Back to results
US 2021/0243026 A1Published application
Password based threshold token generation
AssigneeVisa International Service Association
InventorsPayman Mohassel, Shashank Agrawal, Pratyay Mukherjee, Peihan Miao
Life of this patent
Estimating the term…
Abstract
Embodiments disclosed herein are directed to methods and systems of password-based threshold authentication, which distributes the role of an authentication server among multiple servers. Any t servers can collectively verify passwords and generate authentication tokens, while no t−1 servers can forge a valid token or mount offline dictionary attacks.
Claims21
A method for obtaining an access token by a client, the method comprising:
- receiving a credential for gaining access to a computer resource;
- hashing the credential to obtain a first hash;
- sending request messages to a plurality of servers, each request message including a blinded hash of the first hash and a user identifier;
- receiving response messages from the plurality of servers, each response message from a corresponding server including:
- a partial hash response generated using the blinded hash sent to the corresponding server and a secret share, and
- an encrypted token share from each of the plurality of servers, the encrypted token share being generated by encrypting a token share using a hash portion that was previously generated by the client and sent to the corresponding server, the hash portion being generated using the first hash and the secret share;
- deblinding each of the partial hash responses to obtain the hash portions;
- decrypting the encrypted token shares using the hash portions to obtain the token shares;
- and
- combining the token shares to obtain the access token.
7 more elements
A method comprising performing, by a server computer:
- receiving a request message from a client, the request message including a blinded hash of a first hash of a credential and a user identifier;
- generating a partial hash response using the blinded hash and a secret share;
- determining a hash portion corresponding to the user identifier, the hash portion previously received from the client and generated using the first hash and the secret share;
- generating a token share based on the user identifier and the secret share;
- encrypting the token share using the hash portion corresponding to the user identifier;
- and
- sending a response message to the client, the response message including the partial hash response and the encrypted token share.
4 more elements
(canceled)
A system comprising:
- one or more processors;
- and
- a non-transitory computer readable memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform a method for obtaining an access token by a client, the method comprising:
- receiving a credential for gaining access to a computer resource;
- hashing the credential to obtain a first hash;
- sending request messages to a plurality of servers, each request message including a blinded hash of the first hash and a user identifier;
- receiving response messages from the plurality of servers, each response message from a corresponding server including:
- a partial hash response generated using the blinded hash sent to the corresponding server and a secret share, and
- an encrypted token share from each of the plurality of servers, the encrypted token share being generated by encrypting a token share using a hash portion that was previously generated by the client and sent to the corresponding server, the hash portion being generated using the first hash and the secret share;
- deblinding each of the partial hash responses to obtain the hash portions;
- decrypting the encrypted token shares using the hash portions to obtain the token shares;
- and
- combining the token shares to obtain the access token.
10 more elements
Dependencies are inferred from the claim text.