SERVER-ASSISTED AUTHENTICATION

• US 20170171185A1
• Filed: 12/11/2015
• Published: 06/15/2017
• Est. Priority Date: 12/11/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Camenisch, Jan L., Samelin, Kai W., Preiss, Franz-Stefan, Lehmann, Anja, Neven, Gregory
• Granted Patent: US 10,091,190 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

Authentication of a device through a constructed authentication token. Components of an authentication key are distributed across at least a device and a server, diminishing a likelihood that an individual account is compromised by an attack.

Claims

1. A method comprising:

transmitting a subset of a first set of account data, wherein the subset of the first set of account data includes an authentication token request transcript;

receiving a first authentication token segment;

generating a full authentication token based, at least in part, on;

a first set of authentication key segments of a plurality of authentication key segments,

the authentication token request transcript, and

the first authentication token segment; and

transmitting the full authentication token;

wherein;

the authentication token request transcript is a message and a dataset,

the message and the dataset are derived, at least in part, from a password, and

at least generating the full authentication token is performed by computer software running on computer hardware.

2. The method of claim 1, further comprising:

verifying the full authentication token based, at least in part, on a comparison.

3. The method of claim 1, further comprising:

generating the first set of account data;

wherein;

the first set of account data further includes a double-hashed password, and

the double-hashed password is generated based, at least in part, on a hash function of a hashed password and the authentication token request transcript.

4. The method of claim 1, further comprising:

transmitting a subset of a second set of account data, wherein the subset of the second set of account data;

includes, at least, a second set of authentication key segments of the plurality of authentication key segments, and

does not include, at least, the first set of authentication key segments.

5. The method of claim 4, wherein:

the subset of the first set of account data further includes a first account identifier, and

the subset of the second set of account data further includes a second account identifier.

6. The method of claim 4, further comprising:

generating the second set of account data;

wherein;

the second set of account data further includes a hashed password.

7. The method of claim 6, wherein generating the second set of account data includes:

generating the hashed password based, at least in part, on a hash function of the password and a salt;

wherein;

the salt is a pseudo-randomly generated value, and

the password is received from a user.

8. A computer program product comprising:

a computer readable storage medium having stored thereon;

first instructions executable by a device to cause the device to transmit a subset of a first set of account data, wherein the subset of the first set of account data includes an authentication token request transcript;

second instructions executable by a device to cause the device to receive a first authentication token segment;

third instructions executable by a device to cause the device to generate a full authentication token based, at least in part, on;

a first set of authentication key segments of a plurality of authentication key segments,

the authentication token request transcript, and the first authentication token segment; and

fourth instructions executable by a device to cause the device to transmit the full authentication token;

wherein;

the authentication token request transcript is a message and a dataset, and

the message and the dataset are derived, at least in part, from a password.

9. The computer program product of claim 8, further comprising:

fifth instructions executable by a device to cause the device to verify the full authentication token based, at least in part, on a comparison.

10. The computer program product of claim 8, further comprising:

fifth instructions executable by a device to cause the device to generate the first set of account data;

wherein;

the first set of account data further includes a double-hashed password, and

the double-hashed password is generated based, at least in part, on a hash function of a hashed password and the authentication token request transcript.

11. The computer program product of claim 8, further comprising:

fifth instructions executable by a device to cause the device to transmit a subset of a second set of account data, wherein the subset of the second set of account data;

includes, at least, a second set of authentication key segments of the plurality of authentication key segments, and

does not include, at least, the first set of authentication key segments.

12. The computer program product of claim 11, wherein:

the subset of the first set of account data further includes a first account identifier, and

the subset of the second set of account data further includes a second account identifier.

13. The computer program product of claim 11, further comprising:

sixth instructions executable by a device to cause the device to generate the second set of account data;

wherein;

the second set of account data further includes a hashed password.

14. The computer program product of claim 13, wherein sixth instructions to generate the second set of account data includes:

seventh instructions executable by a device to cause the device to generate the hashed password based, at least in part, on a hash function of the password and a salt;

wherein;

the salt is a pseudo-randomly generated value, and

the password is received from a user.

15. A method comprising:

receiving a first set of account data, wherein the first set of account data includes an authentication token request transcript; and

generating a first authentication token segment, wherein the first authentication token segment is based, at least in part, on;

a first set of authentication key segments of a plurality of authentication key segments, and

the authentication token request transcript;

wherein;

the authentication token request transcript is a message and a dataset,

the message and the dataset are derived, at least in part, from a password, and

at least generating the first authentication token segment is performed by computer software running on computer hardware.

16. The method of claim 15, further comprising:

transmitting the first authentication token segment.

17. The method of claim 15, further comprising:

receiving a second set of account data, wherein the second set of account data includes the first set of authentication key segments.

18. The method of claim 17, further comprising:

verifying the first set of account data based, at least in part, on a comparison of a first hashed password to a second hashed password;

wherein;

the second set of account data further includes the first hashed password, and

the first set of account data further includes the second hashed password.

19. The method of claim 17, further comprising:

verifying the first set of account data based, at least in part, on a comparison of a first double-hashed password to a second double-hashed password;

wherein;

the first set of account data further includes the double-hashed password,

the second double-hashed password is generated based, at least in part, on a hash function of a hashed password and the authentication token request transcript, and

the second set of account data further includes the hashed password.

20. The method of claim 17, further comprising:

verifying the first set of account data based, at least in part, on a comparison of a first account identifier to a second account identifier;

wherein;

the second set of account data further includes the first account identifier, and

the first set of account data further includes the second account identifier.