Password Manager Key Recovery via Multi-Tier Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional password managers cannot recover encrypted data when a user forgets their master password without compromising security, as existing solutions either lower security levels or require trustworthy emergency contacts.
Innovation Solution
A method using multiple tiers of encryption and a hardware security element to derive and store encryption keys, allowing decryption of encrypted data without the master password by leveraging trusted password managers over a network for key retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional password managers use a single master password to encrypt data, then the system is simple to operate, but the user cannot recover data if they forget the master password
Solution Approach 1:
The patent divides the single master password into multiple password fragments distributed across multiple devices. These fragments can be recombined to recover the original encryption key, enabling data recovery without a single point of failure while maintaining operational simplicity through the use of multiple accessible password pieces.
Solution Approach 2:
The patent implements nested encryption where data is encrypted with a key derived from password fragments, and that key is further encrypted and stored in the cloud. This multi-layer nesting allows recovery through alternative paths (cloud storage or fragment recombination) while preserving the simplicity of the original encryption model.
2Reliability
If password managers allow cloud storage of encryption keys for recovery, then data recoverability improves, but security is compromised
Solution Approach 1:
The encryption key is segmented into multiple password fragments that are distributed both locally and to cloud storage. No single fragment contains the complete key, so even if cloud storage is compromised, attackers cannot reconstruct the full encryption key without additional fragments, thus maintaining security while enabling recovery.
Solution Approach 2:
The patent introduces password fragments as intermediaries between the user and the encryption key. These fragments can be stored in cloud storage without exposing the actual key, as they are useless alone for decryption. This intermediary mechanism enables secure cloud-based recovery without compromising the core encryption security.
3Reliability
If password managers require emergency contacts for recovery, then data recoverability improves, but trust requirements and system complexity increase
Solution Approach 1:
The patent enables users to recover their own data by recombining password fragments that they control, without requiring external emergency contacts. The system provides self-service recovery through the fragment recombination mechanism, reducing both trust requirements and system complexity while maintaining reliable data recovery.
Data Source
AI summary
An improved password manager runs on an electronic communication device. It derives an encryption key from a user master password and generates a master encryption key. The manager uses the encryption key to twice encrypt the master encryption key. It uses the mater encryption key to encrypt secret data items. The manager generates a second tier encryption key and uses it to twice encrypt the master encryption key. The encrypted data is stored. The second tier encryption key is encrypted using a hardware encryption element and shared with a trusted password manager. When the master password becomes unavailable, the manager requests the encrypted second tier encryption key is requested from the trusted manager. Once the master encryption password is recovered, it is used to decrypt the encrypted secret data items.