Distributed password verification

• US 9,628,472 B1
• Filed: 11/07/2016
• Issued: 04/18/2017
• Est. Priority Date: 12/22/2015
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Koved, Lawrence, Taban, Gelareh
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Zarrineh, Shahriar
• Application Number:
  US15/344,729
• Time in Patent Office: 162 Days
• Field of Search: 713171
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/55 Push-based network services
• CPC Class Codes: H04L 9/06 the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0847 involving identity based encryption [IBE] schemes
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

Distribution of verification of passwords for electronic account. Password verification is distributed (divided) across multiple entities to reduce potential exposure in the event of a server exposure.

Claims

1. A computer system for distributed password verification to prevent unauthorized access to an account, the computer program product comprising:

a processor set; and

a computer readable storage medium;

wherein;

the processor set is structured, located, connected, and/or programmed to execute instructions stored on the computer readable storage medium; and

the instructions include;

first instructions executable by a device to cause the device to receive, from a client, a first set of client identifiers for the client, wherein the first set of client identifiers includes;

a first username for the client,

a first hashed password for the client, and

a first hashed server identifier;

second instructions executable by a device to cause the device to create an account for the client based on the username for the client;

third instructions executable by a device to cause the device to create a first token on a first server based on;

an encryption key,

a device identifier for a device used by the client, and

the first set of client identifiers for the client;

fourth instructions executable by a device to cause the device to transmit the first token from the first server to the client;

fifth instructions executable by a device to cause the device to add, to a honeychecker registry on a second server, the username for the client, wherein the honeychecker registry is a list of valid usernames;

sixth instructions executable by a device to cause the device to delete the first token from the first server;

seventh instructions executable by a device to cause the device to delete the first set of client identifiers from the first server;

eighth instructions executable by a device to cause the device to receive, on the first server, a second token, wherein;

the second token is encrypted, and

the second token is equivalent to the first token;

ninth instructions executable by a device to cause the device to receive, on the first server, a second set of client identifiers for the client, wherein the second set of client identifiers includes;

a second username,

a second hashed password, and

a second hashed server identifier;

tenth instructions executable by a device to cause the device to decrypt the second token using a decryption key to reveal the first set of client identifiers;

eleventh instructions executable by a device to cause the device to verify the second token with a comparison of;

the second hashed server identifier, and

the first hashed server identifier in the second token;

twelfth instructions executable by a device to cause the device to validate an identity of the client with a comparison of;

the second hashed password, and

the first hashed password for the client in the second token;

thirteenth instructions executable by a device to cause the device to log the second username to an authentication log;

fourteenth instructions executable by a device to cause the device to determine that the second username does not appear in the honeychecker registry;

fifteenth instructions executable by a device to cause the device to, responsive to fourteenth instructions to determine that the second username does not appear in the honeychecker registry, deny, to the client, access to the account to prevent an unauthorized access;

sixteenth instructions executable by a device to cause the device to, responsive to fourteenth instructions to determine that the second username does not appear in the honeychecker registry, lock the account to prevent a future unauthorized access;

seventeenth instructions executable by a device to cause the device to, responsive to fourteenth instructions to determine that the second username does not appear in the honeychecker registry, determine the first server is compromised; and

eighteenth instructions executable by a device to cause the device to, responsive to fourteenth instructions to determine the first server is compromised, transmit an alert to the client that the first server is compromised.