Remote Password Reset via Key Encryption Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password reset methods for encrypted data on communication devices are ineffective when the user forgets their password, as the content protection key becomes inaccessible without the original password, rendering encrypted data inaccessible.
Innovation Solution
A method and system for remotely resetting a password used to protect a content protection key by generating and using key encryption keys, allowing access to encrypted data even if the original password is forgotten, involving steps like generating private and public keys, encrypting the content protection key, and transmitting public keys to recover the key encryption key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the content protection key is protected by or derived from the existing user password, then data security is improved, but the data becomes inaccessible when the user forgets the password
Solution Approach 1:
The patent segments the key protection mechanism into two independent encryption layers: (1) encryption of the content protection key with a key encryption key, and (2) encryption of the key encryption key with the user password. This segmentation allows the content protection key to be recovered through the key encryption key path even when the password is forgotten, while maintaining password-based security protection.
Solution Approach 2:
The patent introduces a key encryption key as an intermediary between the content protection key and the user password. This intermediary key enables indirect access to the content protection key through public key infrastructure, allowing password-less recovery paths while maintaining the original password-based security model.
2Ease of operation
If a remote password reset is implemented, then password recovery is improved, but the content protection key becomes unrecoverable without the existing password
Solution Approach 1:
The patent performs preliminary encryption of the content protection key with the key encryption key before password reset operations. This preliminary action ensures that the content protection key is already protected by an independent encryption mechanism that does not depend on the user password, enabling safe remote password resets while preserving key recoverability through the key encryption key.
Solution Approach 2:
The key encryption key serves as an intermediary that decouples the content protection key from the user password dependency. This allows remote systems to reset passwords without affecting the recoverability of the content protection key through the key encryption key mechanism.
3Device complexity
If the content protection key is encrypted only with the user password, then the encryption process is simple, but the system lacks flexibility for key recovery
Solution Approach 1:
The patent divides the encryption process into two distinct segmentation stages: first encrypting the content protection key with the key encryption key, then encrypting the key encryption key with the user password. This segmentation provides both a simple symmetric encryption path and a flexible asymmetric key recovery path, balancing complexity and versatility.
Solution Approach 2:
The dual-encryption structure provides multi-functionality: it supports standard password-based access, password-less recovery through key encryption key, remote password resets, and secure key distribution. This universal approach handles multiple operational scenarios without requiring separate systems.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for securing data and resetting a password using a content protection key is provided, in which the content protection key itself is protected by a password. A content protection key is also protected at a data storage device with a key encryption key generated in collaboration with an additional device such as a server. The server stores a private key required to regenerate the key encryption key, but this private key is not provided from the server to the data storage device; rather, a public key derived from the private key is provided by the server. The data storage device combines the received public key and a further private key to derive the key encryption key; the further private key itself is not stored by the data storage device, but rather its matching public key is stored. The content protection key is then encrypted using a password and the derived key encryption key. If the password is lost, data from the server and from the data storage device may be combined to recreate the key encryption key.