Utilization of a protected module to prevent offline dictionary attacks
AssigneeMicrosoft Technology Licensing, LLC
InventorsStuart Edward Schechter, David Alexander Molnar, Jacob Rubin Lorch, Barry Clayton Bond, Bryan Jeffrey Parno
Life of this patent
Estimating the term…
Abstract
Various technologies pertaining to authenticating a password in a manner that prevents offline dictionary attacks are described. A protected module, which can be a hardware security module, a trusted platform module, or the like, is in communication with an authentication server. The protected module comprises a key that is restricted to the protected module. The key is employed in connection with authenticating the password on the protected module.
Claims20
A method executed by a computer processor in a protected hardware module, the method comprising:
- executing a hash function over a string to generate a first hash value, wherein the string comprises:
- first data that is indicative of a purported password for a user account;
- and
- a key, the key unable to be removed from the protected hardware module;
- comparing the first hash value with a second hash value, the second hash value previously generated by the protected hardware module, the protected hardware module previously generated the second hash value by executing the hash function over a second string, the second string comprises:
- second data that is indicative of a proper password for the user account;
- and
- the key;
- when the protected hardware module determines that the first hash value is equivalent to the second hash value, outputting a signal that indicates that the purported password matches the proper password.
A computing system comprising:
- a protected hardware module, the protected hardware module comprises a key that is unable to be removed from the protected hardware module, the protected hardware module configured to perform acts comprising:
- receiving, from an authentication server, data that indicates that a user is attempting to access an account by way of the authentication server, wherein the data comprises:
- first hashed data, wherein the first hashed data was previously generated by the protected hardware module based upon the key and a proper password for the account;
- and
- data that is indicative of a purported password for the account received at the authentication server from a client computing device;
- concatenating the data that is indicative of the purported password with the key to generate concatenated data;
- executing a hash function over the concatenated data to generate second hashed data;
- comparing the first hashed data with second hashed data;
- when the first hashed data and the second hashed data are equivalent, transmitting a first signal to the authentication server that indicates that the purported password matches the proper password;
- and
- when the first hashed data and the second hashed data are inequivalent, transmitting a second signal to the authentication server that indicates that the purported password fails to match the proper password.
A method executed by a protected hardware module that is in communication with an authentication server, the authentication server configured to authenticate users attempting to access accounts of an online service, the method comprising:
- receiving data from the authentication server, the data transmitted to the protected hardware module in response to the authentication server receiving a request from a client computing device to access an account of the online service, the data comprises:
- a first string that is indicative of a purported password for the account received from the client computing device;
- and
- a first hash value, the first hash value previously generated by the protected hardware module and provided to the authentication server by the protected hardware module;
- in response to receiving the data, generating a second hash value based upon the first string and a key retained in the protected hardware module, the key unable to be removed from the protected hardware module;
- comparing the first hash value with the second hash value;
- when the first hash value is equivalent to the second hash value, transmitting a first signal that indicates that the client computing device is authenticated to access the account;
- and
- when the first hash value is inequivalent to the second hash value, transmitting a second signal that indicates that the client is to be prohibited from accessing the account.
Dependencies are inferred from the claim text.