Granted Patent B2

US 9,774,591 · App. 14/515,499 · Granted Sep 26, 2017

Abstract

Claims (92)

1. A computer implemented method comprising:

receiving, at a trusted server, a login request comprising a login password and an account ID;

applying one or more cryptographic primitives to the login password to generate a cryptographic login password;

accessing a previously stored verifier associated with the account ID, the verifier generated by masking, using an invertible masking operation, a cryptographic version of an original account password with an encrypted version of a random number;

masking, at the trusted server using the invertible masking operation, the cryptographic login password with the verifier to generate a complementary verifier that obfuscates the login password;

sending a decryption request to an untrusted server communicatively coupled to the trusted server but physically located in a distinct piece of computer hardware different from that of the trusted server, the decryption request comprising the complementary verifier, the decryption request causing the untrusted server to:

attempt to decrypt the complementary verifier using private key decryption, the private key stored by the untrusted server, and

receiving a decryption status at the trusted server from the untrusted server; and

determining, at the trusted server, an outcome of the login request based on the decryption status.

2. The computer implemented method of claim 1 , wherein the one or more cryptographic primitives is a hash function that includes a salt.

3. The computer implemented method of claim 1 , wherein the invertible mathematical operation includes at least one mathematical operation from a group consisting of: a multiplication operation, an addition operation, an AND operation, an OR operation, an XOR operation, and an XNOR operation.

4. The computer implemented method of claim 1 ,

wherein the received decryption status indicates that the decrypted complementary verifier matches the random number associated with the account ID; and

responsive to the decryption status, determining that the outcome of the login request is a successful login.

5. The computer implemented method of claim 1 ,

wherein either the decryption unsuccessful result is received or the received decryption status indicates that the decrypted complementary verifier does not match the random number associated with the account ID; and

responsive to the decryption status, determining that the outcome of the login request is an unsuccessful login.

6. The computer implemented method of claim 1 , wherein the complementary verifier is masked with a blinding factor, the method further comprising:

generating the blinding factor at the trusted server;

encrypting the blinding factor at the trusted server; and

blinding the complementary verifier with the blinding factor at the trusted server.

7. The computer implemented method of claim 6 , wherein receiving the decryption status further comprises:

determining that the outcome of the login request is an unsuccessful login if the blinding factor is not extracted from the received decryption status within a threshold period of time.

8. The computer implemented method of claim 6 , further comprising:

extracting the blinding factor from the received decryption status at the trusted server.

9. A computer implemented method comprising:

receiving, at a trusted server, a login request comprising a login password and an account ID;

applying one or more cryptographic primitives to the login password to generate a cryptographic login password;

accessing a previously stored verifier and a previously stored random number, both of which are associated with the account ID, the verifier generated by masking, using an invertible masking operation, a cryptographic version of an original account password with an encrypted version of a random number;

masking, at the trusted server using the invertible masking operation, the cryptographic login password with the verifier to generate a complementary verifier that obfuscates the login password;

sending a decryption request to an untrusted server communicatively coupled to the trusted server but physically located in a distinct piece of computer hardware different from that of the trusted server, the decryption request comprising the complementary verifier, the decryption request causing the untrusted server to:

attempt to decrypt the complementary verifier using private key decryption, the private key stored by the untrusted server;

receiving a decrypted version of the complementary verifier at the trusted server from the untrusted server;

comparing the decrypted version of the complementary verifier against the previously stored random number; and

determining, at the trusted server, an outcome of the login request based on the comparison.

10. The computer implemented method of claim 9 , wherein the one or more cryptographic primitives is a hash function that includes a salt.

11. The computer implemented method of claim 9 , wherein the invertible mathematical operation includes at least one mathematical operation from a group consisting of: a multiplication operation, an addition operation, an AND operation, an OR operation, an XOR operation, and an XNOR operation.

12. The computer implemented method of claim 9 , wherein the complementary verifier is blinded with a blinding factor, the method further comprising:

generating the blinding factor at the trusted server;

applying one or more cryptographic primitives to the blinding factor at the trusted server;

blinding the complementary verifier with the cryptographic blinding factor at the trusted server; and

awaiting receipt of the decrypted version of the blinded complementary verifier at the trusted server from the untrusted server.

13. The computer implemented method of claim 12 , wherein receiving the decrypted version of the blinded complementary verifier further comprises:

determining that the outcome of the login request is an unsuccessful login if the blinding factor is not extracted from the received decrypted version of the blinded complementary verifier within a threshold period of time.

14. The computer implemented method of claim 12 , further comprising:

extracting the blinding factor from the received decrypted version of the blinded complementary verifier at the trusted server.

