Methods and apparatus for credential validation

A system comprising:

• a processor for performing credential validation,
• a tangible, non-transitory memory configured to communicate with said processor,
• said tangible, non-transitory memory having instructions stored thereon that, in response to execution by said processor, cause said processor to perform operations comprising:
• receiving, by said processor, initial credentials and a user identifier;
• encrypting, by said processor and using a user public key, said initial credentials to create modified credentials, wherein said modified credentials cannot be decrypted by an authentication server;
• adding, by said processor, a first user signature to said modified credentials using a user private key to create signed modified credentials;
• embedding, by said processor, said user identifier and said signed modified credentials within a message, wherein said sec-end is encrypted using an authentication server public key;
• adding, by said processor, a second user signature to said message using said user private key;
• transmitting, by said processor, said message to said authentication server, wherein said authentication server validates said second user signature, decrypts said message, and stores said modified signed credentials and said user identifier;
• receiving, by said processor and in response to a request by said processor, said signed modified credentials from said authentication server;
• validating, by said processor, said first signature using said user public key;
• decrypting, by said processor, said modified credentials using said user private key;
• and,
• performing, by said processor, a credential validation procedure to determine whether a credential match threshold is met.

An article of manufacture including a non-transitory, tangible computer readable medium having instructions stored thereon that, in response to execution by a computer-based system for performing credential validation, cause said computer-based system to perform operations comprising:

• receiving, by said computer-based system, initial credentials and a user identifier;
• encrypting, by said computer-based system and using a user public key, said initial credentials to create modified credentials, wherein said modified credentials cannot be decrypted by an authentication server;
• adding, by said computer-based system, a first user signature to said modified credentials using a user private key to create signed modified credentials;
• embedding, by said computer-based system, said user identifier and said signed modified credentials within a message, wherein said message is encrypted using an authentication server public key;
• adding, by said computer-based system, a second user signature to said message using said user private key;
• transmitting, by said computer-based system, said message to said authentication server, wherein said authentication server validates said second user signature, decrypts said message, and stores said signed modified credentials and said user identifier;
• receiving, by said computer-based system and in response to a request by said computer-based system, said signed modified credentials from said authentication server;
• validating, by said computer-based system, said first user signature using said user public key;
• decrypting, by said computer-based system, said modified credentials using said user private key;
• and,
• performing, a by said computer-based system, a credential validation procedure to determine whether a credential match threshold is met.