System and method for securely storing and utilizing password validation data
OwnerArnold G. Reinholdinventor
Life of this patent
Estimating the term…
Abstract
A system and method for storing and accessing password verification data on multi-user computer systems that prevents remote attacks. Along with commonly-employed measures that limit the number of unsuccessful attempts to login or otherwise verify a password, it allows users to choose relatively simple passwords with full security. The secret component cannot be easily leaked or exfiltrated does not require periodic backup and is isolated in a way that allows it to be protected by conventional security measures such as safes, alarm systems and video surveillance from attackers who somehow gain access to the computing facility.
Claims20
A method for password authentication comprising:
- obtaining a user id and a password as input on a password management module (PMM) comprising software executing on a processor configured to communicate with a restricted secret server (RSS);
- generating a salt on the password management module;
- securely sending a message including the salt to the RSS having a very large key (VLK) module;
- wherein securely sending a message to the RSS comprises:
- sending the message via a secure, authenticated link to at least one data guard;
- authenticating the message on the at least one data guard;
- and
- forwarding the message from the at least one data guard via a dedicated link to the RSS, wherein the at least one data guard is a module located within the RSS, and wherein the at least one data guard provides an interface between a restricted secret server network interface (RSS-NI) and the RSS;
- generating a block of unpredictable data by a cryptographically-strong bit stream generator;
- loading the block of unpredictable data into the VLK module;
- using the salt included in the message as a seed for a deterministic random number generator (DRNG) on the restricted secret server;
- using the seeded DRNG to select multiple subsets of data from the block of unpredictable data;
- combining the multiple subsets of data from the block of unpredictable data to form a password authenticator token;
- and
- securely sending a return message including the password authenticator token to the PMM, wherein securely sending a return message comprises:
- sending the return message from the restricted secret server via a second dedicated link to the at least one data guard;
- authenticating the return message on the at least one data guard;
- and
- forwarding the return message via a secure, authenticated link to the PMM;
- and
- wherein only the PMM can query the RSS using a secure link within one of:
- a data center's intranet to access the RSS;
- and
- a direct communication link between the PMM and the RSS.
A system for password authentication comprising:
- a password management module (PMM);
- a restricted secret server (RSS) having at least one very large key (VLK) module, a restricted secret server network interface (RSS-NI) interconnecting the RSS with the PMM and
- a data guard disposed between the RSS-NI and the VLK module,
- wherein the data guard is disposed between the RSS-NI and the at least one VLK storage module and is configured to restrict and sanitize request data by enforcing message formats and restricting the transfer rate of VLK data.
Dependencies are inferred from the claim text.