Distributed password verification
First Claim
Patent Images
1. A method comprising:
- creating a first token on a first server based, at least in part, on a first set of client identifiers for a client and an encryption key, wherein;
the first set of client identifiers includes;
a first hashed password for the client, anda first username for the client, andthe first token is encrypted;
transmitting the first token from the first server to the client;
adding, to a honeychecker registry on a second server, the first username, wherein the honeychecker registry is a list of valid usernames;
deleting the first token and the first set of client identifiers from the first server;
receiving, on the first server, a second token and a second set of client identifiers for the client, wherein;
the second token is encrypted,the second token is equivalent to the first token, andthe second set of client identifiers includes;
a second hashed password, anda second username;
decrypting the second token using a decryption key to reveal the first set of client identifiers;
comparing the second hashed password to the first hashed password from the second token to verify an identity of the client;
determining that the second username does not appear in the honeychecker registry; and
denying, to the client, responsive to determining that the second username does not appear in the honeychecker registry, access to the account to prevent an unauthorized access;
wherein;
at least comparing the second hashed password to the first hashed password from the second token is performed by computer software running on computer hardware.
1 Assignment
0 Petitions
Accused Products
Abstract
Distribution of verification of passwords for electronic account. Password verification is distributed (divided) across multiple entities to reduce potential exposure in the event of a server exposure.
-
Citations
9 Claims
-
1. A method comprising:
-
creating a first token on a first server based, at least in part, on a first set of client identifiers for a client and an encryption key, wherein; the first set of client identifiers includes; a first hashed password for the client, and a first username for the client, and the first token is encrypted; transmitting the first token from the first server to the client; adding, to a honeychecker registry on a second server, the first username, wherein the honeychecker registry is a list of valid usernames; deleting the first token and the first set of client identifiers from the first server; receiving, on the first server, a second token and a second set of client identifiers for the client, wherein; the second token is encrypted, the second token is equivalent to the first token, and the second set of client identifiers includes; a second hashed password, and a second username; decrypting the second token using a decryption key to reveal the first set of client identifiers; comparing the second hashed password to the first hashed password from the second token to verify an identity of the client; determining that the second username does not appear in the honeychecker registry; and denying, to the client, responsive to determining that the second username does not appear in the honeychecker registry, access to the account to prevent an unauthorized access; wherein; at least comparing the second hashed password to the first hashed password from the second token is performed by computer software running on computer hardware. - View Dependent Claims (2, 3)
-
-
4. A computer program product comprising:
a computer readable storage medium having stored thereon; first instructions executable by a device to cause the device to create a first token on a first server based, at least in part, on a first set of client identifiers for a client and an encryption key, wherein; the first set of client identifiers includes; a first hashed password for the client, and a first username for the client, and the first token is encrypted; second instructions executable by a device to cause the device to transmit the first token from the first server to the client; third instructions executable by a device to cause the device to add, to a honeychecker registry on a second server, the first username, wherein the honeychecker registry is a list of valid usernames; fourth instructions executable by a device to cause the device to delete the first token and the first set of client identifiers from the first server; fifth instructions executable by a device to cause the device to receive, on a second first server, the token and a second set of client identifiers for the client, wherein; the second token is encrypted, the second token is equivalent to the first token, and the second set of client identifiers includes; a second hashed password, and a second username; sixth instructions executable by a device to cause the device to decrypt the second token using a decryption key to reveal the first set of client identifiers; and seventh instructions executable by a device to cause the device to compare the second hashed password to the first hashed password from the second token to verify an identity of the client; eighth instructions executable by a device to cause the device to determine that the second username does not appear in the honeychecker registry; and ninth instructions executable by a device to cause the device to deny, to the client, responsive to determining that the second username does not appear in the honeychecker registry, access to the account to prevent an unauthorized access. - View Dependent Claims (5, 6)
-
7. A computer system comprising:
-
a processor set; and a computer readable storage medium; wherein; the processor set is structured, located, connected, and/or programmed to execute instructions stored on the computer readable storage medium; and the instructions include; first instructions executable by a device to cause the device to create a first token on a first server based, at least in part, on a first set of client identifiers for a client and an encryption key, wherein; the first set of client identifiers includes;
a first hashed password for the client, and
a first username for the client, andthe first token is encrypted; second instructions executable by a device to cause the device to transmit the first token from the first server to the client; third instructions executable by a device to cause the device to add, to a honeychecker registry on a second server, the first username, wherein the honeychecker registry is a list of valid usernames; fourth instructions executable by a device to cause the device to delete the first token and the first set of client identifiers from the first server; fifth instructions executable by a device to cause the device to receive, on a second first server, the token and a second set of client identifiers for the client, wherein; the second token is encrypted, the second token is equivalent to the first token, and the second set of client identifiers includes;
a second hashed password, and
a second username;sixth instructions executable by a device to cause the device to decrypt the second token using a decryption key to reveal the first set of client identifiers; and seventh instructions executable by a device to cause the device to compare the second hashed password to the first hashed password from the second token to verify an identity of the client; eighth instructions executable by a device to cause the device to determine that the second username does not appear in the honeychecker registry; and ninth instructions executable by a device to cause the device to deny, to the client, responsive to determining that the second username does not appear in the honeychecker registry, access to the account to prevent an unauthorized access. - View Dependent Claims (8, 9)
-
Specification