Offline Password Reset Using Signed Device-User Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password reset methods for password-protected devices are insecure, especially in environments with strict security policies, and often require Internet access, which may not be available or permitted.
Innovation Solution
A method involving a server that generates a temporary password signed with cryptographic techniques using unique device and user information, allowing verification by the device without Internet access, and optionally requiring physical proximity or time-limited additional information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a hard-coded recovery mechanism is implemented on the product device, then password reset capability is provided, but security is compromised as it can be discovered by non-permitted users
Solution Approach 1:
The patent introduces a server as an intermediary between the user and the product device for password reset operations. The server generates and sends recovery codes to authorized users, who then use these codes to reset passwords on the device. This intermediary approach maintains security by not hard-coding recovery mechanisms on the device itself, while still providing password reset capability.
2Ease of operation
If a backdoor is provided for password reset, then password recovery is enabled, but security policy compliance is violated and vulnerability to misuse increases
Solution Approach 1:
The server acts as a compliant intermediary that implements password recovery according to security policies. Instead of providing a backdoor on the device, the system uses a centralized service that can generate and manage recovery codes securely, ensuring policy compliance while enabling password recovery for authorized users.
Solution Approach 2:
The system performs preliminary actions by pre-generating and securely distributing recovery codes to authorized users before password loss occurs. This allows users to have recovery capability without requiring backdoors or compromising security policies, as the recovery mechanism is established in advance through proper authorization channels.
3Reliability
If the product device is disconnected from the Internet, then security policy compliance is improved, but Internet-based reset mechanisms become unhelpful
Solution Approach 1:
The system performs preliminary actions by generating and sending recovery codes to users before the device needs to be reset. Users can obtain these codes through Internet connection at any convenient time, then use them offline to reset passwords on disconnected devices. This eliminates the need for continuous Internet connectivity during the reset process while maintaining security policy compliance.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
Enables secure password reset without Internet access, maintaining device functionality, and preventing unauthorized access by ensuring the user's physical presence and using time-limited data.
Implementation Method 1
generating a temporary password that uses information that is unique for each of the product device and the user and is signed using a cryptographic technique
Data Source
AI summary
A method of resetting a password used for accessing a product device is provided, including receiving a password reset request from a user to reset a password for accessing the product device, the user having a prior registration to access the product device, generating a temporary password that uses information that is unique for each of the product device and the user and is signed using a cryptographic technique, and providing the signed password to the user for submission to and verification by the product device. The product device is configured to verify the signed temporary password using the cryptographic technique and using information that is unique for each of the product device and the user and that is known to the product device, and to allow the user access to the product device pending verification.