Passwordless vault access through secure vault enrollment

An apparatus, comprising:

• one or more memories storing processor-executable code;
• and
• one or more processors coupled with the one or more memories and individually or collectively operable to execute the code to cause the apparatus to:
• perform a sign-in or registration process to register a user with an application of an identity management system, wherein the sign-in or registration process comprises receiving an indication of at least one credential associated with an identity of the user;
• perform a vault enrollment process to configure a secure vault for the user of the application, wherein the vault enrollment process comprises:
• generating a cryptographically random identifier;
• combining the cryptographically random identifier with one or more attributes of the user to generate a Recovery Key;
• using a client-side encryption function to derive a symmetric key from the Recovery Key;
• generating a cryptographically random asymmetric keypair that includes a private key and a public key;
• encrypting the private key of the cryptographically random asymmetric keypair with the symmetric key derived from the Recovery Key;
• storing one or more of the Recovery Key, a vault key, the symmetric key, the private key, and the public key on a first client device of the user;
• and
• uploading, to the identity management system, data associated with the secure vault configured for the user of the application;
• perform a device pairing operation to transfer the Recovery Key from the first client device to a second client device of the user, wherein the second client device is operable to use the Recovery Key to generate the symmetric key, the private key, the public key, or a combination thereof;
• and
• use one or more of the symmetric key, the private key, or the public key to access the application of the identity management system via the second client device of the user.

A non-transitory computer-readable medium storing code that comprises instructions executable by one or more processors to:

• perform a sign-in or registration process to register a user with an application of an identity management system, wherein the sign-in or registration process comprises receiving an indication of at least one credential associated with an identity of the user;
• perform a vault enrollment process to configure a secure vault for the user of the application, wherein the vault enrollment process comprises:
• generating a cryptographically random identifier;
• combining the cryptographically random identifier with one or more attributes of the user to generate a Recovery Key;
• using a client-side encryption function to derive a symmetric key from the Recovery Key;
• generating a cryptographically random asymmetric keypair that includes a private key and a public key;
• encrypting the private key of the cryptographically random asymmetric keypair with the symmetric key derived from the Recovery Key;
• storing one or more of the Recovery Key, a vault key, the symmetric key, the private key, and the public key on a first client device of the user;
• and
• uploading, to the identity management system, data associated with the secure vault configured for the user of the application;
• perform a device pairing operation to transfer the Recovery Key from the first client device to a second client device of the user, wherein the second client device is operable to use the Recovery Key to generate the symmetric key, the private key, the public key, or a combination thereof;
• and
• use one or more of the Recovery Key, the symmetric key, the private key, or the public key to access the application of the identity management system via the second client device of the user.