# US 11,451,374 B2 · Automatic password rollover > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,374 B2 - Document ID: US11451374B2 - Status: Granted - Kind: B2 - Application number: 17/183,973 - Filed: 2021-02-24 - Published: 2022-08-25 - Granted: 2022-09-20 - Earliest claimed: 2021-02-24 - Assignees: Micro Focus LLC - Applicants: Micro Focus LLC - Inventors: Vamsi Krishna; Harinath Jarugula; Keshavan Santhanam - Web page: https://patentgrep.com/patent/US11451374B2 ## CPC - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/0841: {involving Diffie-Hellman or related key agreement protocols} - H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A first device nonce and a first Hash based Message Authentication Code (HMAC) of the first device nonce using an old password as a key is received. The received first HMAC is compared to a computed second HMAC of the received first device nonce using a stored old password as the key for a match. In response to the match, a third HMAC of a second device nonce using the stored old password as the key is computed. A change password acknowledgement message is sent to the first device that comprises the second device nonce and the third HMAC. A final secret is computed using a second device secret and the first device nonce. A new password using a key derivation function that uses the old password and the final secret is computed. Thus, a new password is generated without sending the password over a network. ## Claims ### Claim 1 A system comprising: a microprocessor; and a computer readable medium, coupled with the microprocessor and comprising microprocessor readable and executable instructions that, when executed by the microprocessor, cause the microprocessor to: receive, from a first device, at a second device, a first device nonce and a first Hash based Message Authentication Code (HMAC) of the first device nonce using an old password as a key; compare the received first HMAC to a computed second HMAC of the received first device nonce using a stored old password as the key for a match; in response to the match, compute a third HMAC of a second device nonce using the stored old password as the key; send a change password acknowledgement message to the first device that comprises the second device nonce and the third HMAC; compute a final secret using a second device secret and the first device nonce; and compute a new password using a key derivation function that uses the old password and the final secret. ### Claim 2 (depends on 1) The system of claim 1, wherein the microprocessor readable and executable instructions further cause the microprocessor to: generate the second device secret; compute the second device nonce, wherein the second device nonce is computed using gsecond device secret mod and wherein the final secret is computed using (first device nonce)second device secret mod p. ### Claim 3 (depends on 1) The system of claim 1, wherein the microprocessor readable and executable instructions further cause the microprocessor to: receive, from the first device, a change password finalize message that contains a hash of the old password and the new password; verify the hash of the old password and the new password; in response to verifying the hash of the old password and the new password, send a change password complete message that has a hash of the new password and the stored old password; receive a rollover new password commit message; and send a new password updated acknowledgement message. ### Claim 4 (depends on 3) The system of claim 3, wherein an order of the hash of the old password and the new password of the received change password finalize message and an order of the new password and the stored old password of the change password complete message are reversed. ### Claim 5 (depends on 3) The system of claim 3, wherein the microprocessor readable and executable instructions further cause the microprocessor to: start using the new password. ### Claim 6 (depends on 1) The system of claim 1, wherein the received first HMAC is sent based on at least one of: an event, a time period, a detected security breach, and an administered value. ### Claim 7 (depends on 1) The system of claim 1, wherein receiving the first device nonce and the first Hash based Message Authentication Code (HMAC) further comprises receiving one or more Diffie-Hellman key exchange parameters. ### Claim 8 A method comprising: receiving, by a microprocessor, a first device nonce and a first Hash based Message Authentication Code (HMAC) of the first device nonce using an old password as a key; comparing, by the microprocessor, the received first HMAC to a computed second HMAC of the received first device nonce using a stored old password as the key for a match; in response to the match, computing, by the microprocessor, a third HMAC of a second device nonce using the stored old password as the key; sending, by the microprocessor, a change password acknowledgement message that comprises the second device nonce and the third HMAC; computing, by the microprocessor, a final secret using a second device secret and the first device nonce; and computing, by the microprocessor, a new password using a key derivation function that uses the old password and the final secret. ### Claim 9 (depends on 8) The method of claim 8, further comprising: generating the second device secret; computing the second device nonce, wherein the second device nonce is computed using gsecond device secret mod p, and wherein the final secret is computed using (first device nonce)second device secret mod p. ### Claim 10 (depends on 8) The method of claim 8, further comprising: receiving a change password finalize message that contains a hash of the old password and the new password; verifying the hash of the old password and the new password; in response to verifying the hash of the old password and the new password, sending a change password complete message that has a hash of the new password and the stored old password; receiving a rollover new password commit message; and sending a new password updated acknowledgement message. ### Claim 11 (depends on 10) The method of claim 10, wherein an order of the hash of the old password and the new password of the received change password finalize message and an order of the new password and the stored old password of the change password complete message are reversed. ### Claim 12 (depends on 10) The method of claim 10, further comprising, using the new password. ### Claim 13 (depends on 8) The method of claim 8, wherein the received first HMAC is sent based on at least one of: an event, a time period, a detected security breach, and an administered value. ### Claim 14 (depends on 8) The method of claim 8, wherein receiving the first device nonce and the first Hash based Message Authentication Code (HMAC) further comprises receiving one or more Diffie-Hellman key exchange parameters. ### Claim 15 A system comprising: a microprocessor; and a computer readable medium, coupled with the microprocessor and comprising microprocessor readable and executable instructions that, when executed by the microprocessor, cause the microprocessor to: compute a first Hash based Message Authentication Code (HMAC) using a first device nonce with a stored old password as a key; send, from a first device, to a second device, the first device nonce and the first HMAC of the first device nonce with the stored old password as the key; receive a change password acknowledgment message from the second device that comprises a second device nonce and a second HMAC of a second device nonce using an old password as the key; compute a final secret using a first device secret and the second device nonce; and compute a new password using a key derivation function that uses the old password and the final secret. ### Claim 16 (depends on 15) The system of claim 15, wherein the microprocessor readable and executable instructions further cause the microprocessor to: generate the first device secret; compute the first device nonce, wherein the first device nonce is computed using gfirst device secret mod p, and wherein the final secret is computed using (second device nonce)first device secret mod p. ### Claim 17 (depends on 15) The system of claim 15, wherein the microprocessor readable and executable instructions further cause the microprocessor to: send, from the first device, a change password finalize message that contains a hash of the old password and the new password; receive a change password complete message that has a hash of the new password and the old password; verify the hash of the old password and the new password; send a rollover new password commit message; and receive a new password updated acknowledgement message. ### Claim 18 (depends on 17) The system of claim 17, wherein an order of the hash of the old password and the new password of the sent change password finalize message and an order of the new password and the stored old password of the change password complete message are reversed. ### Claim 19 (depends on 17) The system of claim 17, wherein the microprocessor readable and executable instructions further cause the microprocessor to: start using the new password. ### Claim 20 (depends on 15) The system of claim 15, wherein the first sent HMAC is sent based on at least one of: an event, a time period, a detected security breach, and an administered value.