Password security hardware module

A secure device comprising:

• a main processor;
• a first interface that is adapted to connect an external visual display in communication with the main processor;
• a second interface that is adapted to connect a keyboard in communication with the main processor;
• a third interface that is adapted to connect an insecure device in communication with the main processor;
• a secure microprocessor that is connected in communication with the main processor, wherein the secure microprocessor includes a tamper-proof central processing unit (CPU) that is adapted to provide a password manager module and includes a tamper-proof memory that embodies a plurality of passwords and computer executable instructions for adapting the tamper-proof CPU to provide the password manager module;
• and
• an internal visual display connected in communication with the main processor,
• wherein the main processor is configured by the computer executable instructions to:
• securely enter a server password from the keyboard to the password manager module;
• and
• securely deliver the server password to the server via an insecure device.

A method for establishing a secure connection from a device to a server, the method comprising, at the device:

• sending a first shared secret request and an obfuscated secret value of the device from the device to the server, wherein the first shared secret request is encrypted by a symmetric rolling key known to the device and to a trusted authority but not known to the server and the first shared secret request incorporates a symmetric device obfuscation key for decrypting the device's obfuscated secret value;
• receiving a first shared secret response and an obfuscated secret value of the server from the server, wherein the first shared secret response is encrypted by the device's symmetric rolling key and the first shared secret response incorporates a symmetric server obfuscation key for decrypting the server's obfuscated secret value;
• calculating a shared secret of the device and the server by concatenating the device's secret value and the server's secret value and hashing the result;
• generating a symmetric session key for the secure connection based on the shared secret;
• and
• establishing the secure connection using the symmetric session key to encrypt all traffic between the device and the server.

A method for password-based authentication of a client to a server, the method comprising:

• the server sending a nonce to the client;
• the client generating a cryptographically secure hash from the nonce and a secure hashed version of a client password;
• the client sending the cryptographically secure hash to the server;
• the server, which has a copy of the secure hashed version of the client password, verifying that the cryptographically secure hash can only be generated from the secure hashed version of the password and the nonce;
• and
• the server granting access to the client in response to the verifying step.