Network Device Password Retrieval Using Token-Based Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users often lose access to secured data due to forgotten passwords, as conventional password retrieval methods involve passing the actual password, increasing security risks and attack vectors.
Innovation Solution
A system and method that stores a master password in two encrypted files on a network device, using a first password for one file and a second password (token) for the other, allowing retrieval of the master password via a registration server when the first password is forgotten, without exposing the master password itself.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the master password is stored in encrypted form and passed to the server for retrieval, then password recovery is enabled, but the actual password must be transmitted which increases security risks and attack vectors
Solution Approach 1:
The patent extracts the essential function of password retrieval by removing the actual password from the transmission process. Instead of transmitting the password itself, only a token and encrypted password hash are sent to the server, separating the authentication credential from the recovery mechanism.
Solution Approach 2:
The patent introduces a token as an intermediary element that replaces the actual password in the recovery process. The token serves as a placeholder that enables password retrieval without exposing the master password, acting as a mediator between the user and the password storage system.
2Ease of operation
If a single password is used for access, then ease of use is improved, but if forgotten, access is lost forever
Solution Approach 1:
The patent implements preliminary action by pre-configuring a recovery mechanism with the token and encrypted password hash before the password is forgotten. The server is pre-populated with the necessary credentials to restore access, enabling recovery without requiring the user to remember the password.
Solution Approach 2:
The patent changes the parameter of password storage from plaintext to encrypted hash form, and introduces a token as a separate recovery parameter. This transformation allows the system to maintain both security and recoverability by operating in different parameter spaces for authentication and recovery.
3Ease of operation
If the master password is stored in plaintext for easy retrieval, then recovery is simple, but security is compromised
Solution Approach 1:
The patent creates a cryptographic copy of the password in the form of a hash that can be stored and transmitted without containing the actual password. This copy enables verification and recovery operations while maintaining the security of the original password, allowing retrieval without exposure.
Data Source
AI summary
A method for managing a master password on a network device, the method stored as a set of instructions executable by a computer processor to: store the master password in a first file in a memory of the network device; store the master password in a second file in the memory of the network device; encrypt access to the first file using a first password; encrypt access to the second file using a second password; send the second password and an identifier associated with the network device over a communications network to a registration server, the registration server configured for storing the second password for subsequent retrieval by the network device; when the first password is unavailable, send a password retrieval request including the identifier; receive the second password configured as a one-time use password; decrypt access to the second file to retrieve the master password; and, initiate a reset process for subsequent storage of the master password in the memory of the network device.