Protection and verification of user authentication credentials against server compromise

Patent metadata

Field	Value
Publication number	US-10097544-B2
Application number	US-201615169965-A
Country	US
Kind code	B2
Filing date	Jun 1, 2016
Priority date	Jun 1, 2016
Publication date	Oct 9, 2018
Grant date	Oct 9, 2018

Abstract

Authenticating a user is provided. A decryption key corresponding to an authentication account of the user of a client device and authentication credential data obtained from the user of the client device is received during authentication. Encrypted authentication credential data corresponding to the user is decrypted using the received decryption key corresponding to the authentication account of the user. The decrypted authentication credential data is compared with the received authentication credential data to authenticate the user of the client device.

First claim

What is claimed is:

1. A computer-implemented method for authenticating a user, the computer-implemented method comprising:
receiving, by a computer, a data decryption key corresponding to an authentication account of the user of a client device and authentication credential data obtained from the user of the client device during authentication, wherein the authentication credential data obtained from the user during the authentication comprises a password and a biometric sample of the user;
decrypting, by the computer, encrypted authentication credential data retrieved from storage and corresponding to the user using the received data decryption key;
comparing, by the computer, the decrypted authentication credential data with the received authentication credential data to authenticate the user of the client device; and
deleting, by the computer, the received data decryption key, the received authentication credential data, and any unencrypted authentication credential data corresponding to the authentication account of the user.

2. The computer-implemented method of claim 1 further comprising:
determining, by the computer, whether the decrypted authentication credential data matches the received authentication credential data.

3. The computer-implemented method of claim 2 further comprising:
responsive to the computer determining that the decrypted authentication credential data does match the received authentication credential data, verifying, by the computer, the user as authentic; and
allowing, by the computer, the authentication of the verified user.

4. The computer-implemented method of claim 2 further comprising:
responsive to the computer determining that the decrypted authentication credential data does not match the received authentication credential data, rejecting, by the computer, the user as non-authentic; and
denying, by the computer, the authentication of the rejected user.

5. The computer-implemented method of claim 1 further comprising:
processing, by the computer, the received authentication credential data to generate and store an encrypted biometric template in response to the received authentication credential data being a biometric sample obtained from the user by the client device.

6. The computer-implemented method of claim 1 further comprising:
storing, by the computer, the encrypted authentication credential data as a credential blob in the authentication account corresponding to the user.

7. The computer-implemented method of claim 6 , wherein the credential blob includes an expiry date, and wherein the expiry date is a time when information contained in the credential blob expires such that the credential blob includes both encrypted and unencrypted data.

8. The computer-implemented method of claim 1 further comprising:
receiving, by the computer, a request from the client device to delete the authentication account corresponding to the user; and
deleting, by the computer, the authentication account from a storage device of the computer.

9. The computer-implemented method of claim 1 further comprising:
receiving, by the computer, an encrypted decryption key from a first client device to transfer the encrypted encryption key to a second client device;
receiving, by the computer, a request from the second client device for the encrypted decryption key corresponding to the first client device; and
sending, by the computer, the encrypted decryption key corresponding to the first client device to the second client device, wherein the second client device decrypts the encrypted decryption key corresponding to the first client device using a private key corresponding to a public key of the second client device used to encrypt the encrypted decryption key on the first client device.

10. A computer system for authenticating a user, the computer system comprising:
a bus system;
a storage device connected to the bus system, wherein the storage device stores program instructions; and
a processor connected to the bus system, wherein the processor executes the program instructions to:
receive a data decryption key corresponding to an authentication account of the user of a client device and authentication credential data obtained from the user of the client device during authentication, wherein the authentication credential data obtained from the user during the authentication comprises a password and a biometric sample of the user;
decrypt encrypted authentication credential data retrieved from storage and corresponding to the user using the received data decryption key; and
compare the decrypted authentication credential data with the received authentication credential data to authenticate the user of the client device; and
deleting, by the computer, the received data decryption key, the received authentication credential data, and any unencrypted authentication credential data corresponding to the authentication account of the user.

11. The computer system of claim 10 , wherein the processor further executes the program instructions to:
determine whether the decrypted authentication credential data matches the received authentication credential data.

12. The computer system of claim 11 , wherein the processor further executes the program instructions to:
verify the user as authentic in response to determining that the decrypted authentication credential data does match the received authentication credential data; and
allow the authentication of the verified user.

13. The computer system of claim 11 , wherein the processor further executes the program instructions to:
reject the user as non-authentic in response to determining that the decrypted authentication credential data does not match the received authentication credential data; and
deny the authentication of the rejected user.

14. A computer program product for authenticating a user, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:
receiving, by the computer, a data decryption key corresponding to an authentication account of the user of a client device and authentication credential data obtained from the user of the client device during authentication, wherein the authentication credential data obtained from the user during the authentication comprises a password and a biometric sample of the user;
decrypting, by the computer, encrypted authentication credential data retrieved from storage and corresponding to the user using the received data decryption key;
comparing, by the computer, the decrypted authentication credential data with the received authentication credential data to authenticate the user of the client device; and
deleting, by the computer, the received data decryption key, the received authentication credential data, and any unencrypted authentication credential data corresponding to the authentication account of the user.

15. The computer program product of claim 14 further comprising:
determining, by the computer, whether the decrypted authentication credential data matches the received authentication credential data.

16. The computer program product of claim 15 further comprising:
responsive to the computer determining that the decrypted authentication credential data does match the received authentication credential data, verifying, by the computer, the user as authentic; and
allowing, by the computer, the authentication of the verified user.

Assignees

• IBM

Inventors

• Koved Lawrence
• Molloy Ian M
• Taban Gelareh

Classifications

• H04L63/045

  wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14) · CPC title

• H04L63/0861 Primary

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title

• G06F13/4282

  on a serial bus, e.g. I2C bus, SPI bus (on daisy chain buses G06F13/4247) · CPC title

• H04L2463/062

  applying encryption of the keys · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title