Temporary Password Construction via Security Question Answers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional password reset techniques are insecure, as they often use unsecured communication channels for transmitting login information, which can be intercepted, or rely on interactive prompts that can be spoofed, leading to unauthorized access.
Innovation Solution
A method that constructs a temporary password from user-provided answers to security questions, which are stored in a data store, and provides a prompt to the user indicating the composition of the temporary password, enhancing security by making intercepted information useless to bad actors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional password reset techniques transmit login information through unsecured communication channels, then the password reset process can be completed, but the security of the transmitted information is compromised and can be intercepted by bad actors
Solution Approach 1:
The patent segments the password reset process into multiple independent components: security questions, temporary password generation, and verification steps. Each component is handled separately through secure in-app communication, preventing bad actors from intercepting complete login information at any single point.
Solution Approach 2:
The system performs preliminary actions by pre-configuring security questions and temporarily restricting account access before the actual password reset occurs. This preliminary setup ensures that even if communication is intercepted during the reset process, the account remains protected until verification is complete.
2Ease of operation
If interactive prompts are used for password reset, then users can recover their accounts, but the prompts can be spoofed leading to unauthorized access
Solution Approach 1:
The patent introduces an intermediary layer between the user and the password reset process by using pre-configured security questions as a mediator. These questions serve as a trusted intermediary that verifies user identity without requiring direct interaction with potentially spoofed prompts, as the questions and answers are pre-established and verified through secure in-app communication.
Solution Approach 2:
The system implements self-service by requiring users to answer their own pre-configured security questions during the reset process. This self-service mechanism eliminates the need for external interactive prompts that could be spoofed, as the verification is performed autonomously based on pre-established credentials that only the legitimate user should know.
3Productivity
If temporary passwords are transmitted to users, then password reset can be facilitated, but the transmitted passwords can be intercepted and misused
Solution Approach 1:
The patent changes the parameters of the temporary password by making it dependent on dynamic factors such as the specific security questions asked and the context of the reset request. Rather than transmitting a static password, the system generates a temporary credential that is valid only under specific conditions (correct security question answers), rendering intercepted passwords useless without the corresponding verification parameters.
Data Source
AI summary
One embodiment provides a method, including: receiving, in an application on an information handling device, a password reset request from a user; accessing, subsequent to the receiving, a data store comprising a list of answers that are responsive to a list of security questions; constructing, using the data store, a temporary password, wherein the temporary password consists of at least one answer selected from the list of answers; and providing, to the user, a prompt containing an indication of the temporary password, wherein the prompt comprises at least one security question, from the list of security questions, that corresponds to the at least one answer. Other aspects are described and claimed.