Decentralized password vault

1. A method for securing passwords, the method comprising:

obtaining, by an authentication service, a plurality of public keys, each public key of the plurality of public keys associated with one of a plurality of devices associated with a user;

generating, by the authentication service, a password for the user;

sending, by the authentication service, the password to a password management entity;

encrypting, by the authentication service, the password with each of the public keys, thus generating a plurality of encrypted passwords, each encrypted password of the plurality of encrypted passwords encrypted with one of the public keys and associated with a device of the plurality of devices; and

deleting the password by the authentication service.

2. The method of claim 1 , comprising:

obtaining, at the authentication service from a first device, a request to log in the user to the first device; and

sending to the first device, by the authentication service, the encrypted password associated with the first device.

3. The method of claim 2 , comprising:

obtaining, at the first device, the encrypted password associated with the first device;

decrypting, at the first device, the encrypted password using a private key associated with the public key of the first device, to obtain the decrypted password; and

using, by the first device, the decrypted password to perform the login.

4. The method of claim 3 , comprising:

sending, by the authentication service, the password to a password management entity;

verifying, by the password management entity, the local device using the password obtained from the authentication service; and

allowing the login, by the password management entity, only if the decrypted password is verified.

5. The method of claim 1 , comprising:

prior to sending the encrypted password associated with the first device, sending, by the authentication service, to a second device associated with the user, a request to identify the user; and

obtaining verification of the identity from the second device.

6. The method of claim 1 , comprising:

obtaining, at the authentication service, a request to associate with the user a third device that is not one of the plurality of devices, and a public key of the third device;

generating, by the authentication service, a new password for the user;

sending, by the authentication service, the new password to the password management entity;

encrypting, by the authentication service, the new password with each of the public keys and with the public key of the third device, thus generating a plurality of new encrypted passwords, each associated with a device of the plurality of devices and with the new device; and

deleting the new password by the authentication service.

7. The method of claim 1 , comprising:

obtaining, at the authentication service, a request to change the password of the user;

generating, by the authentication service, a new password for the user;

sending, by the authentication service, the new password to the password management entity;

encrypting, by the authentication service, the new password with each of the public keys, thus generating a plurality of new encrypted passwords, each associated with a device of the plurality of devices; and

deleting the password by the authentication service.

8. The method of claim 1 , comprising:

in a preparation stage, sending, to a second device associated with the user, by the authentication service, the encrypted password associated with the first device;

performing a login to the first device when the authentication service is off-line by:

sending from the first device to the second device a request to login the user to the first device;

verifying the identity of the user by the second device;

following a successful identification of the user, sending the encrypted password associated with the first device from the second device to the first device;

decrypting, at the first device, the encrypted password using a private key associated with the public key of the first device, to obtain the decrypted password; and

using the decrypted password to perform the login.

9. The method of claim 1 , comprising:

in a preparation stage, sending, to a second device associated with the user, by the authentication service, the encrypted password associated with the second device and the public key of the first device;

performing a login to the first device when the authentication service is off-line by:

sending from the first device to the second device a request to log in the user to the first device;

verifying the identity of the user by the second device;

following a successful identification of the user:

decrypting, by the second device, the encrypted password associated with the second device to obtain a clear password;

encrypting, by the second device, the clear password with the public key of the first device to obtain the encrypted password associated with the first device;

sending the encrypted password associated with the first device from the second device to the first device;

decrypting, at the first device, the encrypted password using a private key associated with the public key of the first device, to obtain the decrypted password; and

using the decrypted password to perform the login.

10. The method of claim 1 , comprising:

in a preparation stage, sending, to a second device associated with the user, by the authentication service, the encrypted password associated with the second device;

performing a login to the first device when the authentication service is off-line by:

decrypting, by the second device the encrypted password associated with the second device;

verifying the identity of the user by the second device;

following a successful identification of the user, presenting the decrypted password to the user;

obtaining, at the first device, the decrypted password from the user; and

using the decrypted password to perform the login.

