Cryptographically linking data and authentication identifiers without explicit storage of linkage

A computer program product comprising a non-transitory machine-readable recordable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by a processor of a server store a data secret of a client by implementing the following steps of:

• receiving an authentication identifier identifying an authentication secret, said data secret, and a pseudo-random client value from said client;
• determining a pseudo-random server value associated with said received authentication identifier;
• calculating, using at least one processing device, a storage seed based on a first cryptographic hash function using said pseudo-random client value and said pseudo-random server value as input;
• obtaining, using at least one processing device, a storage authentication identifier identifying said authentication secret using said storage seed;
• obtaining, using at least one processing device, a storage data identifier identifying said data secret using a second cryptographic hash function using said storage seed and a sequence number as input, if said storage authentication identifier is substantially equal to said received authentication identifier, wherein said sequence number is associated with said data secret and wherein said storage data identifier is not accessible by said client;
• storing, using at least one processing device, said data secret in a memory location of a memory of said server based on said storage data identifier if said storage authentication identifier is substantially equal to said received authentication identifier;
• and
• returning said sequence number associated with said stored data secret to said client.

A server apparatus for storing a data secret of a client, the apparatus comprising:

• a memory;
• and
• at least one processing device comprising at least one processor, coupled to the memory, configured to:
• receive an authentication identifier identifying an authentication secret, said data secret, and a pseudo-random client value from said client;
• determine a pseudo-random server value associated with said received authentication identifier;
• calculate, using at least one processing device, a storage seed based on a first cryptographic hash function using said pseudo-random client value and said pseudo-random server value as input;
• obtain, using at least one processing device, a storage authentication identifier identifying said authentication secret using said storage seed;
• obtain, using at least one processing device, a storage data identifier identifying said data secret using a second cryptographic hash function using said storage seed and a sequence number as input, if said storage authentication identifier is substantially equal to said received authentication identifier, wherein said sequence number is associated with said data secret and wherein said storage data identifier is not accessible by said client;
• store, using at least one processing device, said data secret in a memory location of a memory of said server based on said storage data identifier if said storage authentication identifier is substantially equal to said received authentication identifier;
• and
• return said sequence number associated with said stored data secret to said client.