Iterated password hash systems and methods for preserving password entropy

#This disclosure relates generally to password authentication and, more particularly, to password authenticated systems and methods using iterated hashes.

#Modern computer systems or microprocessor based electronic devices are often interconnected by large scale communication networks. Interconnected systems, such as these, may though be vulnerable to attacks from hackers or other malicious systems. To defend or prevent such attacks, a variety of network security techniques, such as cryptographic tools, have been developed. Cryptographic tools may encrypt and decrypt messages exchanged between different computer systems or keep certain user information secret.

#Cryptographic tools may also encrypt secret passwords used by users to login to a computer system. In such an application, the password may be encrypted by the use of a hash function. A hash function can be viewed as a one-way mathematical function that encrypts data. The one-way indicates that, for practical purposes, the one-way hash cannot be calculated backwards; meaning that the hash value cannot be decrypted to reveal the password in clear text again.

#The accompanying drawings, which are incorporated in and constitute a part of this specification, show certain aspects of the present invention and, together with the description, help explain some of the principles associated with the invention. In the drawings:

#FIG. 1 is a pictorial illustration of an exemplary password authentication environment consistent with the present invention;

#FIG. 2 illustrates a block diagram of an exemplary server, consistent with an exemplary embodiment of the present invention, used to perform password authentication;

#Reference will now be made in detail to the invention, examples of which are illustrated in the accompanying drawings. The implementations set forth in the following description do not represent all implementations consistent with the claimed invention. Instead, they are merely some examples consistent with certain aspects related to the invention. Wherever possible, the same reference numbers will be used throughout the drawings to refer to the same or like parts.

#FIG. 1 illustrates an exemplary system 100 for illustrating authentication procedures consistent with the present invention. As shown in FIG. 1, system 100 may include a network 110 coupled to a client system 120, a remote server 130, and an intermediary server 140. Client system 120 may thus communicate with servers 130 and 140 via network 110. Network 110 may be any appropriate type of data communication network, such as the Internet. The Internet may refer to any publicly accessible network or networks interconnected via communication protocols, such as transmission control protocol/internet protocol (TCP/IP). System 100 may also include, as shown, a private network 150 coupled to intermediary server 140 and a private server 160. Intermediary server 140 may thus communicate with private server 160 via private network 150. Private network 150 may be any appropriate type of data communication network, such as a local area network or other private computer network. In exemplary embodiments, access to private network 150 may be limited by a firewall (not shown).

#Client system 120 may, however, communicate with private network 150 and private server 160 via intermediary server 140. To do so, intermediary server 140 must first authenticate the user of client system 120 before permitting access to private network 150 and private server 160. For instance, the user of client system 120 may be required to provide a password to intermediary server 140. If intermediary server 140 determines that the provided password corresponds to a stored version of the password, then intermediary server 140 authenticates the user and grants client system 120 access to private server 160 via private network 140. Other components of system 100 may perform similar password authentication procedures. For instance, client system 120 may perform similar password authentication procedures with remote server 130.