Remote Password Reset for Encrypted Data via Key Recovery Agent
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to remotely reset a password used to protect encrypted data on a device without rendering the encrypted content inaccessible, as the content protection key cannot be recovered without the existing user password.
Innovation Solution
A method and system that allows remote password resetting by generating a private key and calculating a public key using elliptic curve cryptography, storing and transmitting encrypted versions of the content protection key, and enabling recovery through a blinded public key protocol, ensuring access to encrypted data even if the original password is forgotten.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the content protection key is protected by or derived from the existing user password, then data security is improved, but the ability to recover access when the password is forgotten deteriorates
Solution Approach 1:
The patent introduces a key recovery agent as an intermediary between the user's device and the password protection mechanism. This agent stores a cryptographic component (hash or encrypted portion) that can be combined with a newly set password to recover the content protection key, enabling password recovery without compromising the original security model
Solution Approach 2:
The content protection key is segmented into multiple components: one portion is derived from the user's password, while another portion is stored securely by a key recovery agent. This segmentation allows the system to reconstruct the full key through a controlled process involving both components, resolving the contradiction between security and recoverability
2Ease of operation
If a remote password reset is implemented, then password recovery ease is improved, but the risk of unauthorized access increases
Solution Approach 1:
The system implements a feedback mechanism where the key recovery agent verifies device identity and authentication credentials before releasing any key recovery information. This feedback loop ensures that only authorized devices can initiate password recovery, mitigating unauthorized access risks while enabling remote reset functionality
Solution Approach 2:
The key recovery agent performs preliminary verification of the device's identity and authorization status before allowing any password reset operation. This preliminary action prevents unauthorized access attempts from proceeding, while still enabling legitimate remote password recovery
Data Source
AI summary
Data is secured on a device in communication with a remote location using a password and content protection key. The device stores data encrypted using a content protection key, which itself may be stored in encrypted form using the password and a key encryption key. The remote location receives a public key from the device. The remote location uses the public key and a stored private key to generate a further public key. The further public key is sent to the device. The device uses the further public key to generate a key encryption key, which is then used to decrypt the encrypted content protection key. A new content encryption key may then be created.