Distributed password verification

Patent metadata

Field	Value
Publication number	US-9537857-B1
Application number	US-201615091930-A
Country	US
Kind code	B1
Filing date	Apr 6, 2016
Priority date	Dec 22, 2015
Publication date	Jan 3, 2017
Grant date	Jan 3, 2017

Abstract

Distribution of verification of passwords for electronic account. Password verification is distributed (divided) across multiple entities to reduce potential exposure in the event of a server exposure.

First claim

What is claimed is:

1. A method of distributed password verification to prevent unauthorized access to an account, the method comprising:
receiving, from a client, a first set of client identifiers for the client, wherein the first set of client identifiers includes:
a first username for the client,
a first hashed password for the client, and
a first hashed server identifier;

creating an account for the client based on the username for the client;
creating a first token on a first server based on:
an encryption key,
a device identifier for a device used by the client, and
the first set of client identifiers for the client;

transmitting the first token from the first server to the client;
adding, to a honeychecker registry on a second server, the username for the client, wherein the honeychecker registry is a list of valid usernames;
deleting the first token from the first server;
deleting the first set of client identifiers from the first server;
receiving, on the first server, a second token, wherein:
the second token is encrypted, and
the second token is equivalent to the first token;

receiving, on the first server, a second set of client identifiers for the client, wherein the second set of client identifiers includes:
a second username,
a second hashed password, and
a second hashed server identifier;

decrypting the second token using a decryption key to reveal the first set of client identifiers;
verifying the second token with a comparison of:
the second hashed server identifier, and
the first hashed server identifier in the second token; validating an identity of the client with a comparison of:
the second hashed password, and
the first hashed password for the client in the second token;

logging the second username to an authentication log;
determining that the second username does not appear in the honeychecker registry;
responsive to determining that the second username does not appear in the honeychecker registry, denying, to the client, access to the account to prevent an unauthorized access;
responsive to determining that the second username does not appear in the honeychecker registry, locking the account to prevent a future unauthorized access;
responsive to determining that the second username does not appear in the honeychecker registry, determining the first server is compromised; and
responsive to determining the first server is compromised, transmitting an alert to the client that the first server is compromised;
wherein:
at least deleting the first token from the first server is performed by computer software running on computer hardware.

Assignees

• IBM

Inventors

• Koved Lawrence
• Taban Gelareh

Classifications

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L9/3236

  using cryptographic hash functions · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title