Distributed password verification

• US 9,876,783 B2
• Filed: 12/22/2015
• Issued: 01/23/2018
• Est. Priority Date: 12/22/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Koved, Lawrence, Taban, Gelareh
• Primary Examiner(s): Rashid, Harunur
• Assistant Examiner(s): Zarrineh, Shahriar
• Application Number:
  US14/977,690
• Publication Number:
  US 20170180347A1
• Time in Patent Office: 763 Days
• Field of Search: 713171
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/55 Push-based network services
• CPC Class Codes: H04L 9/06 the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0847 involving identity based encryption [IBE] schemes
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

Distribution of verification of passwords for electronic account. Password verification is distributed (divided) across multiple entities to reduce potential exposure in the event of a server exposure.

Claims

1. A method comprising:

creating a first token on a first server based, at least in part, on a first set of client identifiers for a client and an encryption key, wherein;

the first set of client identifiers includes;

a first hashed password for the client, and

a first username for the client, and

the first token is encrypted;

transmitting the first token from the first server to the client;

adding, to a honeychecker registry on a second server, the first username, wherein the honeychecker registry is a list of valid usernames;

deleting the first token and the first set of client identifiers from the first server;

receiving, on the first server, a second token and a second set of client identifiers for the client, wherein;

the second token is encrypted,

the second token is equivalent to the first token, and

the second set of client identifiers includes;

a second hashed password, and

a second username;

decrypting the second token using a decryption key to reveal the first set of client identifiers;

comparing the second hashed password to the first hashed password from the second token to verify an identity of the client;

determining that the second username does not appear in the honeychecker registry; and

denying, to the client, responsive to determining that the second username does not appear in the honeychecker registry, access to the account to prevent an unauthorized access;

wherein;

at least comparing the second hashed password to the first hashed password from the second token is performed by computer software running on computer hardware.

2. The method of claim 1, further comprising:

logging the second username to an authentication log.

3. The method of claim 1, wherein creating the first token is further based, at least in part, on a device identifier for a device used by the client.

4. A computer program product comprising:

a computer readable storage medium having stored thereon;

first instructions executable by a device to cause the device to create a first token on a first server based, at least in part, on a first set of client identifiers for a client and an encryption key, wherein;

the first set of client identifiers includes;

a first hashed password for the client, and

a first username for the client, and

the first token is encrypted;

second instructions executable by a device to cause the device to transmit the first token from the first server to the client;

third instructions executable by a device to cause the device to add, to a honeychecker registry on a second server, the first username, wherein the honeychecker registry is a list of valid usernames;

fourth instructions executable by a device to cause the device to delete the first token and the first set of client identifiers from the first server;

fifth instructions executable by a device to cause the device to receive, on a second first server, the token and a second set of client identifiers for the client, wherein;

the second token is encrypted,

the second token is equivalent to the first token, and

the second set of client identifiers includes;

a second hashed password, and

a second username;

sixth instructions executable by a device to cause the device to decrypt the second token using a decryption key to reveal the first set of client identifiers; and

seventh instructions executable by a device to cause the device to compare the second hashed password to the first hashed password from the second token to verify an identity of the client;

eighth instructions executable by a device to cause the device to determine that the second username does not appear in the honeychecker registry; and

ninth instructions executable by a device to cause the device to deny, to the client, responsive to determining that the second username does not appear in the honeychecker registry, access to the account to prevent an unauthorized access.

5. The computer program product of claim 4, further comprising:

tenth instructions executable by a device to cause the device to log the second username to an authentication log.

6. The computer program product of claim 4, wherein first instructions to create the first token are further based, at least in part, on a device identifier for a device used by the client.

7. A computer system comprising:

a processor set; and

a computer readable storage medium;

wherein;

the processor set is structured, located, connected, and/or programmed to execute instructions stored on the computer readable storage medium; and

the instructions include;

first instructions executable by a device to cause the device to create a first token on a first server based, at least in part, on a first set of client identifiers for a client and an encryption key, wherein;

the first set of client identifiers includes;

 

a first hashed password for the client, and

 

a first username for the client, and

the first token is encrypted;

second instructions executable by a device to cause the device to transmit the first token from the first server to the client;

third instructions executable by a device to cause the device to add, to a honeychecker registry on a second server, the first username, wherein the honeychecker registry is a list of valid usernames;

fourth instructions executable by a device to cause the device to delete the first token and the first set of client identifiers from the first server;

fifth instructions executable by a device to cause the device to receive, on a second first server, the token and a second set of client identifiers for the client, wherein;

the second token is encrypted,

the second token is equivalent to the first token, and

the second set of client identifiers includes;

 

a second hashed password, and

 

a second username;

sixth instructions executable by a device to cause the device to decrypt the second token using a decryption key to reveal the first set of client identifiers; and

seventh instructions executable by a device to cause the device to compare the second hashed password to the first hashed password from the second token to verify an identity of the client;

eighth instructions executable by a device to cause the device to determine that the second username does not appear in the honeychecker registry; and

ninth instructions executable by a device to cause the device to deny, to the client, responsive to determining that the second username does not appear in the honeychecker registry, access to the account to prevent an unauthorized access.

8. The computer system of claim 7, further comprising:

tenth instructions executable by a device to cause the device to log the second username to an authentication log.

9. The computer system of claim 7, wherein first instructions to create the first token are further based, at least in part, on a device identifier for a device used by the client.