Hardware-backed password security for cloud systems

1 . A method for data processing, comprising:

receiving, at a server host, a login request that includes a clear text password for an account associated with a tenant of a multi-tenant cloud platform;

retrieving, from a database associated with the multi-tenant cloud platform, a payload stored in association with the account, the payload comprising a hash value of a user configured password for the account, a key agreement public key associated with the account, an initialization vector, and an indication of a hashing algorithm used for generation of the hash value, wherein at least a portion of the payload is encrypted using a secret key derived from the key agreement public key associated with the account and a private key provisioned to a key protection component of the server host;

transmitting, to the key protection component, an application programming interface (API) request comprising the payload retrieved from the database and the clear text password extracted from the login request; and

receiving an API response that indicates whether a hash value of the clear text password from the login request corresponds to the hash value of the user configured password for the account.

2 . The method of claim 1 , further comprising:

providing the user configured password to the key protection component; and

receiving the payload from the key protection component.

3 . The method of claim 2 , wherein the key protection component is configured to:

generate the secret key using the key agreement public key associated with the account and the private key provisioned to the key protection component;

generate the hash value of the user configured password using the hashing algorithm;

encrypt the hash value of the user configured password and the indication of the hashing algorithm using the secret key and the initialization vector; and

include the encrypted hash value of the user configured password, the encrypted indication of the hashing algorithm, the initialization vector, and the key agreement public key in the payload.

4 . The method of claim 2 , further comprising:

storing the payload in the database;

retrieving the payload from the database in response to the login request; and

including the payload in the API request.

5 . The method of claim 1 , wherein the hashing algorithm is selected by the key protection component.

6 . The method of claim 1 , wherein:

the private key is provisioned by a key distribution service that comprises at least one of a hardware security module (HSM), or a master host, or a quorum-based key sharing service; and

the key agreement public key is generated by the key protection component.

7 . The method of claim 1 , wherein the API request is configured to cause the key protection component of the server host to:

generate the secret key using the key agreement public key in the API request and the private key provisioned to the key protection component;

decrypt the payload using the secret key and the initialization vector associated with the payload;

generate the hash value of the clear text password from the login request using the hashing algorithm associated with the payload; and

compare the hash value of the clear text password to the hash value of the user configured password for the account.

8 . The method of claim 1 , further comprising:

transmitting, to the key protection component, a message comprising the private key wrapped by a host public key associated with the server host.

9 . The method of claim 8 , wherein the message is configured to cause the key protection component to unwrap the private key using a host private key associated with the server host, wherein the host private key is locally accessible to the key protection component.

10 . The method of claim 8 , further comprising:

storing, in the database, the private key wrapped by the host public key associated with the server host.

11 . The method of claim 1 , wherein the database comprises two or more instances of the private key wrapped by respective host public keys associated with server hosts of a sub-system of the multi-tenant cloud platform that includes the server host.

12 . The method of claim 1 , wherein the hashing algorithm comprises a 256-bit secure hashing algorithm (SHA-256), a 384-bit secure hashing algorithm (SHA-384), a 512-bit secure hashing algorithm (SHA-512), or a Keccak algorithm.

13 . The method of claim 1 , wherein the API response comprises a Boolean that indicates whether the hash value of the clear text password from the login request matches the hash value of the user configured password for the account.

14 . The method of claim 1 , wherein the private key is associated with a digital certificate provisioned by a certificate authority (CA) of the multi-tenant cloud platform.

15 . The method of claim 1 , wherein the secret key is generated using an Elliptic Curve Diffie-Hellman (ECDH) key agreement scheme.

16 . An apparatus for data processing, comprising:

one or more memories storing processor-executable code; and

one or more processors coupled with the one or more memories, wherein the one or more processors are individually or collectively operable to execute the processor-executable code to cause the apparatus to:

receive, at a server host, a login request that includes a clear text password for an account associated with a tenant of a multi-tenant cloud platform;

retrieve, from a database associated with the multi-tenant cloud platform, a payload stored in association with the account, the payload comprising a hash value of a user configured password for the account, a key agreement public key associated with the account, an initialization vector, and an indication of a hashing algorithm used for generation of the hash value, wherein at least a portion of the payload is encrypted using a secret key derived from the key agreement public key associated with the account and a private key provisioned to a key protection component of the server host;

transmit, to the key protection component, an application programming interface (API) request comprising the payload retrieved from the database and the clear text password extracted from the login request; and

receive an API response that indicates whether a hash value of the clear text password from the login request corresponds to the hash value of the user configured password for the account.

17 . The apparatus of claim 16 , wherein the processor-executable code is further executable by the one or more processors to cause the apparatus to:

provide the user configured password to the key protection component; and

receive the payload from the key protection component.

18 . The apparatus of claim 17 , wherein the key protection component is configured to:

generate the secret key using the key agreement public key associated with the account and the private key provisioned to the key protection component;

generate the hash value of the user configured password using the hashing algorithm;

encrypt the hash value of the user configured password and the indication of the hashing algorithm using the secret key and the initialization vector; and

include the encrypted hash value of the user configured password, the encrypted indication of the hashing algorithm, the initialization vector, and the key agreement public key in the payload.

19 . The apparatus of claim 17 , wherein the processor-executable code is further executable by the one or more processors to cause the apparatus to:

store the payload in the database;

retrieve the payload from the database in response to the login request; and

include the payload in the API request.

20 . A non-transitory computer-readable medium storing code for data processing, the code comprising instructions executable by one or more processors to:

receive, at a server host, a login request that includes a clear text password for an account associated with a tenant of a multi-tenant cloud platform;

retrieve, from a database associated with the multi-tenant cloud platform, a payload stored in association with the account, the payload comprising a hash value of a user configured password for the account, a key agreement public key associated with the account, an initialization vector, and an indication of a hashing algorithm used for generation of the hash value, wherein at least a portion of the payload is encrypted using a secret key derived from the key agreement public key associated with the account and a private key provisioned to a key protection component of the server host;

transmit, to the key protection component, an application programming interface (API) request comprising the payload retrieved from the database and the clear text password extracted from the login request; and

receive an API response that indicates whether a hash value of the clear text password from the login request corresponds to the hash value of the user configured password for the account.