Cryptographic passcode reset
View Patent ↗This invention provides a novel method, system, and apparatus allowing an authorized user access to controlled assets when a passcode method malfunctions, such as when a user forgets a password, a token malfunction, or a biometric mismatch. The invention allows temporary access to an access control system without knowing the password and without sending the user the password or a new random password. The user is able to set a new password without knowing the previous password. Furthermore, stored encrypted data is preserved and made accessible once again via the new passcode. This invention works for many authentication methods such as restoring access when a password, token, access card, or biometric sample is used.
1. A method for creating a passcode within an access control system allowing a user access to controlled assets comprising:
obtaining a source and creating a passcode from the source, wherein the source is provided by a non-numeric input device yielding a non-numeric passcode that is converted to a numeric passcode;
generating a random code that is at least the same order of magnitude as the passcode for use as a first cryptographic recovery split;
using the passcode and the random code as inputs in a cryptographic derivation function to form a second cryptographic recovery split;
storing the first cryptographic recovery split in a first repository within the access controlled system and storing the second cryptographic recovery split in a second repository outside of the access control system.
2. The method of claim 1 , wherein the passcode is created from a token that stores the source for the passcode on a token device such as an RF chip within a fob or an access card.
3. The method of claim 1 , wherein the passcode is created from a source provided by a biometric system that associates the source of the passcode to biometric features of a person.
4. The method of claim 1 , wherein the cryptographic derivation function is a reversible algorithm such as the Exclusive-OR (“XOR”) binary Boolean algebraic operation.
5. The method of claim 1 , wherein the second cryptographic recovery split is stored in a second repository that is under the control of a custodian that is a separate entity than the user.
6. A method for creating a passcode within an access control system allowing a user access to controlled assets comprising:
obtaining a source and creating a passcode from the source;
generating a random code that is at least the same order of magnitude as the passcode for use as a first cryptographic recovery split;
using the passcode and the random code as inputs in a cryptographic derivation function to form a second cryptographic recovery split; and
storing the first cryptographic recovery split in a first repository within the access controlled system and storing the second cryptographic recovery split in a second repository outside of the access control system, wherein the second repository is under the control of a custodian that is a separate entity than the user.
7. The method of claim 6 , wherein the passcode is created from a source provided by a numerical input device yielding a numeric passcode.
8. The method of claim 6 , wherein the passcode is created from a source provided by a non-numeric input device yielding a non-numeric passcode.
9. The method of claim 8 , wherein the non-numeric passcode is converted to a numeric passcode.
10. The method of claim 6 , wherein the passcode is created from a token that stores the source on a token device such as an RF chip within a fob or an access card.
11. The method of claim 6 , wherein the passcode is created from a source provided by a biometric system that associates the source to biometric features of a person.
12. The method of claim 6 , wherein the cryptographic derivation function is a reversible algorithm such as the Exclusive-OR (“XOR”) binary Boolean algebraic operation.
13. A method for creating a passcode within an access control system allowing a user access to controlled assets comprising:
obtaining a source and creatin a passcode from the source wherein the source is provided by a non-numeric input device yielding a non-numeric passcode that is converted to a numeric passcode;
generating a random code that is at least the same order of magnitude as the passcode for use as a first cryptographic recovery split;
using the passcode and the random code as inputs in a cryptographic derivation function to form a second cryptographic recovery split; and
storing the first cryptographic recovery split in a first repository within the access controlled system and storing the second cryptographic recovery split in a second repository outside of the access control system, wherein the second repository is under the control of a custodian that is a separate entity than the user.
14. The method of claim 13 , wherein the passcode is created from a token that stores the source on a token device such as an RF chip within a fob or an access card.
15. The method of claim 13 , wherein the passcode is created from a source provided by a biometric system that associates the source to biometric features of a person.
16. The method of claim 13 , wherein the cryptographic derivation function is a reversible algorithm such as the Exclusive-OR (“XOR”) binary Boolean algebraic operation.