Automatic recovery of forgotten passwords

• US 6,360,322 B1
• Filed: 09/28/1998
• Issued: 03/19/2002
• Est. Priority Date: 09/28/1998
• Status: Expired due to Term

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Grawrock, David
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/162,102
• Time in Patent Office: 1,268 Days
• Field of Search: 380/255, 380/277, 380/283, 713/155, 713/168, 713/170, 713/171, 713/176, 713/180, 713/182
• US Class Current: 713/176
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords

Abstract

In accordance with the invention a method of securely and automatically authenticating a user is disclosed. Bona fides are entered for a user, hashed, and stored at an authenticating entity, remote from the user'"'"'s computer. When a user forgets his/her password, the user enters his/her bona fides, which are again hashed on the user'"'"'s system, and then securely transmitted to the authenticating entity. The authenticating entity compares the received, hashed bona fides to those previously stored at the authenticating entity. If the comparison shows that the values match or otherwise appropriately correlate, the user will be authenticated. The user will then be provided with the means to access his/her encrypted data. In other words, once authenticated the authenticating entity will automatically provide the user and/or the user'"'"'s computer with an access key, in one embodiment, allowing the user to access his/her encrypted data.

Claims

1. A method of granting a user access to encrypted data stored on a user'"'"'s computer, said user and said user'"'"'s computer remote from an authenticating entity, comprising the steps of:

automatically authenticating said user by an authenticating computer at said authenticating entity;

upon authentication, automatically providing an access key to said authenticated user, enabling said user to access said encrypted data stored on said user'"'"'s computer.

2. The method of clam 1, wherein the step of automatically authenticating a user, comprises the steps of:

storing user-identifying information in said authenticating computer, resulting in stored user-identifying information;

receiving, by said authenticating computer from said user, second user-identifying information; and

comparing, by said authenticating computer, said second user-identifying information to said stored user-identifying information, wherein if said second user-identifying information correlates to said stored user-identifying information said user is authenticated.

3. The method of claim 2, wherein said user-identifying information includes a hashed bona fide.

4. A method of authenticating a user, comprising the steps of:

storing a bona-fide hash at an authenticating entity remote from said user, resulting in a stored bona-fide hash;

receiving, by said authenticating entity, a second bona fide hash from said user;

comparing, by said authenticating entity, said second bona-fide hash with said stored bona-fide hash; and

providing, by said authenticating entity, an access key for enabling said user to access encrypted data stored on said user'"'"'s computer if said second bona-fide hash correlates to said stored bona-fide hash, wherein said user'"'"'s computer is remote from said authenticating entity.

5. The method of claim 4, wherein said steps of receiving, comparing, and providing occur without human intervention at said authenticating entity.

6. The method of claim 4, wherein said step of storing farther includes protecting said bona fide hash with at least a digital signature.

7. The method of claim 4, wherein said step of receiving includes receivingsaid second bona fide hash from secure channel, wherein said secure channel includes encryption of said second bona fide hash.

8. A method of authenticating a user, comprising the steps of:

(a) receiving, by a user'"'"'s computer, a set of bona fides from said user;

(b) hashing, by said user'"'"'s computer, said set of bona fides resulting in a set of bona-fides hashes;

(c) securely communicating said set of bona-fides hashes to an authenticating entity remote from said user'"'"'s computer;

(d) storing said set of bona-fides hashes at said authenticating entity resulting in a stored set of bona-fides hashes;

(e) receiving, by said user'"'"'s computer, at least a subset of said set of bona fides said user;

(f) hashing, by said user'"'"'s computer, said subset of bona fides resulting in a second set of bona-fides hashes;

(g) securely communicating said second set of bona-fides hashes to said authenticating entity;

(h) comparing, by said authenticating entity, said second set of bona-fides hashes with said stored set of bona-fides hashes, wherein if said second set of bona-fides hashes correlates to said stored set of bona-fides hashes the user is authenticated; and

(i) if said user is authenticated, communicating, by said authenticating entity to said user'"'"'s computer, an access key to allow said user to access encrypted data on said user'"'"'s computer.

9. The method of claim 8, wherein said step of storing includes protecting said set of bona fides hashes by at least digitally signing said set of bona fides hashes.

10. The method of claim 8, wherein said steps (h) and (i) occur without human intervention at said authenticating entity.

11. A system for granting a user access to encrypted data stored on a user'"'"'s computer when the user has forgotten his/her password, comprising:

a hash unit, located at said user'"'"'s computer and having an input for receiving a user bona fide and having an output for carrying a bona fide hash;

a storage record located at an authenticating entity, said storage record including a stored bona fides hash, said authenticating entity remote from said user'"'"'s computer and couplable to said user'"'"'s computer with a secure channel;

a comparison unit, located at said authenticating entity, said comparison unit having a first input coupled to receive said bona fides hash from said secure channel, having a second input coupled to receive said stored bona fides hash, and having an output for carrying a signal indicative of whether the user has been authenticated; and

an access key provider, located at said authenticating entity and activated by said comparison unit output, said user gaining access to said encrypted data upon receipt of an access key from said access key provider.

12. A system for granting a user access to encrypted data stored on a user'"'"'s computer when the user has forgotten his/her password, comprising:

an authenticating entity remotely located from said user'"'"'s computer, said authenticating entity comprising;

means for automatically and securely authenticating said user using user bona fides; and

means for automatically providing a user access to his/her encrypted data.