Systems and methods for obfuscation of password key and dynamic key pool management
In accordance with embodiments of the present disclosure, an information handling system may include a processor and a non-transitory computer-readable medium having stored thereon a program of instructions executable by the processor. The program of instructions may be configured to, when read and executed by the processor, receive an initial password, the initial password comprising a string of characters to be entered by a user of the information handling system for accessing the information handling system, separate the initial password into a plurality of compartments, select a random order of the plurality of compartments, generate a key based on the initial password as rearranged in accordance with the random order of the plurality of compartments, and store a key sequence representative of the random order of the plurality of compartments.
1. An information handling system comprising:
a processor; and
a non-transitory computer-readable medium having stored thereon a program of instructions executable by the processor, the program of instructions configured to, when read and executed by the processor:
receive an initial password, the initial password comprising a string of characters to be entered by a user of the information handling system for accessing the information handling system;
separate the initial password into a plurality of compartments, each compartment comprising a plurality of characters of the string of characters;
select a random order of the plurality of compartments from a plurality of potential orders;
generate a key based on the initial password as rearranged in accordance with the random order of the plurality of compartments; and
store a key sequence representative of the random order of the plurality of compartments, wherein the key sequence includes information that specifies which of the plurality of potential orders is selected as the random order.
2. The information handling system of claim 1 , wherein generating the key comprises:
selecting a salt comprising a string of immutable data associated with the information handling system; and
using the salt to perform a hash on the initial password as reordered in accordance with the random order of the plurality of compartments to generate the key.
3. The information handling system of claim 2 , wherein the program of instructions is further configured to, when read and executed by the processor, encrypt with the key a portion of data stored within the information handling system in order to generate a message associated with the initial password.
4. The information handling system of claim 3 , wherein the program of instructions is further configured to, when read and executed by the processor, store the message associated with the initial password.
5. The information handling system of claim 3 , wherein the program of instructions is further configured to, when read and executed by the processor:
receive an attempted password string;
separate the attempted password string into a second plurality of compartments;
rearrange the second plurality of compartments in accordance with the key sequence;
use the salt to perform a hash on the attempted password string as rearranged in accordance with the key sequence to generate a second key;
encrypt with the second key the portion of data stored within the information handling system in order to generate a message associated with the attempted password string; and
grant or deny access to the information handling system based on a comparison of the message associated with the initial password with the message associated with the attempted password string.
6. The information handling system of claim 2 , wherein the program of instructions is further configured to, when read and executed by the processor, enforce a key rotation policy defining when and how to generate a new key sequence and update the key based on the generation of the new key sequence.
7. A method comprising:
receiving an initial password, the initial password comprising a string of characters to be entered by a user of an information handling system for accessing the information handling system;
separating the initial password into a plurality of compartments, each compartment comprising a plurality of characters of the string of characters;
selecting a random order of the plurality of compartments from a plurality of potential orders;
generating a key based on the initial password as rearranged in accordance with the random order of the plurality of compartments; and
storing a key sequence representative of the random order of the compartments, wherein the key sequence includes information that specifies which of the plurality of potential orders is selected as the random order.
8. The method of claim 7 , wherein generating the key comprises:
selecting a salt comprising a string of immutable data associated with the information handling system; and
using the salt to perform a hash on the initial password as reordered in accordance with the random order of the plurality of compartments to generate the key.
9. The method of claim 8 , further comprising encrypting with the key a portion of data stored within the information handling system in order to generate a message associated with the initial password.
10. The method of claim 9 , further comprising storing the message associated with the initial password.
11. The method of claim 9 , further comprising:
receiving an attempted password string;
separating the attempted password string into a second plurality of compartments;
rearranging the second plurality of compartments in accordance with the key sequence;
using the salt to perform a hash on the attempted password string as rearranged in accordance with the key sequence to generate a second key;
encrypting with the second key the portion of data stored within the information handling system in order to generate a message associated with the attempted password string; and
granting or denying access to the information handling system based on a comparison of the message associated with the initial password with the message associated with the attempted password string.
12. The method of claim 8 , further comprising enforcing a key rotation policy defining when and how to generate a new key sequence and update the key based on the generation of the new key sequence.
13. An article of manufacture comprising:
a non-transitory computer-readable medium; and
computer-executable instructions carried on the computer-readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
receive an initial password, the initial password comprising a string of characters to be entered by a user of an information handling system for accessing the information handling system;
separate the initial password into a plurality of compartments, each compartment comprising a plurality of characters of the string of characters;
select a random order of the plurality of compartments from a plurality of potential orders;
generate a key based on the initial password as rearranged in accordance with the random order of the plurality of compartments; and
store a key sequence representative of the random order of the plurality of compartments, wherein the key sequence includes information that specifies which of the plurality of potential orders is selected as the random order.
14. The article of manufacture of claim 13 , wherein generating the key comprises:
selecting a salt comprising a string of immutable data associated with the information handling system; and
using the salt to perform a hash on the initial password as reordered in accordance with the random order of the plurality of compartments to generate the key.
15. The article of manufacture of claim 14 , the instructions for further causing the processor to, when read and executed by the processor, encrypt with the key a portion of data stored within the information handling system in order to generate a message associated with the initial password.
16. The article of manufacture of claim 15 , the instructions for further causing the processor to, when read and executed by the processor, store the message associated with the initial password.
17. The article of manufacture of claim 15 , the instructions for further causing the processor to, when read and executed by the processor:
receive an attempted password string;
separate the attempted password string into a second plurality of compartments;
rearrange the second plurality of compartments in accordance with the key sequence;
use the salt to perform a hash on the attempted password string as rearranged in accordance with the key sequence to generate a second key;
encrypt with the second key the portion of data stored within the information handling system in order to generate a message associated with the attempted password string; and
grant or deny access to the information handling system based on a comparison of the message associated with the initial password with the message associated with the attempted password string.
18. The article of manufacture of claim 14 , the instructions for further causing the processor to, when read and executed by the processor, enforce a key rotation policy defining when and how to generate a new key sequence and update the key based on the generation of the new key sequence.
19. The information handling system of claim 2 , wherein the salt is selected from a plurality of potential salts, and wherein the key sequence further includes information usable to identify which of the plurality of potential salts is selected as the salt.
20. The information handling system of claim 1 , wherein the key sequence does not include the key, the initial password, or the initial password as rearranged.