# US 9,292,674 B2 · Password encryption key

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,292,674 B2
- Document ID: US9292674B2
- Status: Granted
- Kind: B2
- Application number: 13/896,633
- Filed: 2013-05-17
- Published: 2013-12-05
- Granted: 2016-03-22
- Earliest claimed: 2002-10-25
- Assignees: Cambridge Interactive Development Corp.
- Applicants: Cambridge Interactive Development Corp.
- Inventors: Daniil Utin
- Web page: https://patentgrep.com/patent/US9292674B2

## CPC

- G06F 21/31: User authentication
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A password-encrypted key (PEK) is generated from a user-supplied password or other identifying data and then used to encrypt the user's password. The encrypted password is stored in a user record on a server. At login a would-be user's password is again used to make a key, which is then used to decrypt and compare the stored encrypted password with the would-be user's password to complete the login. The successful PEK is stored in a temporary session record and can be used to decrypt other sensitive user information previously encrypted and stored in the user record as well as to encrypt new information for storage in the user record. A public/private key system can also be used to maintain limited access for the host to certain information in the user record.

## Claims

### Claim 1

A computer-implemented method, comprising:
upon receiving, at a server, data from a computing device that represents a user login password, generating a key from the would-be user's password by calculating a checksum;
retrieving a corresponding user record;
decrypting an encrypted password in the user record using the key, the encrypted password being encrypted by using an unencrypted password previously provided by the user and a previously generated key, wherein the previously generated key is generated from the previously provided unencrypted password;
comparing the decrypted password and the user login password to determine if they match; and
if the decrypted password and user login password match, creating a temporary session record and storing the key in the session record, otherwise aborting the user login, the stored key being usable to decrypt other encrypted information stored in the user record during a session.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, further comprising:
generating a public/private key pair,
storing the public key on an application server and the mating private key only on another server,
encrypting the previously provided unencrypted password with the public key and storing the public-key encrypted password on the application server, and
fetching the private key from the other server and using it to decrypt selected information on the application server.

### Claim 3 (depends on 2)

The computer-implemented method of claim 2, wherein the other server is a secure offsite server.

### Claim 4

A computer-executable program residing on a server, the execution of the program causing the server to:
upon receiving, at the server, data from a computing device that represents a user login password, generating a key from the would-be user's password by calculating a checksum;
retrieving a corresponding user record;
decrypting an encrypted password in the user record using the key, the encrypted password being encrypted by using an unencrypted password previously provided by the user and a previously generated key, wherein the previously generated key is generated from the previously provided unencrypted password;
comparing the decrypted password with the user login password to determine if they match; and
if the decrypted password and user login password match, creating a temporary session record and storing the key in the session record, otherwise aborting the user login, the stored key being usable to decrypt other encrypted information stored in the user record during a session.

### Claim 5

A computing device comprising:
a memory configured to store instructions; and
a processor configured to execute instructions to perform operations comprising:
upon receiving data from a computing device that represents a user login password, generating a key from the would-be user's password by calculating a checksum;
retrieving a corresponding user record;
decrypting an encrypted password in the user record using the key, the encrypted password being encrypted by using an unencrypted password previously provided by the user and a previously generated key, wherein the previously generated key is generated from the previously-supplied unencrypted password;
comparing the decrypted password with the user login password to see if they match; and
if the decrypted password and user login password match, creating a temporary session record and storing the key in the session record, otherwise aborting the user login, the stored key being usable to decrypt other encrypted information stored in the user record during a session.

### Claim 6 (depends on 5)

The computing device of claim 5, wherein the processor is configured to execute instructions to perform operations comprising:
encrypting sensitive user data using the previously generated key;
storing the encrypted sensitive user data in the user record;
using the key to decrypt the stored encrypted sensitive user data; and
storing the decrypted sensitive user data in the temporary user session record.