Protection and verification of user authentication credentials against server compromise

#The disclosure relates generally to protection of user authentication credentials stored on a server and more specifically to verification of a user of a client device by the server during authentication using a decryption key received from the client device to decrypt a credential blob stored in a user authentication account on the server.

#An open problem in network security is the vulnerability of credential verification information stored on a server to wholesale theft in the event of server compromise. Credentials are a way to identify and authenticate a client device user. Examples of credentials may include user names, passwords, and biometric data corresponding to the user. These credentials are stored on the server for comparison with received credentials for verification and authentication of client device users.

#However, there are many different types of compromises available to exploit a server to misappropriate these stored credentials. Under many circumstances, an attacker may exploit a server using common techniques, such as using a brute force attack to guess a weak password or attempting to use known vulnerabilities in software of the server in hopes the server is not on a regular patch schedule. In addition, attackers are always evolving and changing their tactics.

#FIG. 1 is a pictorial representation of a network of data processing systems in which illustrative embodiments may be implemented;

#FIG. 2 is a diagram of a data processing system in which illustrative embodiments may be implemented;

#FIG. 3 is a diagram illustrating a cloud computing environment in which illustrative embodiments may be implemented;

#The present invention may be a system, a method, and/or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention.

#The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

#Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.