Distributed password verification
Distribution of verification of passwords for electronic account. Password verification is distributed (divided) across multiple entities to reduce potential exposure in the event of a server exposure.
1. A method comprising:
creating a first token on a first server based, at least in part, on a first set of client identifiers for a client and an encryption key, wherein:
the first set of client identifiers includes:
a first hashed password for the client, and
a first username for the client, and
the first token is encrypted;
transmitting the first token from the first server to the client;
adding, to a honeychecker registry on a second server, the first username, wherein the honeychecker registry is a list of valid usernames;
deleting the first token and the first set of client identifiers from the first server;
receiving, on the first server, a second token and a second set of client identifiers for the client, wherein:
the second token is encrypted,
the second token is equivalent to the first token, and
the second set of client identifiers includes:
a second hashed password, and
a second username;
decrypting the second token using a decryption key to reveal the first set of client identifiers;
comparing the second hashed password to the first hashed password from the second token to verify an identity of the client;
determining that the second username does not appear in the honeychecker registry; and
denying, to the client, responsive to determining that the second username does not appear in the honeychecker registry, access to the account to prevent an unauthorized access;
wherein:
at least comparing the second hashed password to the first hashed password from the second token is performed by computer software running on computer hardware.
2. The method of claim 1 , further comprising:
logging the second username to an authentication log.
3. The method of claim 1 , wherein creating the first token is further based, at least in part, on a device identifier for a device used by the client.
4. A computer program product comprising:
a computer readable storage medium having stored thereon:
first instructions executable by a device to cause the device to create a first token on a first server based, at least in part, on a first set of client identifiers for a client and an encryption key, wherein:
the first set of client identifiers includes:
a first hashed password for the client, and
a first username for the client, and
the first token is encrypted;
second instructions executable by a device to cause the device to transmit the first token from the first server to the client;
third instructions executable by a device to cause the device to add, to a honeychecker registry on a second server, the first username, wherein the honeychecker registry is a list of valid usernames;
fourth instructions executable by a device to cause the device to delete the first token and the first set of client identifiers from the first server;
fifth instructions executable by a device to cause the device to receive, on a second first server, the token and a second set of client identifiers for the client, wherein:
the second token is encrypted,
the second token is equivalent to the first token, and
the second set of client identifiers includes:
a second hashed password, and
a second username;
sixth instructions executable by a device to cause the device to decrypt the second token using a decryption key to reveal the first set of client identifiers; and
seventh instructions executable by a device to cause the device to compare the second hashed password to the first hashed password from the second token to verify an identity of the client;
eighth instructions executable by a device to cause the device to determine that the second username does not appear in the honeychecker registry; and
ninth instructions executable by a device to cause the device to deny, to the client, responsive to determining that the second username does not appear in the honeychecker registry, access to the account to prevent an unauthorized access.
5. The computer program product of claim 4 , further comprising:
tenth instructions executable by a device to cause the device to log the second username to an authentication log.
6. The computer program product of claim 4 , wherein first instructions to create the first token are further based, at least in part, on a device identifier for a device used by the client.
7. A computer system comprising:
a processor set; and
a computer readable storage medium;
wherein:
the processor set is structured, located, connected, and/or programmed to execute instructions stored on the computer readable storage medium; and
the instructions include:
first instructions executable by a device to cause the device to create a first token on a first server based, at least in part, on a first set of client identifiers for a client and an encryption key, wherein:
the first set of client identifiers includes:
a first hashed password for the client, and
a first username for the client, and
the first token is encrypted;
second instructions executable by a device to cause the device to transmit the first token from the first server to the client;
third instructions executable by a device to cause the device to add, to a honeychecker registry on a second server, the first username, wherein the honeychecker registry is a list of valid usernames;
fourth instructions executable by a device to cause the device to delete the first token and the first set of client identifiers from the first server;
fifth instructions executable by a device to cause the device to receive, on a second first server, the token and a second set of client identifiers for the client, wherein:
the second token is encrypted,
the second token is equivalent to the first token, and
the second set of client identifiers includes:
a second hashed password, and
a second username;
sixth instructions executable by a device to cause the device to decrypt the second token using a decryption key to reveal the first set of client identifiers; and
seventh instructions executable by a device to cause the device to compare the second hashed password to the first hashed password from the second token to verify an identity of the client;
eighth instructions executable by a device to cause the device to determine that the second username does not appear in the honeychecker registry; and
ninth instructions executable by a device to cause the device to deny, to the client, responsive to determining that the second username does not appear in the honeychecker registry, access to the account to prevent an unauthorized access.
8. The computer system of claim 7 , further comprising:
tenth instructions executable by a device to cause the device to log the second username to an authentication log.
9. The computer system of claim 7 , wherein first instructions to create the first token are further based, at least in part, on a device identifier for a device used by the client.