Device Key Management via Server-Side Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices with encrypted perimeters face challenges in password recovery and management, particularly when passwords are lost or forgotten, as they cannot recreate the encryption key without the password, leading to inaccessible encrypted data.
Innovation Solution
A method involving a public/private key pair where the public key is stored on the device and the private key is stored on the server, using a Password Key Derivation Function (PKDF) to derive an encryption key, encrypting the PKDF value with the public key, and sending it to the server for decryption to recover the encryption key, ensuring secure storage and retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the password is stored on the device for easy retrieval, then the ease of operation is improved, but the security is worsened due to the risk of unauthorized access
Solution Approach 1:
The patent extracts the password from the device and stores it on a remote server instead. The device only retains the encrypted password hash, which cannot be used to derive the encryption key without the original password. This separation removes the security risk of storing passwords on the device while maintaining the ability to retrieve them through secure server-based authentication.
Solution Approach 2:
The patent introduces a secure server as an intermediary between the user and the encrypted data. The server stores the password securely and provides authenticated access to the device, eliminating the need for the device to store the password locally. This intermediary enables secure password management without compromising device security.
2Object-affected harmful factors
If the plain-text password is not stored on the device for security reasons, then the security is improved, but the ability to recover data when password is lost is worsened
Solution Approach 1:
The patent performs preliminary action by establishing a secure communication channel and transmitting the encrypted password to a server before any data encryption occurs. This pre-configuration enables future password recovery without requiring the device to store the plain-text password, thus maintaining both security and reliability.
Solution Approach 2:
The patent implements a feedback mechanism where the server stores the encrypted password and can provide authenticated access back to the device when needed. This feedback loop enables password recovery scenarios while maintaining the security principle of not storing plain-text passwords on the device.
3Object-affected harmful factors
If a secure channel is established with the server for password transmission, then the security is improved, but the device complexity is worsened due to additional cryptographic operations
Solution Approach 1:
The patent segments the cryptographic operations between the device and the server. The device performs only the initial encryption of the password and stores it locally, while the server handles the secure storage and authenticated decryption operations. This segmentation reduces device complexity while maintaining security through distributed cryptographic processing.
Data Source
AI summary
There is provided a method and apparatus for resetting a password for a device or managing the device, the device having an encryption perimeter. A device shares a public/private key pair with a server, the public key being on the device and the private key being on the server. An intermediate value is encrypted on the mobile device using the public key. If the password is lost or the device needs to be managed, the server can request the encrypted intermediate value, decrypt it, and send the decrypted value to the mobile device which may then resume operations. A new password may be provided by the server or the user may set a new password once the encryption key is recreated from the decrypted intermediate value.