Password security

Patent metadata

Field	Value
Publication number	US-9935940-B1
Application number	US-201414481798-A
Country	US
Kind code	B1
Filing date	Sep 9, 2014
Priority date	Sep 9, 2014
Publication date	Apr 3, 2018
Grant date	Apr 3, 2018

Abstract

Techniques are disclosed for increasing the security of a database. A database is coupled with an access manager to limit certain applications that use the database to store user password information to queries that return at most one row. Additionally, returning a record may be limited to a case where the query includes the hash of the user name and password that is stored in the database. Other techniques may be implemented for other user account operations, such as password resets.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving a user name and password in connection with a request to access a resource;
authenticating to a database associated with the resource using credentials associated with a policy, the policy being configured with respect to database queries such that database queries are allowed where they uniquely identify one result or no results;
generating a value based at least in part on the user name and based at least in part on the password, the value differing from the user name, the value differing from the password;
constructing a database query to look up an entry in the database, the database query including an indication of the value as a query term;
sending, after the authenticating, the query to the database;
receiving a response from the database that indicates whether the database contains a row that uses the value as a key for the row;
determining that the user name and password are valid when the response from the database indicates that the database contains a row that uses the value as the key for the row; and
providing access to the resource in response to determining that the user name and password are valid.

2. The computer-implemented method of claim 1 , further comprising:
generating a second value based at least in part on a second user name and a second password;
sending a second database query to the database, the second database query including an indication of the second value as a query term;
determining that the user name and password are invalid when a second response from the database indicates that the database lacks a row that uses the value as the key for the row, the database matching either uniquely matching one row or no rows based on a given key; and
denying access to the resource in response to determining that the second user name and the second password are invalid.

3. A system, comprising:
at least one processor; and
at least one memory bearing processor executable instructions that, upon execution by the at least one processor, cause the system at least to:
generate a value based at least in part on a user name and a password,
authenticate to a database using credentials associated with a policy, the policy indicating that database queries are allowed where they uniquely identify one result or no results;
construct a database query to look up an entry in the database, the database query including an indication of the value;
send, after the authenticating, the query to the database;
receive a response from the database that indicates whether the database contains a row that uses the value as a key for the row; and
provide an indication that access to a resource is to be allowed based at least in part on whether the response from the database indicates whether the database contains the row that uses the value as the key for the row.

4. The system of claim 3 , further comprising:
the database.

5. The system of claim 3 , further comprising:
an access control component operable to inspect the query to determine whether the query is consistent with the policy, and to allow the query to proceed to the database where the query is consistent with the policy.

6. The system of claim 3 , wherein the instructions that, upon execution by the at least one processor, cause the system at least to generate the value and construct the database query are performed by a web application, and wherein the at least one memory further bears instructions that, upon execution by the at least one processor, cause the system at least to:
receive, by the web application, the user name and password from a remote computer across a communications network, the remote computer providing the user name and password as part of an attempt to log into the web application.

7. The system of claim 5 , wherein the at least one memory further bears instructions that, upon execution by the at least one processor, cause the system at least to:
in response to sending a second query to the database that involves a scan, enumerate, or wildcard operation on the database, fail to receive a response from the database indicative of the database having processed the second query.

8. The system of claim 3 , wherein the database is configured to enforce a different policy between two services that query the database.

9. The system of claim 3 , wherein the query is a Get query in a NoSQL database query format that omits a wildcard.

10. The system of claim 3 , wherein the instructions that, upon execution by the at least one processor, cause the system at least to receive the response from the database further cause the system at least to:
receive the response from the database based at least in part on the database determining that a threshold rate of queries has not been exceeded based on the policy.

11. The system of claim 10 , wherein the at least one memory further bears instructions that, upon execution by the at least one processor, cause the system at least to:
receive a response to a second query sent to the database based at least in part on the database determining that the threshold rate of queries has been exceeded, the database delaying producing the response to the second query while the threshold rate of queries is exceeded, or the database having dropped a third query from a queue of queries to be processed based at least in part on adding the second query to the queue of queries to be processed.

12. The system of claim 3 , wherein the at least one memory further bears instructions that, upon execution by the at least one processor, causes the system at least to:
receive a password reset request for the user name or a second user name; and
send, by an application, a second query indicative of a password reset to an intermediary process, the intermediary process having access to direct the database to reset passwords, the application lacking access to directly direct the database to reset passwords.

13. The system of claim 3 , wherein the at least one memory further bears instructions that, upon execution by the at least one processor, causes the system at least to:
receive a password reset request for the user name or a second user name; and
send a second query indicative of a password reset to the database, the database processing the second query by creating a new row in the database indicative of the user name and a time stamp, the database maintaining a prior row indicative of the user name and a second time stamp that is older than the time stamp.

14. A non-transitory computer-readable storage medium bearing computer-executable instructions that, when executed on a computer, cause the computer to perform operations comprising:
generating a value based at least in part on a user name and a password;
authenticating to a database using credentials associated with a policy, the policy being configured with respect to database queries such that database queries are allowed where they uniquely identify one result or no results;
constructing a database query to look up an entry in the database, the database query including an indication of the value;
sending the query to the database;
receiving a response from the database that indicates whether the database contains a row that uses the value as a key for the row; and
providing an indication that access to a resource is to be allowed based at least in part on whether the response from the database indicates whether the database contains the row that uses the value as the key for the row.

15. The non-transitory computer-readable storage medium of claim 14

Assignees

• Amazon Tech Inc

Inventors

• Demoss Matthew Daniel
• Roth Gregory Branchek
• Mikulski Andrew Paul

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06F17/30864

  Physics · mapped topic

• H04W12/068

  using credential vaults, e.g. password manager applications or one time password [OTP] applications · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title