15. A non-transitory computer readable storage medium comprising computer program instructions that when executed by a processor causes the processor to:

receive, at a trusted server associated with the processor, a login request comprising a login password and an account ID;

apply one or more cryptographic primitives to the login password to generate a cryptographic login password;

access a previously stored verifier associated with the account ID, the verifier generated, by masking, using an invertible masking operation, a cryptographic version of an original account password with an encrypted version of a random number;

mask, at the trusted server using the invertible masking operation, the cryptographic login password with the verifier to generate a complementary verifier that obfuscates the login password;

send a decryption request to an untrusted server communicatively coupled to the trusted server but physically located in a distinct piece of computer hardware different from that of the trusted server, the decryption request comprising the complementary verifier, the decryption request causing the untrusted server to:

attempt to decrypt the complementary verifier using private key decryption, the private key stored by the untrusted server, and

receive a decryption status at the trusted server from the untrusted server; and

determine, at the trusted server, an outcome of the login request based on the decryption status.

16. The computer readable storage medium of claim 15 , wherein the one or more cryptographic primitives is a hash function that includes a salt.

17. The computer readable storage medium of claim 15 , wherein the invertible mathematical operation includes at least one mathematical operation from a group consisting of: a multiplication operation, an addition operation, an AND operation, an OR operation, an XOR operation, and an XNOR operation.

18. The computer readable storage medium of claim 15 ,

wherein the received decryption status indicates that the decrypted complementary verifier matches the random number associated with the account ID; and

responsive to the decryption status, determining that the outcome of the login request is a successful login.

19. The computer readable storage medium of claim 15 ,

wherein either the decryption unsuccessful result is received or the received decryption status indicates that the decrypted complementary verifier does not match the random number associated with the account ID; and

responsive to the decryption status, determining that the outcome of the login request is an unsuccessful login.

20. The computer readable storage medium of claim 15 , wherein the complementary verifier is masked with a blinding factor, the method further comprising:

generating the blinding factor at the trusted server;

encrypting the blinding factor at the trusted server; and

blinding the complementary verifier with the blinding factor at the trusted server.

21. The computer readable storage medium of claim 20 , wherein receiving the decryption status further comprises:

determining that the outcome of the login request is an unsuccessful login if the blinding factor is not extracted from the received decryption status within a threshold period of time.

22. The computer readable storage medium of claim 20 , further comprising:

extracting the blinding factor from the received decryption status at the trusted server.

23. A non-transitory computer readable storage medium comprising computer program instructions that when executed by a processor causes the processor to:

receive, at a trusted server associated with the processor, a login request comprising a login password and an account ID;

apply one or more cryptographic primitives to the login password to generate a cryptographic login password;

access a previously stored verifier and a previously stored random number, both of which are associated with the account ID, the verifier generated by masking, using an invertible masking operation, a cryptographic version of an original account password with an encrypted version of a random number;

mask, at the trusted server using the invertible masking operation, the cryptographic login password with the masked password to generate a complementary verifier that obfuscates the login password;

send a decryption request to an untrusted server communicatively coupled to the trusted server but physically located in a distinct piece of computer hardware different from that of the trusted server, the decryption request comprising the complementary verifier, the decryption request causing the untrusted server to:

attempt to decrypt the complementary verifier using private key decryption, the private key stored by the untrusted server;

receive a decrypted version of the complementary verifier at the trusted server from the untrusted server;

compare the decrypted version of the complementary verifier against the previously stored random number; and

determine, at the trusted server, an outcome of the login request based on the comparison.

24. The computer readable storage medium of claim 23 , wherein the one or more cryptographic primitives is a hash function that includes a salt.

25. The computer readable storage medium of claim 23 , wherein the invertible mathematical operation includes at least one mathematical operation from a group consisting of: a multiplication operation, an addition operation, an AND operation, an OR operation, an XOR operation, and an XNOR operation.

26. The computer readable storage medium of claim 23 , wherein the complementary verifier is blinded with a blinding factor, the method further comprising:

generating the blinding factor at the trusted server;

applying one or more cryptographic primitives to the blinding factor at the trusted server;

blinding the complementary verifier with the cryptographic blinding factor at the trusted server; and

awaiting receipt of the decrypted version of the blinded complementary verifier at the trusted server from the untrusted server.

27. The computer readable storage medium of claim 26 , wherein receiving the decrypted version of the blinded complementary verifier further comprises:

determining that the outcome of the login request is an unsuccessful login if the blinding factor is not extracted from the received decrypted version of the blinded complementary verifier within a threshold period of time.

28. The computer readable storage medium of claim 26 , further comprising:

extracting the blinding factor from the received decrypted version of the blinded complementary verifier at the trusted server.

Assignments (7)