Mobile device management including features of passwordless authentication

A non-transitory computer-readable medium having encoded therein programming code executable by one or more processors to perform or control performance of operations of securely storing a device password, the operations comprising:

• receiving from a relying party, via a communication interface, a first public encryption key associated with a first device associated with a user identity;
• generating, at a second device associated with the same user identity and registering with the relying party, a public encryption key pair that includes a second public encryption key;
• performing a first level of encryption with respect to a password encryption key associated with encrypting a device password of the second device to produce a singly encrypted password encryption key using the second public encryption key;
• performing a second level of encryption with respect to the singly encrypted password encryption key to produce a doubly encrypted password encryption key using the first public encryption key;
• storing the doubly encrypted password encryption key on the second device;
• retrieving the device password of the second device using the doubly encrypted password encryption key, wherein the retrieving the password includes sending the doubly encrypted password encryption key to the first device;
• and the doubly encrypted password encryption key is sent to the first device via the relying party or a secure wireless communication;
• performing a first level of decryption of the doubly encrypted password encryption key to retrieve the singly encrypted password encryption key using a first private encryption key associated with the first device;
• returning the singly encrypted password encryption key to the second device;
• receiving the singly encrypted password encryption key;
• performing a second level of decryption of the singly encrypted password encryption key to retrieve the password encryption key using a second private encryption key associated with the second public encryption key;
• decrypting the device password using the password encryption key;
• and
• providing access to the second device using the device password.

A system configured to securely store a device password, the system comprising:

• a communication interface;
• and
• a processor coupled to the communication interface and configured to:
• receive from a relying party, via the communication interface, a first public encryption key associated with a first computing device associated with a user identity;
• generate at a second computing device associated with the same user identity and register with the relying party a public encryption key pair that includes a second public encryption key;
• using the second public encryption key to perform a first level of encryption with respect to a password encryption key associated with encrypting a device password of the second computing device to produce a singly encrypted password encryption key;
• using the first public encryption key to perform a second level of encryption with respect to the singly encrypted password encryption key to produce a doubly encrypted password encryption key;
• store the doubly encrypted password encryption key on the second computing device;
• use the doubly encrypted password encryption key to retrieve the device password of the second computing device by sending the doubly encrypted password encryption key to the first computing device via the relying party or via a secure wireless communication;
• the first computing device is configured to:
• use a first private encryption key associated with the first computing device to perform a first level of decryption of the doubly encrypted password encryption key to retrieve the singly encrypted password encryption key;
• and
• return the singly encrypted password encryption key to the second computing device;
• and
• the processor is further configured to:
• receive the singly encrypted password encryption key;
• use a second private encryption key associated with the second public encryption key to perform a second level of decryption of the singly encrypted password encryption key to retrieve the password encryption key;
• use the password encryption key to decrypt the device password;
• and
• use the device password to provide access to the second computing device.