PASSWORD-BASED AUTHENTICATION

• US 20150341173A1
• Filed: 06/19/2015
• Published: 11/26/2015
• Est. Priority Date: 05/23/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Camenisch, Jan L., Lehmann, Anja, Neven, Gregory
• Granted Patent: US 9,596,086 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A password authentication system includes an access control server configured to control access by a user computer to a resource dependent on authentication of user passwords associated with user IDs. The system further includes a plurality of authentication servers, storing respective secret values. For each user ID, the access control server stores a first ciphertext produced by encrypting the user password associated with that ID using a predetermined algorithm dependent on the secret values. In response to receipt of a user ID and an input password, the access control server communicates with the plurality of authentication servers to implement password authentication, requiring use of the secret values, in which a second ciphertext is produced by encrypting the input password using said predetermined algorithm. The access control server compares the first and second ciphertexts to determine whether the input password equals the user password to permit access to the resource.

Claims

1. A method for controlling access by user computers to a resource in dependence on authentication of user passwords, associated with respective user IDs, at an access control server configured to communicate via a network with the user computers and a plurality n of authentication servers, the method comprising:

storing respective secret values at the plurality n of authentication servers;

for each said user ID, storing at the access control server a first ciphertext produced by encrypting a user password associated with a user ID using a predetermined algorithm dependent on said secret values;

at the access control server, in response to receipt from a user computer of a received user ID and an input password, communicating with a plurality k≦

n of authentication servers to implement a password authentication protocol, requiring use by the plurality k of authentication servers of the respective secret values, in which a second ciphertext is produced by encrypting the input password using said predetermined algorithm and the access control server uses the first and second ciphertexts to determine whether the input password equals the user password for the received user ID; and

at the access control server, permitting access to the resource by the user computer if the input password equals the user password.

2. The method as claimed in claim 1, wherein:

the first ciphertext comprises first pseudorandom values, each of which encrypts, via a pseudorandom function, a secret value of a respective authentication server and an initial pseudorandom value;

the initial pseudorandom value encrypts, via said pseudorandom function, the user password for the respective user ID; and

to implement said password verification protocol;

at the access control server, using the input password to produce a test pseudorandom value, which corresponds to said initial pseudorandom value, and sending the test pseudorandom value to a plurality k=n of authentication servers;

at each of the plurality k=n of authentication servers, using the test pseudorandom value to produce a respective server pseudorandom value, which corresponds to a first pseudorandom value, and sending the server pseudorandom value to the access control server; and

at the access control server, producing the second ciphertext from the server pseudorandom values, and comparing the first and second ciphertexts to determine whether the input password equals the user password for the received user ID.

3. The method as claimed in claim 1, wherein the first ciphertext is produced using a predetermined homomorphic encryption algorithm for encrypting the user password under a public key of a cryptographic key-pair, the secret values of the plurality n of authentication servers comprise respective key-shares of a secret key of said cryptographic key-pair, and to implement the password authentication protocol in response to receipt of the received user ID and input password:

at the access control server, producing the second ciphertext from the input password using said homomorphic encryption algorithm;

at the access control server, producing a test value by combining the second ciphertext and the first ciphertext for the received user ID such that, due to the homomorphism encryption algorithm, the test value decrypts to a predetermined value if the input password equals the user password associated with the user ID;

at the access control server, sending the test value to the plurality k of authentication servers;

at each of the plurality k of authentication servers, using its respective key-share to produce a k decryption share dependent on the test value, and sending the k decryption share to the access control server; and

at the access control server, determining whether the input password equals the user password by determining from the k decryption shares whether the test value decrypts to said predetermined value.