Securing passwords with hash value

• US 9,185,107 B2
• Filed: 01/22/2014
• Issued: 11/10/2015
• Est. Priority Date: 05/27/2010
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Todorov, Alexander
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US14/160,876
• Publication Number:
  US 20140137224A1
• Time in Patent Office: 657 Days
• Field of Search: 726/5, 726/7, 726/51, 709/229, 705/40
• US Class Current: 1/1
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A password security system, hosted by a server, whose method of operation may include receiving a client hash value from a client where the client hash value is computed by hashing a password to generate a first hash value, and hashing the first hash value combined with a user input of an answer to a challenge to generate the client hash value. A server hash value is computed using password data for the user that is stored in a data store coupled to the server and a server-side answer that is stored in the data store. A determination is made whether the server hash value matches the client hash value and data access is granted to the user in view of a determination that the server hash value matches the client hash value, and data access is denied to the user in view of a determination that the server hash value does not match the client hash value.

Claims

1. A method of securing a password comprising:

receiving, by a processing device of a server computer system, a client hash value from a client, the client hash value computed by hashing the password to generate a first hash value, and hashing the first hash value combined with a user input of an answer to a challenge in response to a challenge presented to the user to generate the client hash value;

computing, by the processing device of the server computer system, a server hash value using password data for the user that is stored in a data store coupled to the server and a server-side answer that is stored in the data store;

determining, by the processing device of the server computer system, whether the server hash value matches the client hash value; and

granting, by the processing device of the server computer system, data access to the user in view of a determination that the server hash value matches the client hash value and denying data access to the user in view of a determination that the server hash value does not match the client hash value.

2. The method of claim 1, further comprising sending to the client a first request for the password and a second request for user input of the answer to the challenge.

3. The method of claim 1, wherein the password data comprises a hash value for a password.

4. The method of claim 1, further comprising:

removing the server-side answer from the data store in view of a determination that the server hash value matches the client hash value.

5. A server computer system comprising:

a data store to store password data for a user and a server-side answer; and

a hardware processing device coupled to the data store, the hardware processing device to;

receive a client hash value from a client, the client hash value computed by hashing a password to generate a first hash value, and hashing the first hash value combined with a user input of an answer to a challenge in response to a challenge presented to the user to generate the client hash value;

compute a server hash value using the password data and the server-side answer;

determine whether the server hash value matches the client hash value; and

grant data access to the client in view of a determination that the server hash value matches the client hash value and denying data access to the client in view of a determination that the server hash value does not match the client hash value.

6. The system of claim 5, wherein the hardware processing device is further to send to the client a first request for the password and a second request for user input of the answer to the challenge.

7. The system of claim 5, wherein the password data comprises a hash value for a password.

8. The system of claim 5, wherein the processing device is further to remove the server side answer from the data store in view of a determination that the server hash value matches the client hash value.

9. A non-transitory computer-readable storage medium comprising instructions to secure a password that, when executed by a processing device, cause the processing device to:

receive, by the processing device, a client hash value from a client, the client hash value computed by hashing the password to generate a first hash value, and hashing the first hash value combined with a user input of an answer to a challenge in response to a challenge presented to the user to generate the client hash value;

compute, by the processing device, a server hash value using password data for the user that is stored in a data store coupled to the server and a server-side answer that is stored in the data store;

determine, by the processing device, whether the server hash value matches the client hash value; and

grant, by the processing device, data access to the user in view of a determination that the server hash value matches the client hash value and denying data access to the user in view of a determination that the server hash value does not match the client hash value.

10. The non-transitory computer-readable storage medium of claim 9, wherein the password data comprises a hash value for the password.

11. The non-transitory computer-readable storage medium of claim 9, wherein the processing device is further to send to the client a first request for the password and a second request for user input of the answer to the challenge.