Method for inhibiting mass credential theft

• US 10,395,053 B2
• Filed: 12/20/2018
• Issued: 08/27/2019
• Est. Priority Date: 12/20/2017
• Status: Active Grant

• Current Assignee: Gideon Samid
• Original Assignee: Gideon Samid
• Inventors: Samid, Gideon
• Primary Examiner(s): Bechtel, Kevin
• Application Number:
  US16/228,675
• Publication Number:
  US 20190188404A1
• Time in Patent Office: 250 Days
• CPC Class Codes: G06F 18/22 Matching criteria, e.g. proximity measures
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6236 between heterogeneous systems

Abstract

Representing personal information and confidential data in a way that allows a data center to authenticate a customer submitting his or her credentials, without having the exact copy of the credentials held by the customer. If the data center is compromised and the customer authentication data is exposed, the data center arms itself with another non-exact copy of the customer authentication data such that only the customer holding the un-compromised data will properly authenticate themselves. A thief, holding the now defunct data center version of the customer authentication data, will not be able to use the stolen customer authentication data to authenticate themselves as the customer.

Claims

1. A method to represent access credentials, the method comprising:

receiving a first access credential;

generating a random data bit string O with a bit count that is equal to the value of the first access credential, wherein the identities of the bits of the random data bit string O are randomly selected from any of the potential 2ⁿ permutations of bits, where n is the bit count of the random data bit string O;

providing the generated random bit string O to a party for use as an authentication credential;

storing a copy of the random data bit string O in an off-line file;

creating a data bit string Ot that has a Hamming distance oft from the random data bit string O (H(O, Ot)=t);

storing the data bit string Ot in a verifier; and

authenticating, by the verifier, a submitter of a received second access credential as the party that was provided the generated random bit string O if and only if the received second access credential has the Hamming distance of t from the stored data bit string Ot.

2. The method of claim 1, where upon a break-in to the database, and a compromise of Ot:

retrieving the random data bit string O from the off-line file; and

creating a data bit string Ou comprised of n bits that has a Hamming distance of u from the random data bit string O(H(O, Ou)=u), where u does not equal t, thereby preventing a thief of data bit string Ot from authenticating themselves as the party that was provided the generated random data bit string O.

3. A non-transitory computer-readable storage device with computer-executable instructions stored thereon that, when executed by one or more computer processors, cause the one or more computer processors to perform operations comprising:

receiving a first access credential;

generating a random data bit string O with a bit count that is equal to the value of the first access credential, wherein the identities of the bits of the random data bit string O are randomly selected from any of the potential 2ⁿ permutations of bits, where n is the bit count of the random data bit string O;

providing the generated random bit string O to a party for use as an authentication credential;

storing a copy of the random data bit string O in an off-line file;

creating a data bit string Ot that has a Hamming distance oft from the random data bit string O (H(O, Ot)=t);

storing the data bit string Ot in a verifier; and

authenticating, by the verifier, a submitter of a received second access credential as the party that was provided the generated random bit string O if and only if the received second access credential has the Hamming distance oft from the stored data bit string Ot.

4. The non-transitory computer-readable storage device of claim 3, where upon a break-in to the database, and a compromise of Ot, the computer-executable instructions to further cause the one or more computer processors to perform operations comprising:

retrieving the random data bit string O from the off-line file; and

creating a data bit string Ou comprised of n bits that has a Hamming distance of u from the random data bit string O(H(O, Ou)=u), where u does not equal t, thereby preventing a thief of data bit string Ot from authenticating themselves as the party that was provided the generated random data bit string O.

5. A computer system, the computer system comprising:

a computer processor; and

a memory device storing computer-executable instructions that, when executed by the computer processor, causes the computer processor to perform operations comprising;

receiving a first access credential;

generating a random data bit string O with a bit count that is equal to the value of the first access credential, wherein the identities of the bits of the random data bit string O are randomly selected from any of the potential 2ⁿ permutations of bits, where n is the bit count of the random data bit string O;

providing the generated random bit string O to a party for use as an authentication credential;

storing a copy of the random data bit string O in an off-line file;

creating a data bit string Ot that has a Hamming distance oft from the random data bit string O (H(O, Ot)=t);

storing the data bit string Ot in a verifier; and

authenticating, by the verifier, a submitter of a received second access credential as the party that was provided the generated random bit string O if and only if the received second access credential has the Hamming distance oft from the stored data bit string Ot.

6. The computer system of claim 5, where upon a break-in to the database, and a compromise of Ot, the computer-executable instructions to further cause the computer processor to perform operations comprising:

retrieving the random data bit string O from the off-line file; and

creating a data bit string Ou comprised of n bits that has a Hamming distance of u from the random data bit string O(H(O, Ou)=u), where u does not equal t, thereby preventing a thief of data bit string Ot from authenticating themselves as the party that was provided the generated random data bit string O.