Automatic Credential Update for Encrypted Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In portable computing devices, encrypted file systems often retain the old password after a user updates their password with an authentication server until a manual action is taken on the device, leading to potential unauthorized access during the boot process.
Innovation Solution
A method and system for updating authentication credentials involve a client device receiving credentials from a user, generating access keys, and if they fail to decrypt storage keys, sending a request to an authentication server for a recovery key to generate an updated storage key, while the server verifies credentials and revokes or updates access keys as necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the system uses encrypted storage with password-based authentication, then security is improved, but the system fails to automatically update credentials after a password change, creating a security vulnerability
Solution Approach 1:
The system performs preliminary actions by establishing a bootstrap authentication mechanism that proactively detects password changes and initiates credential updates before the system becomes vulnerable. The authentication server monitors for password changes and automatically triggers the key update process, eliminating the need for manual user intervention.
Solution Approach 2:
The system implements a feedback loop where the authentication server communicates password change status to the client device, which then automatically updates its authentication credentials. This closed-loop feedback ensures that the system state remains synchronized with the user's current password, maintaining security without requiring manual updates.
2Reliability
If the system requires manual action to update credentials after password change, then security is maintained, but user convenience deteriorates due to additional manual steps
Solution Approach 1:
The system enables self-service by automatically detecting password changes and performing credential updates without requiring any manual action from the user. The authentication server and client device work together to autonomously refresh the authentication credentials, combining security with complete user convenience.
3Reliability
If the system implements automatic credential updates during boot process, then security is improved and user convenience is maintained, but system complexity increases
Solution Approach 1:
The authentication system is segmented into distinct functional modules: password change detection on the server, secure communication protocols, credential verification mechanisms, and key update execution on the client device. This modular segmentation manages complexity by assigning specific responsibilities to each component while maintaining overall system security.
4Ease of operation
If the system allows old password to remain in decrypted form, then ease of access is improved, but security vulnerability increases during the transition period
Solution Approach 1:
The system applies preliminary anti-action by proactively revoking the old password's authentication credentials immediately when a password change is detected, before any potential unauthorized access can occur. The authentication server prevents the old password from being used to decrypt storage, eliminating the security vulnerability while maintaining quick access with the new password.
Data Source
AI summary
A method of updating an authentication credential may include, by a client device, receiving an authentication credential from a user, generating an access key using the authentication credential, determining whether the access key decrypts a storage key that encrypts at least a portion of a computer-readable storage medium of the client device, and in response to determining that access key does not decrypt the storage key, sending a request to an authentication server. The request may include the authentication credential. The method may include receiving, from the authentication server, a recovery key, and generating an updated storage key using the decryption key.