US 2006/0156026 A1 · Password encryption key

Abstract

A password-encrypted key (PEK) is generated from a user-supplied password or other identifyting data and then used to encrypt the user's password. The encrypted password is stored in a user record on a server. At login a would-be user's password is again used to make a key, which is then used to decrypt and compare the stored encrypted password with the would-be user's password to complete the login. The successful PEK is stored in a temporary session record and can be used to decrypt other sensitive user information previously encrypted and stored in the user record as well as to encrypt new information for storage in the user record. A public/private key system can also be used to maintain limited access for the host to certain information in the user record.

Claims10

Dependent claims

A secure transaction process, comprising

generating a key from a user-supplied unencrypted password,
encrypting the user's password with the key,
creating a user record,
storing the encrypted password in the user record.

1 more element

Dependencies are inferred from the claim text.

Facts

Application

10/532,541Filed 23 Oct 2003

Priority

25 Oct 2002

Published

13 Jul 2006

Term ends

Not estimatedThe source records don’t support an estimate.

Classification11 codes

G06F 21/31
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
G06F 21/62
Protecting data: protecting access to data via a platform, e.g. using keys or access control rules
G06F 21/6245
To a system of files or objects, e.g. local or distributed file system or database: protecting personal data, e.g. for financial or medical purposes
H04L 9/0863
Generation of secret information including derivation or calculation of cryptographic keys or passwords: involving passwords or one-time passwords

Password encryption key

Life of this patent

Password encryption key

Life of this patent

Abstract

Claims10