Secure Password Reset Using Asymmetric Key Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Resetting passwords in an enterprise computing environment co-existing with a secure environment is problematic due to users choosing easily memorable passwords, which can be easily derived by others, and administrative resets that compromise security by revealing passwords to administrators.
Innovation Solution
A computer-implemented method using a security card to obtain and manage public and private keys for asymmetric encryption, allowing users to securely reset passwords by uploading certificates to a secure domain, updating user accounts, and generating and encrypting new passwords within the secure domain for secure transfer and decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users choose easily memorable passwords, then ease of operation is improved, but security is worsened
Solution Approach 1:
A security card acts as an intermediary device that stores cryptographic key pairs. The card enables users to authenticate and reset passwords without needing to remember complex passwords, while the private key stored on the card provides strong security. This mediator resolves the contradiction by separating memory burden from security function.
Solution Approach 2:
The patent replaces the mechanical/password-based authentication system with a cryptographic system using public-private key pairs stored on a security card. This substitution eliminates the need for users to remember passwords while maintaining or enhancing security through cryptographic principles.
2Ease of operation
If administrative personnel manually reset passwords, then password reset capability is provided, but security is worsened due to password exposure
Solution Approach 1:
The system introduces an automated password reset service as an intermediary between users and the authentication system. This service uses the user's security card and public key infrastructure to automatically generate and deliver new passwords without requiring administrative personnel to handle or know the passwords, eliminating the security risk of password exposure to admins.
Solution Approach 2:
Users can independently initiate and complete password reset operations using their security cards. The automated service processes the reset request without human administrative intervention, allowing users to serve themselves while preventing password exposure to administrators.
3Extent of automation
If federated authentication is implemented, then automated password reset is achieved, but device complexity is worsened
Solution Approach 1:
The security card serves multiple functions: it stores user credentials, holds private keys for cryptographic operations, and enables both authentication and password reset operations. This multi-functionality reduces the need for separate systems for each function, thereby reducing overall system complexity while maintaining automation.
Data Source
AI summary
A computer implemented method is used for changing a password in a multi-domain environment. The method includes obtaining a private key and a public key from a security card at a user device in a user domain, transferring the public key to a controller in a secure domain, requesting a password change, receiving a public key encrypted new password from the secure domain, and decrypting the new password using the private key.