Back to results
US 2016/0112396 A1Published application
Password Manipulation for Secure Account Creation and Verification Through Third-Party Servers
AssigneeAirbnb, Inc.
InventorsIsmail Cem Paya, Kevin Nguyen
Life of this patent
Estimating the term…
Abstract
A method and system for deterring attacks at potential breach points between servers and an account and login server for creating and subsequent verification of accounts. Various cryptographic primitives are used to manipulate passwords to generate verifiers. The verifiers are used with external hardware security modules (HSMs) to eliminate HSMs and intermediate steps between the HSM and login servers as potential breach points.
Claims26
A computer implemented method comprising:
- receiving, at a trusted server, a request to create a new account, the request comprising an account identification (ID) and a password;
- applying one or more cryptographic primitives to the password to generate a cryptographic password;
- accessing, by the trusted server, a random number;
- encrypting the random number using a public key cryptography scheme;
- masking, at the trusted server, the cryptographic password with the encrypted random number to generate a verifier that obfuscates the cryptographic password;
- and
- storing, at a verifier store, the verifier in association with the account ID for the new account, the verifier store coupled to the trusted server but physically located in a distinct piece of computer hardware different from that of the trusted server.
4 more elements
A computer implemented method comprising:
- receiving, at a trusted server, a login request comprising a login password and an account ID;
- applying one or more cryptographic primitives to the login password to generate a cryptographic login password;
- accessing a previously stored verifier associated with the account ID;
- masking, at the trusted server, the cryptographic login password with the verifier to generate a complementary verifier that obfuscates the login password;
- sending a decryption request to an untrusted server communicatively coupled to the trusted server but physically located in a distinct piece of computer hardware different from that of the trusted server, the decryption request comprising the complementary verifier, the decryption request causing the untrusted server to:
- decrypt the complementary verifier using private key decryption, the private key stored by the untrusted server, and
- receiving a decryption status at the trusted server from the untrusted server;
- and
- determining, at the trusted server, an outcome of the login request based on the decryption status.
6 more elements
A computer implemented method comprising:
- receiving, at a trusted server, a login request comprising a login password and an account ID;
- applying one or more cryptographic primitives to the login password to generate a cryptographic login password;
- accessing a previously stored verifier and a previously stored random number, both of which are associated with the account ID;
- masking, at the trusted server, the cryptographic login password with the masked password to generate a complementary verifier that obfuscates the login password;
- sending a decryption request to an untrusted server communicatively coupled to the trusted server but physically located in a distinct piece of computer hardware different from that of the trusted server, the decryption request comprising the complementary verifier, the decryption request causing the untrusted server to:
- decrypt the complementary verifier using private key decryption, the private key stored by the untrusted server;
- receiving a decrypted version of the complementary verifier at the trusted server from the untrusted server;
- comparing the decrypted version of the complementary verifier against the previously stored random number;
- and
- determining, at the trusted server, an outcome of the login request based on the comparison.
7 more elements
Dependencies are inferred from the claim text.