Ephemeral Entropy for Secure Logon Resumption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems require user credentials for access to resources during system reboots, which can be inconvenient and insecure, as they necessitate manual re-entry of credentials.
Innovation Solution
A method where a user device generates ephemeral entropy to encrypt and decrypt a data protection key, allowing access to user resources without requiring the actual user credential during reboots, by storing the ephemeral entropy in a secure location and using it to reestablish access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user credentials are required during system reboot for resource access, then security is maintained, but user convenience deteriorates due to manual re-entry requirement
Solution Approach 1:
The system performs preliminary actions by generating ephemeral entropy and encrypting the data protection key with this entropy before the reboot occurs. The encrypted key is stored in a secure location, so that upon reboot, the system can automatically decrypt and use the key without requiring manual credential entry, thus maintaining security while improving convenience.
2Ease of operation
If ephemeral entropy is generated and stored to enable automatic access, then ease of operation improves, but device complexity increases
Solution Approach 1:
The system introduces ephemeral entropy as an intermediary element between the user credential and the data protection key. Instead of directly storing or requiring the user credential, the system uses the ephemeral entropy to encrypt and store the data protection key, creating a middle layer that enables automatic access while managing complexity through controlled entropy generation and secure storage mechanisms.
3Reliability
If credential-protected key is decrypted and reencrypted with ephemeral entropy, then access security is maintained, but loss of time occurs during the reencryption process
Solution Approach 1:
The system performs the decryption and reencryption operation as a preliminary action before the reboot occurs. By completing the key transformation in advance and storing the entropy-protected key in a secure location, the system avoids the need to perform time-consuming cryptographic operations during the reboot process, thus maintaining security while minimizing time loss.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one embodiment, a user device may reestablish access to a user resource while forgoing use of a user credential during a system reboot. The user device may receive the user credential from a user during an initial login to access the user resource. The user device may create an ephemeral entropy to access the user resource. The user device may access the user resource using the ephemeral entropy.