Abstract:

The existed password management methods are not secured enough but inconvenient to change each account password. Based on the key technologies of trusted computing, such as key management, security storage and authorized access control, a new password management scheme is proposed. This scheme helps users manage multiple accounts by turning a single memorized password into a different password for each account. The implementation of the scheme is discussed and compared its strength and usability to those of related approaches. Unlike previous approaches, our scheme is both highly resistant to brute force attacks and convenient to execute a password change for each password. It also can prevent phishing.

Key words: trusted computing, password authentication, password management, phishing