# US 10,454,900 B2 · Remote authentication and passwordless password reset > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,900 B2 - Document ID: US10454900B2 - Status: Granted - Kind: B2 - Application number: 14/866,217 - Filed: 2015-09-25 - Published: 2017-03-30 - Granted: 2019-10-22 - Earliest claimed: 2015-09-25 - Assignees: McAfee, Inc. - Applicants: McAfee, Inc. - Inventors: Francois Proulx; Mathieu Rene; Richard Reiner - Web page: https://patentgrep.com/patent/US10454900B2 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 9/0822: {using key encryption key} - H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 2209/24: Key scheduling, i.e. generating round keys or sub-keys for block encryption - H04L 2463/062: applying encryption of the keys - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A passwordless reset technique includes actions to receive a request for a password reset, wherein the request password reset is initiated at a first device, determine that the first device is a trusted device, authenticate the user in order to obtain a cloud key from a network device, wherein the cloud key is associated with the first device, derive a key encryption key using the cloud key, decrypt a local storage key using the key encryption key, decrypt a local storage using the local storage key to obtain a content encryption key, obtain a new password via user input, re-encrypt the content encryption key, and transmit it to the network device, derive a new authentication token using the new password, and transmit the new authentication token to the network device. ## Claims ### Claim 1 At least one of a storage device or storage disk, comprising instructions that when executed cause a trusted device to at least: initiate a first transmission of a password reset request, the password reset request to request replacement of a first password with a new password without providing the first password; derive an online key encryption key based on a cloud key obtained from a network device; decrypt a local storage key using the online key encryption key; decrypt a key bag using the local storage key to obtain at least a content encryption key, the key bag being an encrypted data structure local to the trusted device; in response to decrypting the key bag, decrypt information encrypted by the content encryption key, using the content encryption key; obtain the new password; derive a new online key encryption key from the new password; re-encrypt the content encryption key with the new online key encryption key, the re-encrypted content encryption key to enable authentication of a user at the network device using the new password; derive a new authentication token using the new password; and initiate a second transmission of the new authentication token and the re-encrypted content encryption key to the network device. ### Claim 2 (depends on 1) The storage device or storage disk of claim 1, wherein the key bag of the trusted device includes the content encryption key and the information encrypted by the content encryption key, the information encrypted by the content encryption key including credentials used to login to a website. ### Claim 3 (depends on 1) The storage device or storage disk of claim 1, wherein the instructions cause the trusted device to obtain the cloud key in response to authentication of the user associated with the password reset request. ### Claim 4 (depends on 3) The storage device or storage disk of claim 3, wherein the authentication of the user associated with the password reset request includes biometric authentication. ### Claim 5 A trusted device, comprising: a memory including instructions and a key bag; and one or more processors to execute the instructions to: initiate a first transmission of a password reset request, the password reset request to request replacement of a first password with a new password without provision of the first password; derive an online key encryption key based on a cloud key obtained from a network device; decrypt a local storage key using the online key encryption key; decrypt the key bag using the local storage key to obtain at least a content encryption key; in response to decrypting the key bag, decrypt information encrypted by the content encryption key, using the content encryption key; obtain the new password; derive a new online key encryption key from the new password; re-encrypt the content encryption key with the new online key encryption key; derive a new authentication token using the new password; and initiate a second transmission of the new authentication token and the re-encrypted content encryption key to the network device, to enable authentication of a user at the network device using the new password. ### Claim 6 (depends on 5) The trusted device of claim 5, wherein the key bag includes the content encryption key and the information encrypted by the content encryption key, the information encrypted by the content encryption key including credentials used to login to a website. ### Claim 7 (depends on 5) The trusted device of claim 5, wherein the one or more processors are to obtain the cloud key in response to authentication of the user. ### Claim 8 (depends on 7) The trusted device of claim 7, wherein the one or more processors are to authenticate the user via biometric authentication. ### Claim 9 A method, comprising: initiating, at a trusted device, a first transmission of a password reset request, the password reset request to request replacement of a first password with a new password without provision of the first password; deriving an online key encryption key based on a cloud key obtained from a network device; decrypting a local storage key using the online key encryption key; decrypting a key bag local to the trusted device using the local storage key to obtain a content encryption key; in response to decrypting the key bag, decrypting information encrypted by the content encryption key, using the content encryption key; obtaining the new password; deriving a new online key encryption key from the new password; re-encrypting the content encryption key with the new online key encryption key; deriving a new authentication token using the new password; and initiating a second transmission of the new authentication token and the re-encrypted content encryption key to the network device, to enable authentication of a user at the network device using the new password. ### Claim 10 (depends on 9) The method of claim 9, the key bag of the trusted device includes the content encryption key and the information encrypted by the content encryption key, the information encrypted by the content encryption key including credentials used to login to a website. ### Claim 11 (depends on 9) The method of claim 9, further including obtaining the cloud key in response to authentication of the user associated with the password reset request. ### Claim 12 (depends on 9) The method of claim 9, further including authenticating the user via biometric authentication. ### Claim 13 At least one of a storage device or a storage disk comprising instructions that, when executed, cause a trusted machine to at least: generate a key encryption key based on a key encryption key salt from a network device and a master password from a user of the trusted machine; decrypt an encrypted content encryption key using the key encryption key, the encrypted content encryption key from the network device; generate a local storage key based on a cloud key obtained from the network device, the cloud key associated with the trusted machine; encrypt information with the decrypted content encryption key; encrypt a key bag of secure storage on the trusted machine using the local storage key; store the decrypted content encryption key in the key bag; and encrypt the local storage key using an online encryption key obtained from the network device. ### Claim 14 (depends on 13) The at least one storage device or storage disk of claim 13, wherein the instructions cause the trusted machine to obtain the cloud key in response to authentication of the user. ### Claim 15 (depends on 14) The at least one storage device or storage disk of claim 14, wherein the authentication of the user includes biometric authentication. ### Claim 16 (depends on 13) The at least one storage device or storage disk of claim 13, wherein the instructions cause the trusted machine to: generate a device salt; and encrypt the local storage key using the device salt and the cloud key. ### Claim 17 (depends on 16) The at least one storage device or storage disk of claim 16, wherein the instructions cause the trusted machine to: access the key bag based on a request; derive an online key encryption key from the cloud key; decrypt the encrypted local storage key with the online key encryption key; and access the key bag using the decrypted local storage key.