System and method for securely storing and utilizing password validation data
OwnerArnold G. Reinholdinventor
Life of this patent
Estimating the term…
Abstract
A system and method for storing and accessing password verification data on multi-user computer systems that prevents remote attacks. Along with commonly-employed measures that limit the number of unsuccessful attempts to login or otherwise verify a password, it allows users to choose relatively simple passwords with full security. The secret component cannot be easily leaked or exfiltrated does not require periodic backup and is isolated in a way that allows it to be protected by conventional security measures such as safes, alarm systems and video surveillance from attackers who somehow gain access to the computing facility.
Claims20
A method for password authentication comprising:
- obtaining a user id and a password as input on a password management module (PMM);
- generating a salt on the password management module;
- securely sending a message including the salt to a restricted secret server (RSS) having a very large key (VLK) module;
- generating a block of unpredictable data by a cryptographically-strong bit stream generator;
- loading the block of unpredictable data into the VLK module;
- wherein the block of unpredictable data stored in the VLK module has a size such that a time to transfer the block of unpredictable data deters exfiltrating the block of unpredictable data out of the restricted secret server;
- using the salt included in the message as a seed for a deterministic random number generator (DRNG) on the restricted secret server;
- using the seeded DRNG to select multiple subsets of data from the block of unpredictable data;
- combining the multiple subsets of data from the block of unpredictable data to form a password authenticator token;
- securely sending a return message including the password authenticator token to the password management module;
- combining the password authenticator token with the password to form an input to a cryptographic hash function, an output of which is a password authenticator field;
- and
- storing the salt and the password authenticator field in a storage record associated with the user id in a database on the password management module.
A system for password authentication comprising:
- a password management module (PMM);
- a restricted secret server (RSS) having at least one very large key (VLK) module, a restricted secret server network interface (RSS-NI) interconnecting the RSS with the PMM and a data guard disposed between the RSS-NI and the VLK module;
- and
- wherein a VLK and the VLK module are large enough to deter unauthorized transfer of the VLK out of the RSS.
Dependencies are inferred from the claim text.