Transformable Password Generation Using Encryption Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users with multiple online accounts often reuse passwords, making it easier for compromised passwords to grant unauthorized access to multiple accounts if security is breached, as third-party services can access and misuse login information.
Innovation Solution
A computer-implemented method using encryption keys to generate and manage transformed passwords, where a user's original password is encrypted with a third-party-associated key, allowing secure access while invalidating passwords upon security breaches to protect the original password.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users reuse the same password for multiple online accounts, then it is easier to remember and manage accounts, but security is compromised because a single stolen password can access multiple accounts
Solution Approach 1:
The patent applies segmentation by dividing the password into two parts: a master password that the user remembers and per-account encryption keys that are unique to each service. This allows users to use a single memorable password while maintaining security through unique cryptographic keys for each account, preventing cross-account access if one key is compromised.
Solution Approach 2:
The patent introduces an intermediary system (the password management service) that handles the cryptographic operations between the user's master password and the per-account encryption keys. This intermediary generates and manages the unique keys for each service, allowing users to maintain ease of use while the system ensures security through key isolation.
2Adaptability or versatility
If third-party services access user account information using shared passwords, then service integration is simplified, but security is weakened because compromised third-party services can access user accounts
Solution Approach 1:
The patent segments access control by assigning unique encryption keys to each third-party service rather than using a shared password. This allows multiple services to integrate with user accounts while maintaining security isolation, so that a breach in one service cannot compromise other services or the user's master password.
Solution Approach 2:
The patent changes the parameter from a static shared password to dynamic per-service encryption keys that are generated and managedcryptographically. This parameter change allows the system to maintain versatility for multiple services while improving security through unique cryptographic parameters for each service integration.
3Ease of manufacture
If encryption keys are stored at the host server, then password verification is simplified, but security is reduced because the server becomes a target for attacks
Solution Approach 1:
The patent extracts the encryption keys from the host server and places them in the memory of computing devices (clients) instead. This extraction removes the harmful concentration of cryptographic material at the server, simplifying security architecture while maintaining ease of verification through local key storage in user devices.
Solution Approach 2:
The patent employs disposable or short-lived encryption keys that are generated for each service and stored temporarily in user device memory rather than permanently at the server. This approach reduces the impact of potential server compromises and simplifies security management by using transient, non-persistent key storage.
Data Source
AI summary
The invention relates to generating and using secure transformable passwords. In one example, a user grants a third party access to an online account at a host server, and the user requests a transformed password from the host server. The host server associates an encryption key with the third party and generates a transformed password using the user's online account password and the encryption key. The user transmits the transformed password to the third party which may use the transformed password to access the online account. The host server generates a second transformed password and compares it to the password information received from the third party. If the received password information and the second transformed password are identical, access is granted. The invention also includes methods for invalidating the transformed passwords by changing the encryption keys to an invalid state.