.
2Reliability
If security credentials are not stored elsewhere (local-only storage), then security protection is improved, but accessibility and recovery options are reduced
Solution Approach 1:
The system performs preliminary actions by pre-configuring multiple encrypted copies of credentials in different locations (local device storage and server storage) before any loss occurs. Decryption keys are also pre-configured and stored securely on the server, ready for immediate deployment when recovery is needed.
Solution Approach 2:
Different locations have different qualities and purposes: local storage provides secure, fast access with full encryption control, while server storage provides backup and recovery capabilities. Each location is optimized for its specific function, with the server holding encrypted copies and decryption keys while the local device holds the primary credential for active use.
3Reliability
If credentials are encrypted and stored securely, then security is improved, but access complexity and operational difficulty increase
Solution Approach 1:
The system enables self-service credential recovery by allowing users to autonomously retrieve their decryption keys from the server through authenticated requests. Users can recover their own credentials without requiring administrative intervention, maintaining security while simplifying the recovery process.
Data Source
AI summary
A system and method for recovering a security credential is provided. A security credential stored in the storage of a computing device is encrypted using a first encryption key generated by a server. A first decryption key for decrypting the security credential and a second encryption key for re-encrypting the security credential are received. The first decryption key and the second encryption key are generated by the server. The security credential is decrypted using the first decryption key. The security credential is communicated to a user of the computing device. The security credential is re-encrypted in the storage of the computing device using the second encryption key.