Secure storage of passwords

Patent metadata

Field	Value
Publication number	US-2022179984-A1
Application number	US-202217679459-A
Country	US
Kind code	A1
Filing date	Feb 24, 2022
Priority date	Nov 21, 2019
Publication date	Jun 9, 2022
Grant date	—

Abstract

A device includes a memory and a processor. The processor is to execute the instruction to: receive, from a user device, a username of a user and a string; retrieve a first Message Authentication Code (MAC) and a salt from a database in response to receiving the username and the string; send the first MAC, the salt, and one or more parameters to a Hardware Security Module (HSM); receive, from the HSM, a message indicating whether the first MAC matches a second MAC that the HSM generates based on the one or more parameters and the salt. In addition, the processor to perform one of: authenticate the user when the message indicates that the first MAC matches the second MAC; or not authenticate the user when the message indicates that the first MAC does not match the second MAC.

First claim

What is claimed is:

1 . A device comprising:
a processor configured to:
receive, from a user device, a username of a user and a string;
retrieve a salt and a first Message Authentication Code (MAC) that a Hardware Security Module (HSM) previously generated using a secret key internal to the HSM;
send the first MAC, the salt, and one or more parameters to the HSM;
receive, from the HSM, a message indicating whether the first MAC matches a second MAC that the HSM generates based on the one or more parameters, the salt, and the secret key internal to the HSM; and
perform an authentication of the user based on the message.

2 . The device of claim 1 , wherein the device further comprises the HSM, and wherein when the HSM generates the second MAC, the HSM is configured to:
apply the secret key to a result of concatenating the string and the salt.

3 . The device of claim 2 , wherein the string includes a plaintext password.

4 . The device of claim 1 , wherein the processor is further to:
generate a nonce; and send, to the user device, the nonce and a public key, wherein the string includes a result of encryption, by the user device using the public key, of another string obtained by concatenating a plaintext password and the nonce.

5 . The device of claim 4 , wherein the processor is further to:
send the string and the nonce to the HSM; and receive the plaintext password from the HSM.

6 . The device of claim 4 , wherein the one or more parameters include the plaintext password.

7 . The device of claim 4 , wherein the encryption comprises the Rivest-Shamir-Adleman (RSA) encryption.

8 . The device of claim 4 , wherein the one or more parameters include the nonce and the string.

9 . The device of claim 8 , wherein the device further comprises the HSM, and wherein when the HSM generates the second MAC, the HSM is configured to:
decrypt the string using the secret key to obtain a resultant string; remove a portion corresponding to the nonce from the resultant string to obtain the plaintext password; concatenate the plaintext password with the salt to obtain a salted password; and use the salted password and a secret key to generate the second MAC.

10 . The device of claim 1 , wherein the processor is further configured to:
notify the user device whether the user is authenticated.

11 . A method comprising:
receiving, from a user device, a username of a user and a string; retrieving a salt and a first Message Authentication Code (MAC) that a Hardware Security Module (HSM) previously generated using a secret key internal to the HSM; sending the first MAC, the salt, and one or more parameters to the HSM; receiving, from the HSM, a message indicating whether the first MAC matches a second MAC that the HSM generates based on the one or more parameters, the salt, and the secret key internal to the HSM; and performing, by a device, an authentication of the user based on the message.

12 . The method claim 11 , wherein the device comprises the HSM, and wherein when the HSM generates the second MAC, the HSM is configured to:
apply the secret key to a result of concatenating the plaintext password and the salt.

13 . The method of claim 12 , the string includes the plaintext password.

14 . The method of claim 11 , further comprising:
generating a nonce; and sending, to the user device, the nonce and a public key, wherein the string includes a result of encryption, by the user device using the public key, of another string obtained by concatenating a plaintext password and the nonce.

15 . The method of claim 14 , further comprising:
sending the string and the nonce to the HSM; and receiving the plaintext password from the HSM.

16 . The method claim 14 , wherein the one or more parameters include the plaintext password.

17 . The method of claim 14 , wherein the encryption comprises the Rivest-Shamir-Adleman (RSA) encryption.

18 . The method of claim 14 , wherein the one or more parameters include the nonce and the string.

19 . A non-transitory computer-readable medium, comprising computer-executable instruction, wherein when executed by a processor, the instructions cause the processor to:
receive, from a user device, a username of a user and a string; retrieve a salt and a first Message Authentication Code (MAC) that a Hardware Security Module (HSM) previously generated using a secret key internal to the HSM; send the first MAC, the salt, and one or more parameters to the HSM; receive, from the HSM, a message indicating whether the first MAC matches a second MAC that the HSM generates based on the one or more parameters, the salt, and the secret key internal to the HSM; and perform an authentication of the user based on the message.

20 . The non-transitory computer-readable medium of claim 19 , wherein the one or more parameters include a plaintext password and the string includes the plaintext password.

Assignees

• Verizon Patent & Licensing Inc

Inventors

• Bilger Brent R
• Patel Rajesh M
• Venugopal Shailesh K
• Copeland William F
• Basmaji Michel J

Classifications

• H04L9/0897 Primary

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title

• H04L9/302

  involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes · CPC title

• G06F21/45

  Structures or tools for the administration of authentication · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L9/0877

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title