Device Password Recovery via Encrypted PKDF Value
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key and password management systems for devices with encrypted perimeters face challenges in recovering encryption keys when passwords are lost or forgotten, especially in scenarios where plain-text passwords are not stored, rendering data inaccessible.
Innovation Solution
The method involves using a Password Key Derivation Function (PKDF) to securely generate and store an encrypted value on both the device and server, allowing for password recovery and management without storing unencrypted passwords, by using cryptographic hash iterations and public/private key pairs for secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If plain-text passwords are not stored on the device for security reasons, then data security is improved, but the ability to recover encryption keys when passwords are lost is lost
Solution Approach 1:
The system performs preliminary action by computing and storing an encrypted version of the password (encryptedPKDFValue) before the actual password is needed for recovery. This encrypted value is stored securely on the server using asymmetric encryption, so that when password recovery is needed, the system can decrypt this pre-stored value without ever having stored the plain-text password. This resolves the contradiction by preparing the recovery mechanism in advance while maintaining security during normal operation.
Solution Approach 2:
The system introduces an intermediary mechanism - the encryptedPKDFValue stored on the server - that mediates between the security requirement (no plain-text password storage) and the recovery requirement (ability to retrieve encryption keys). The server acts as a trusted intermediary that holds the encrypted credential and provides it to the device when recovery is needed, after proper authentication. This intermediary resolves the contradiction by enabling recovery without compromising security.
2Ease of operation
If passwords are stored on a server for recovery purposes, then password recovery is enabled, but security is compromised due to storing unencrypted passwords
Solution Approach 1:
Instead of storing the original plain-text password on the server, the system creates a cryptographic copy - the encryptedPKDFValue - which can be used for recovery purposes. This copy is encrypted using asymmetric encryption with the server's private key, so it cannot be used to derive the original password even if intercepted. The server stores and transmits this cryptographic copy rather than the original, enabling recovery while maintaining security.
Solution Approach 2:
The system transforms the password parameter from its original plain-text form into an encrypted derivative form (encryptedPKDFValue) before storing it on the server. This parameter transformation uses cryptographic hash functions and asymmetric encryption to create a derived value that retains the ability to reconstruct the encryption key while eliminating the security risks of storing plain-text passwords. The server stores this transformed parameter rather than the original.
3Reliability
If encryption keys are derived from passwords without storing plain-text passwords, then security is improved, but key recovery becomes technically impossible
Solution Approach 1:
The system performs preliminary action by computing the password-derived encryption key material (PKDFValue) in advance and creating an encrypted version of it (encryptedPKDFValue) that can be stored and retrieved. This pre-computed encrypted value serves as a backup that can reconstruct the encryption key when needed, preventing permanent loss of access while maintaining security during normal operation where the plain-text password is not stored.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is provided a method and apparatus for resetting a password for a device or managing the device, the device having an encryption perimeter,. A device shares a public/private key pair with a server, the public key being on the device and the private key being on the server. An intermediate value is encrypted on the mobile device using the public key. If the password is lost or the device needs to be managed, the server can request the encrypted intermediate value, decrypt it, and send the decrypted value to the mobile device which may then resume operations. A new password may be provided by the server or the user may set a new password once the encryption key is recreated from the decrypted intermediate value.