Password manipulation for secure account creation and verification through third-party servers
View Patent ↗A method and system for deterring attacks at potential breach points between servers and an account and login server for creating and subsequent verification of accounts. Various cryptographic primitives are used to manipulate passwords to generate verifiers. The verifiers are used with external hardware security modules (HSMs) to eliminate HSMs and intermediate steps between the HSM and login servers as potential breach points.
1. A computer implemented method comprising:
receiving, at a trusted server, a request to create a new account, the request comprising an account identification (ID) and an original account password;
applying one or more cryptographic primitives to the original account password to generate a cryptographic original account password;
accessing, by the trusted server, a random number;
encrypting the random number using a public key cryptography scheme;
masking, at the trusted server using an invertible masking operation, the cryptographic original account password with the encrypted random number to generate a verifier that obfuscates the cryptographic original account password; and
storing, at a verifier store, the verifier in association with the account ID for the new account, the verifier store coupled to the trusted server but physically located in a distinct piece of computer hardware different from that of the trusted server.
2. The computer implemented method of claim 1 , wherein the one or more cryptographic primitives is a hash function that includes a salt.
3. The computer implemented method of claim 1 , wherein the invertible masking operation comprises performing an invertible mathematical operation on the cryptographic password and the encrypted random number.
4. The computer implemented method of claim 3 , wherein the invertible mathematical operation includes at least one mathematical operation from a group consisting of: a multiplication operation, an addition operation, an AND operation, an OR operation, an XOR operation, and an XNOR operation.
5. The computer implemented method of claim 1 , wherein the invertible masking operation is invertible such that performing the invertible masking operation on the verifier and the cryptographic original account password results in the encrypted random number.
6. The computer implemented method of claim 1 , further comprising:
accessing a plurality of random numbers;
encrypting the plurality of random numbers using the public key cryptography scheme;
masking, at the trusted server, the cryptographic original account password with each of the plurality of encrypted random numbers to generate a plurality of verifiers that each differently obfuscate the cryptographic original account password; and
storing, at the verifier store, the plurality of verifiers in association with the account ID for the new account.
7. The computer implemented method of claim 1 , further comprising storing, at the verifier store, the random number in association with the account ID for the new account.
8. The computer implemented method of claim 1 , wherein a private key associated with the public key cryptography scheme is stored at an untrusted server communicatively coupled to the trusted server but physically located in a distinct piece of computer hardware different from that of the trusted server.
9. A non-transitory computer readable storage medium comprising computer program instructions that, when executed by a processor, cause the processor to:
receive, at a trusted server, a request to create a new account, the request comprising an account identification (ID) and an original account password;
apply one or more cryptographic primitives to the original account password to generate a cryptographic original account password;
access, by the trusted server, a random number;
encrypt the random number using a public key cryptography scheme;
mask, at the trusted server using an invertible masking operation, the cryptographic original account password with the encrypted random number to generate a verifier that obfuscates the cryptographic original account password; and
store, at a verifier store, the verifier in association with the account ID for the new account, the verifier store coupled to the trusted server but physically located in a distinct piece of computer hardware different from that of the trusted server.
10. The non-transitory computer readable storage medium of claim 9 , wherein the one or more cryptographic primitives is a hash function that includes a salt.
11. The non-transitory computer readable storage medium of claim 9 , wherein the invertible masking operation comprises performing an invertible mathematical operation on the cryptographic password and the encrypted random number.
12. The non-transitory computer readable storage medium of claim 11 , wherein the invertible mathematical operation includes at least one mathematical operation from a group consisting of: a multiplication operation, an addition operation, an AND operation, an OR operation, an XOR operation, and an XNOR operation.
13. The non-transitory computer readable storage medium of claim 9 , wherein the invertible masking operation is invertible such that performing the invertible masking operation on the verifier and the cryptographic original account password results in the encrypted random number.
14. The non-transitory computer readable storage medium of claim 9 , further comprising instructions which, when executed by the processor, cause the processor to:
access a plurality of random numbers;
encrypt the plurality of random numbers using the public key cryptography scheme;
mask, at the trusted server, the cryptographic original account password with each of the plurality of encrypted random numbers to generate a plurality of verifiers that each differently obfuscate the cryptographic original account password; and
store, at the verifier store, the plurality of verifiers in association with the account ID for the new account.
15. The non-transitory computer readable storage medium of claim 9 , further comprising instructions which, when executed by the processor, cause the processor to store, at the verifier store, the random number in association with the account ID for the new account.
16. The non-transitory computer readable storage medium of claim 9 , wherein a private key associated with the public key cryptography scheme is stored at an untrusted server communicatively coupled to the trusted server but physically located in a distinct piece of computer hardware different from that of the trusted server.
17. A computer system comprising:
a trusted server configured to:
receive a request to create a new account, the request comprising an account identification (ID) and an original account password;
apply one or more cryptographic primitives to the original account password to generate a cryptographic original account password;
access a random number;
encrypt the random number using a public key cryptography scheme;
mask, using an invertible masking operation, the cryptographic original account password with the encrypted random number to generate a verifier that obfuscates the cryptographic original account password; and
a verifier store coupled to the trusted server but physically located in a distinct piece of computer hardware different from that of the trusted server, the verifier store configured to store the verifier in association with the account ID for the new account.
18. The computer system of claim 17 , wherein the one or more cryptographic primitives is a hash function that includes a salt.
19. The computer system of claim 17 , wherein the invertible masking operation comprises performing an invertible mathematical operation on the cryptographic password and the encrypted random number.
20. The computer system of claim 19 , wherein the invertible mathematical operation includes at least one mathematical operation from a group consisting of: a multiplication operation, an addition operation, an AND operation, an OR operation, an XOR operation, and an XNOR operation.