Updating stored passwords
View Patent ↗A device may include an authentication server and a server. The authentication server may receive a first form of a password from a client device in accordance with an authentication protocol, and authenticate the client device based on a comparison of the first form to a value derived from a second form of the password stored in a password database, where the comparison fails when the first form is not comparable to a value derived from the second form. The server may establish a secure connection to the client, receive a plain-text password from the client device over the secure connection, authenticate the client device by comparing a value derived from the plain-text password with a value derived from the second form, and update the password database with a third form of the password that permits the authentication server to successfully authenticate the client device when the authentication server receives the first form.
1. A device comprising:
a memory to store instructions; and
a processor to execute the instructions to:
determine that a first hash of a password received from a client device differs from a value associated with the client device, the value associated with the client device being derived from a second hash of the password;
in response to determining that the first hash of the password differs from the value associated with the client device, establish a secure connection between the device and the client device via a quarantine network;
receive, via the secure connection, a plain-text password from the client device;
compare a value derived from the plain-text password with the value associated with the client device; and
in response to the comparison, associate a third hash of the password with the client device when the value derived from the plain-text password matches the value associated with the client device.
2. The device of claim 1 , where the first hash of the password is the same as the third hash of the password.
3. The device of claim 1 , where the processor is to execute the instructions further to:
apply a function to both the second hash of the password and a challenge string to obtain the value associated with the client device.
4. The device of claim 3 , where, when comparing the value derived from the plain-text password with the value associated with the client device, the processor executes the instructions to:
apply the function to both the plain-text password and the challenge string to obtain the value derived from the plain-text password.
5. The device of claim 1 , where the processor further executes the instructions to:
transmit, prior to receiving the first hash of the password, a challenge string to the client device, where the first hash of the password is based on applying a hash function to both the plain-text password and the challenge string.
6. The device of claim 1 , where, when establishing the secure connection, the processor executes the instructions to:
establish a secure hypertext transfer protocol (HTTPS) connection.
7. The device of claim 1 , where the quarantine network includes:
a virtual local area network (VLAN).
8. A method comprising:
determining, by a processor, that a first hash of a password received from a client device differs from a value associated with the client device, the value associated with the client device being derived from a second hash of the password;
in response to determining that the first hash of the password differs from the value associated with the client device, establishing a secure connection between the device and the client device via a quarantine network;
receiving, via the secure connection, a plain-text password from the client device;
comparing, by the processor, a value derived from the plain-text password with the value associated with the client device; and
in response to the comparison, associating, by the processor, a third hash of the password with the client device when the value derived from the plain-text password matches the value associated with the client device.
9. The method of claim 8 , where the first hash of the password is the same as the third hash of the password.
10. The method of claim 8 , further comprising:
applying a function to both the second hash of the password and a challenge string to obtain the value associated with the client device.
11. The method of claim 10 , further comprising:
when comparing the value derived from the plain-text password with the value associated with the client device, applying the function to both the plain-text password and the challenge string to obtain the value derived from the plain-text password.
12. The method of claim 8 , further comprising:
transmitting, prior to receiving the first hash of the password, a challenge string to the client device, where the first hash of the password is based on applying a hash function to both the plain-text password and the challenge string.
13. The method of claim 8 , wherein establishing the secure connection comprises establishing a secure hypertext transfer protocol (HTTPS) connection.
14. The method of claim 8 , where the quarantine network includes:
a virtual local area network (VLAN).
15. A non-transitory computer-readable medium storing instructions, which, when executed by a processor, perform steps comprising:
determining that a first hash of a password received from a client device differs from a value associated with the client device, the value associated with the client device being derived from a second hash of the password;
in response to determining that the first hash of the password differs from the value associated with the client device, establishing a secure connection between the device and the client device via a quarantine network;
receiving, via the secure connection, a plain-text password from the client device;
comparing a value derived from the plain-text password with the value associated with the client device; and
in response to the comparison, associating a third hash of the password with the client device when the value derived from the plain-text password matches the value associated with the client device.
16. The computer-readable medium of claim 15 , where the first hash of the password is the same as the third hash of the password.
17. The computer-readable medium of claim 15 , the instructions, when executed, performing further steps comprising:
applying a function to both the second hash of the password and a challenge string to obtain the value associated with the client device.
18. The computer-readable medium of claim 17 , the instructions, when executed, performing further steps comprising:
when comparing the value derived from the plain-text password with the value associated with the client device, applying the function to both the plain-text password and the challenge string to obtain the value derived from the plain-text password.
19. The computer-readable medium of claim 15 , the instructions, when executed, performing further steps comprising:
transmitting, prior to receiving the first hash of the password, a challenge string to the client device, where the first hash of the password is based on applying a hash function to both the plain-text password and the challenge string.
20. The computer-readable medium of claim 15 , wherein establishing the secure connection comprises establishing a secure hypertext transfer protocol (HTTPS) connection.