A Practical Password Management Scheme based on Computer Hardware Information and IC card

Abstract

Since the twenty-first Century, the Internet has brought great convenience to our life, following with a large number of network accounts registered on kinds of websites or Internet systems. The management of these accounts and their passwords has become a public problem needed to be solved. Recently, there have been a lot of works trying to answer this question in the literature. However, there isn’t a practical method suitable for a variety of occasions. In this paper, we propose a novel password management scheme to address this issue by binding the computer hardware’s identifier and an IC (Integrated Circuit) card. The accounts and passwords of the third-party systems are stored in a secure repository of a computer. Any manipulations of the accounts and passwords must be authenticated, in which only the user who can provide the computer, the IC card and the management password is accepted by the system. Therefore，with only one password, which is called management password, the administration of all the other accounts and passwords can be achieved. Additionally, we can login into a third-party system automatically if its’ login API is public. Practicability and security analysis show that the proposed scheme is practical and secure, and can be applied in many situations.