Distributed passcode verification system

• US 9,374,368 B1
• Filed: 01/07/2014
• Issued: 06/21/2016
• Est. Priority Date: 01/07/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory Branchek, Rubin, Gregory Alan
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Murphy, J. Brant
• Application Number:
  US14/149,721
• Time in Patent Office: 896 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

A distributed passcode verification system includes devices that each have a hardware secret and that are each able to perform a limited number of verifications using their hardware secrets. Passcode verifiers receive passcode information from a passcode information manager. The passcode information provides information usable, with a hardware secret, to verify passcodes provided to a verifier.

Claims

1. A computer-implemented method, comprising:

under the control of a computer system configured with executable instructions,

receiving passcode information comprising, for each passcode of a plurality of passcodes, a value derived based at least in part on the passcode and usable, with a hardware secret, to verify purported passcodes, the hardware secret maintained in a hardware device so as to be unobtainable to any processor executing code outside of the hardware device;

receiving a purported passcode;

causing the hardware device to provide a reference value calculated based at least in part on the purported passcode and the hardware secret;

determining, based at least in part on whether the calculated reference value matches a corresponding value of the passcode information, whether the purported passcode is valid;

enabling access to computing functionality as a result of determining that the purported passcode is valid; and

as a result of a limit on a number of passcode verifications being exceeded, causing the computer system to become unable to use the hardware secret to verify purported passcodes such that the computer system is unable to unilaterally restore an ability to use the hardware secret to verify purported passcodes.

2. The computer-implemented method of claim 1, further comprising:

receiving, to the hardware device and from another device, information indicating an increase to the limit;

determining, at the hardware device, whether the information indicating the increase to the limit is valid; and

on a condition that the information indicating the increase to the limit is valid, performing, by the hardware device, one or more operations that result in additional passcode verifications being performable by the computer system.

3. The computer-implemented method of claim 2, wherein receiving the information indicating the increase to the limit is triggered as a result of establishing a connection with a private network that includes the other device.

4. The computer-implemented method of claim 2, wherein receiving the information occurs by a unidirectional communication protocol.

5. The computer-implemented method of claim 1, wherein causing the computer system to become unable to verify purported passcodes includes performing one or more physically destructive operations that cause the hardware secret to become inaccessible to the hardware device.

6. The computer-implemented method of claim 1, wherein the computing functionality comprises functionality of an operating system of the computer system.

7. A system, comprising a plurality of computing devices configured to implement at least:

one or more passcode verifiers, each passcode verifier of the one or more passcode verifiers configured with a hardware device that maintains a hardware secret so as to be unobtainable outside of the hardware device, the passcode verifier further configured to;

receive, from a passcode information manager, passcode information required to perform passcode verifications; and

use the hardware device to verify passcodes based at least in part on the hardware secret and in accordance with a limit on a number of passcode verifications performable using the hardware secret such that, as a result of such limit on a number of passcode verifications being exceeded, the passcode verifier is made unable to use the hardware secret to verify purported passcodes such that the passcode verifier is unable to unilaterally restore an ability to use the hardware secret to verify purported passcodes.

8. The system of claim 7, wherein the hardware device is configured such that physical tampering of the hardware device causes the hardware secret to be destroyed.

9. The system of claim 7, wherein at least one of the passcode verifiers is configured such that both successful and unsuccessful passcode verifications contribute to exhaustion of the limit.

10. The system of claim 7 wherein the passcode information manager is configured to increase the limit for at least one of the passcode verifiers.

11. The system of claim 7, wherein the hardware device is configured to destroy a corresponding hardware secret as a result of exceeding the limit.

12. The system of claim 7, further comprising the passcode information manager, the passcode information manager being configured to distribute the passcode information to at least a subset of the one or more passcode verifiers.

13. The system of claim 12, wherein:

the passcode information manager is a server on a private network; and

the passcode verifiers are computing devices at least intermittently on the private network.

14. The system of claim 7, wherein at least one of the passcode verifiers is configured to, after receipt of the passcode information, use the passcode information to verify a passcode without communicating with the passcode information manager.

15. The system of claim 7, wherein the passcode information for at least one passcode verifier of the one or more passcode verifiers comprises, for each passcode of a plurality of passcodes each corresponding to a different account a hash value generated based at least in part on a copy of the hardware secret and of the at least one passcode verifier.

16. A non-transitory computer-readable storage medium having collectively stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to:

receive a purported passcode;

as a result of receiving the purported passcode;

cause to be calculated, based at least in part on the purported passcode and a hardware secret of the computer system, a reference value;

determine, based at least in part on the calculated reference value and passcode verification information received from another computer system, whether the purported passcode is valid;

enable access to a resource on a condition that the purported passcode is determined to be valid; and

perform an operation that contributes to depletion of a limited number of passcode verifications performable by the computer system such that, as a result of the limited number of passcode verifications being fully depleted, the computer system is made unable to use the hardware secret to verify purported passcodes such that the system is unable to unilaterally restore an ability to use the hardware secret to verify purported passcodes.

17. The non-transitory computer-readable storage medium of claim 16, wherein the instructions that cause the computer system to receive the purported passcode cause the computer system to receive the purported passcode through an input device of the computer system.

18. The non-transitory computer-readable storage medium of claim 16, wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to request, to another computer system, that the limited number of passcode verifications be refreshed and refresh the limited number of passcode verifications upon receiving authorization from the other computer system.

19. The non-transitory computer-readable storage medium of claim 18, wherein the instructions that cause the computer system to request that the limited number of passcode verifications be refreshed cause the computer system to request that the limited number of passcode verifications be refreshed prior to complete depletion of the limited number of passcode verifications.

20. The non-transitory computer-readable storage medium of claim 16, wherein the limited number of passcode verifications is a fixed number of passcode verifications.

21. The non-transitory computer-readable storage medium of claim 16, wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to destroy the hardware secret as a result of complete depletion of the limited number of passcode verifications.

22. The non-transitory computer-readable storage medium of claim 16, wherein:

the hardware secret is from a set of one or more hardware secrets of the computer system; and

the instructions that cause the computer system to enable access to the resource, when executed by the one or more processors, cause the computer system to use a specified hardware secret from the set of one or more hardware secrets to decrypt data stored in encrypted form on a data storage device of the computer system.