11. A system for securing passwords, the system comprising:

a memory; and

a processor configured to:

obtain a plurality of public keys, each public key of the plurality of public keys associated with one of a plurality of devices associated with a user;

generate a password for the user;

send the password to a password management entity;

encrypt the password with each of the public keys, thus generating a plurality of encrypted passwords, each encrypted password of the plurality of encrypted passwords encrypted with one of the public keys and associated with a device of the plurality of devices; and

delete the password.

12. The system of claim 11 , comprising:

a first device;

wherein the processor is configured to:

obtain from the first device, a request to log in the user to the first device; and

send to the first device the encrypted password associated with the first device.

13. The system of claim 12 , wherein the first device is configured to:

obtain the encrypted password associated with the first device;

decrypt the encrypted password using a private key associated with the public key of the first device, to obtain the decrypted password; and

use the decrypted password to perform the login.

14. The system of claim 13 , comprising:

a password management entity;

wherein the processor is configured to send the password to the password management entity;

wherein the password management entity is configured to:

verify the local device using the password obtained from the processor; and

allow the login only if the decrypted password is verified.

15. The system of claim 11 , comprising:

a second device;

wherein the processor is configured to:

prior to sending the encrypted password associated with the first device, send to a second device associated with the user, a request to identify the user; and

obtain verification of the identity from the second device.

16. The system of claim 11 , wherein the processor is configured to:

obtain a request to associate with the user a third device that is not one of the plurality of devices, and a public key of the third device;

generate a new password for the user;

send the new password to the password management entity;

encrypt the new password with each of the public keys and with the public key of the third device, thus generating a plurality of new encrypted passwords, each associated with a device of the plurality of devices and with the new device; and

delete the new password.

17. The system of claim 11 , wherein the processor is configured to:

obtain a request to change the password of the user;

generate a new password for the user;

send the new password to the password management entity;

encrypt the new password with each of the public keys, thus generating a plurality of new encrypted passwords, each associated with a device of the plurality of devices; and

deleting the password.

18. The system of claim 11 , comprising:

a first device; and

a second device associated with the user;

wherein the processor is configured to send to the second device the encrypted password associated with the first device in a preparation stage;

wherein the first device is configured to perform a login to the first device when the processor is off-line by sending to the second device a request to login the user to the first device;

wherein the second device is configured to:

verify the identity of the user; and

following a successful identification of the user, send the encrypted password associated with the first device from the first device;

wherein the first device is configured to:

decrypt the encrypted password using a private key associated with the public key of the first device, to obtain the decrypted password; and

use the decrypted password to perform the login.

19. The system of claim 11 , comprising:

a first device; and

a second device associated with the user;

wherein the processor is configured to send, in a preparation stage, to the second device the encrypted password associated with the second device and the public key of the first device;

wherein the first device is configured to perform a login to the first device when the authentication service is off-line by sending to the second device a request to log in the user to the first device;

wherein the second device is configured to:

verify the identity of the user; and

following a successful identification of the user:

decrypt the encrypted password associated with the second device to obtain a clear password;

encrypt the clear password with the public key of the first device to obtain the encrypted password associated with the first device; and

send the encrypted password associated with the first device to the first device;

wherein the first device is configured to:

decrypt the encrypted password using a private key associated with the public key of the first device, to obtain the decrypted password; and

using the decrypted password to perform the login.

20. The system of claim 11 , comprising:

a first device; and

a second device associated with the user;

wherein the processor is configured to send, in a preparation stage, to the second device the encrypted password associated with the second device;

wherein the second device is configured to:

decrypt the encrypted password associated with the second device;

verify the identity of the user;

following a successful identification of the user, present the decrypted password to the user; and

wherein the first device is configured to perform a login to the first device when the authentication service is off-line by:

obtaining the decrypted password from the user; and

using the decrypted password to perform the login.