Password Recovery Service

A method for enabling a server to update a previous user encrypted key secured by encrypting an encryption key with a user secret, the encryption key for use by a client device of the user to encrypt and decrypt data, and the user having access to a back-up encrypted key comprising the encryption key encrypted by a service operator secret, the method comprising the steps of:

• receiving encrypted back-up information from the user at the server, the encrypted back-up information comprising a new user secret and the back-up encrypted key encrypted with the service operator secret;
• decrypting the encrypted back-up information using a corresponding service operator secret to produce the encryption key and the new user secret;
• encrypting the encryption key with the new user secret producing a new user encrypted key;
• removing the received back-up encrypted information, the decrypted new user secret and the decrypted encryption key such that the server only has access to the new user encrypted key;
• storing the new user encrypted key for use by the user in updating the previous user encrypted key on the client device.

An apparatus for use in enabling a user to secure and back-up an encryption key for use by a client device of the user in encrypting and decrypting data, the apparatus comprising:

• a receiver, a transmitter, a memory unit, and a processor, the processor being connected to the receiver, to the transmitter, and to the memory unit, wherein:
• the processor is configured to:
• receive a user secret;
• encrypt the encryption key with the user secret to produce a user encrypted key and store the user encrypted key on the memory unit;
• encrypt the encryption key with a service operator secret to produce a back-up encrypted key and store the back-up encrypted key;
• and
• remove the encryption key such that the encryption key can only be accessed by the client device via the user encrypted key and the user secret.

An apparatus for use in enabling a user to change a user secret previously used to secure an encryption key for use by a client device in encrypting and decrypting data, wherein the user has access to a back-up encrypted key comprising the encryption key encrypted by a service operator secret, the apparatus comprising:

• a receiver, a transmitter, a memory unit, and processor, the processor being connected to the receiver, to the transmitter, and to the memory unit, wherein:
• the processor is configured to:
• receive a new user secret and the back-up encrypted key;
• encrypt the new user secret and the back-up encryption key with the service operator secret to produce encrypted back-up information;
• and
• the transmitter is configured to transmit the encrypted back-up information to the service operator for securely encrypting the encryption key using the new user secret to produce a new user encrypted key for use in updating the previous user encrypted key stored on the client device.

An apparatus for use in enabling a service operator to update a previous user encrypted key secured by encrypting an encryption key with a user secret, the encryption key for use by a user's client device to encrypt and decrypt data, wherein the user has access to a back-up encrypted key comprising the encryption key encrypted by a service operator secret, the apparatus comprising:

• a receiver, a transmitter, a memory unit, and processor, the processor being connected to the receiver, to the transmitter, and to the memory unit wherein:
• the receiver is configured for receiving encrypted back-up information from the user, the encrypted back-up information comprising a new user secret and the back-up encrypted key encrypted with the service operator secret;
• and
• the processor is configured to:
• decrypt the encrypted back-up information using a corresponding service operator secret producing the encryption key and the new user secret;
• encrypt the encryption key with the new user secret producing a new user encrypted key;
• remove the received back-up encrypted information, the decrypted new user secret and the decrypted encryption key such that the service operator only has access to the new user encrypted key;
• and
• store the new user encrypted key for use by the user in updating the previous user encrypted key on the client device.