Secure Remote Device Credential Reset via Trusted Service
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for remotely modifying user device credentials, such as passwords or PIN codes on mobile devices, often compromise security by making devices vulnerable during the reset process or reduce security by providing multiple access points, lacking robust authentication mechanisms to ensure the credentials have not been stolen or hacked.
Innovation Solution
A computer-implemented method that enables secure remote modification of user device credentials by generating new credentials on the device itself, based on merged policies from multiple management sources, with additional authentication factors required for access, and optionally seeding the credentials with a trusted service, ensuring security without disclosing the new or old credentials to administrators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If IT administrators remotely clear passwords from devices to grant user access, then users can regain access to their devices, but the device and data become vulnerable during the password reset period
Solution Approach 1:
The system generates a new credential and provides it to the user before the old credential is cleared from the device. This preliminary provision of the new credential ensures the user has access information in advance, while the old credential remains active on the device to maintain security until the controlled reset time.
Solution Approach 2:
A trusted service acts as an intermediary between the user and the device credential system. The trusted service securely manages the credential reset process, generating new credentials, coordinating with the device to clear old credentials at the appropriate time, and ensuring security policies are met without exposing credentials to administrators.
2Ease of operation
If a recovery key is pre-set on a mobile device to provide user access, then users can regain access, but the security of the device is reduced because two passwords are available
Solution Approach 1:
The system extracts the credential provisioning function from the traditional recovery key model. Instead of pre-setting a static recovery key on the device, the system dynamically generates credentials through a trusted service and securely delivers them to the user, eliminating the need for multiple stored credentials on the device itself.
Solution Approach 2:
The user receives the new credential directly from the trusted service without administrator intervention. The system enables self-service credential reset where the user can obtain their new credential independently, and the device automatically clears the old credential at the coordinated time without requiring the user to manually remove it.
3Reliability
If additional authentication factors are required to ensure recovery key validity, then security is enhanced, but the authentication process becomes more complex
Solution Approach 1:
The system performs preliminary authentication verification through the trusted service before the credential reset process begins. The trusted service validates the user's identity and ensures security policies are met in advance, so that when the actual credential reset occurs, additional authentication steps are minimized or already completed.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
Methods, systems, and computer program products are provided that enable secure remote modification of device credentials using device-generated credentials. A plurality of credentials policies is stored by the user device. The credentials policies are merged to generate a merged credentials policy. An instruction is received by the user device from a trusted service to initiate a device credentials change. A new device credentials is generated on the user device based at least on the merged credentials policy.