Password manipulation for secure account creation and verification through third-party servers
AssigneeAirbnb, Inc.
InventorsIsmail Cem Paya, Kevin Nguyen
Life of this patent
Estimating the term…
Abstract
A method and system for deterring attacks at potential breach points between servers and an account and login server for creating and subsequent verification of accounts. Various cryptographic primitives are used to manipulate passwords to generate verifiers. The verifiers are used with external hardware security modules (HSMs) to eliminate HSMs and intermediate steps between the HSM and login servers as potential breach points.
Claims20
A computer implemented method comprising:
- receiving, at a trusted server, a login request comprising a login password and an account identifier (ID);
- accessing, at the trusted server, a verifier associated with the account ID, the verifier generated using an invertible masking operation on an original account password for the account ID and an encrypted version of a random number;
- masking, at the trusted server using the invertible masking operation, the login password with the verifier to generate a complementary verifier;
- sending, from the trusted server to an untrusted server communicatively coupled to but distinct from the trusted server, a decryption request comprising the complementary verifier;
- receiving, at the trusted server, a decryption status from the untrusted server;
- and
- determining, at the trusted server, an outcome of the login request based on the decryption status.
A non-transitory computer readable storage medium comprising computer program instructions that, when executed by a processor, cause the processor to perform the steps of:
- receiving, at a trusted server, a login request comprising a login password and an account identifier (ID);
- accessing, at the trusted server, a verifier associated with the account ID, the verifier generated using an invertible masking operation on an original account password for the account ID and an encrypted version of a random number;
- masking, at the trusted server using the invertible masking operation, the login password with the verifier to generate a complementary verifier;
- sending, from the trusted server to an untrusted server communicatively coupled to but distinct from the trusted server, a decryption request comprising the complementary verifier;
- receiving, at the trusted server, a decryption status from the untrusted server;
- and
- determining, at the trusted server, an outcome of the login request based on the decryption status.
Dependencies are inferred from the claim text.