System, method, and computer program product for performing hardware-backed password-based authentication

1. A method, comprising:

receiving, by a device, a request to access software of the device utilizing password-based authentication;

receiving, by the device, a password for the password-based authentication;

responsive to receiving the password, computing, by the device, a hardware-backed secret in a hardware-backed storage of the device;

computing, by the device, a hash utilizing the password and the hardware-backed secret, wherein the hardware-backed secret is utilized to bind the computation of the hash to the hardware of the device; and

verifying, by the device, that the hash computed utilizing the password and the hardware-based authenticator is correct for accessing the software by comparing the hash computed utilizing the password and the hardware-based authenticator to a hash associated with the software that is stored in memory of the device;

granting, by the device, access to the software only when the hash computed utilizing the password and the hardware-based authenticator is verified as being correct for accessing the software.

2. The method of claim 1 , wherein the hardware-backed secret is generated utilizing one of: ARM TrustZone, Trusted Platform Module (TPM), or a smart card.

3. The method of claim 1 , wherein computing the hash further includes computing a message authentication code (MAC) or a digital signature every iteration.

4. The method of claim 3 , wherein computation of the hash includes using a pseudorandom function that relies on a hardware-backed MAC or a hardware-backed digital signature.

5. The method of claim 3 , wherein a hardware-backed MAC or a hardware-backed digital signature are utilized as a pseudorandom function used by the password hash computation.

6. The method of claim 1 , wherein the computation of the hardware-backed secret is a hardware-backed operation that must be executed on the hardware of the device.

7. A non-transitory computer readable medium storing computer code executable by a processor to perform a method comprising:

receiving, by a device, a request to access software of the device utilizing password-based authentication;

receiving, by the device, a password for the password-based authentication;

responsive to receiving the password, computing, by the device, a hardware-backed secret in a hardware-backed storage of the device;

computing, by the device, a hash utilizing the password and the hardware-backed secret, wherein the hardware-backed secret is utilized to bind the computation of the hash to the hardware of the device; and

verifying, by the device, that the hash computed utilizing the password and the hardware-based authenticator is correct for accessing the software by comparing the hash computed utilizing the password and the hardware-based authenticator to a hash associated with the software that is stored in memory of the device;

granting, by the device, access to the software only when the hash computed utilizing the password and the hardware-based authenticator is verified as being correct for accessing the software.

8. The non-transitory computer readable medium of claim 7 , wherein the hardware-backed secret is generated utilizing one of: ARM TrustZone, Trusted Platform Module (TPM), or a smart card.

9. The non-transitory computer readable medium of claim 7 , wherein computing the hash further includes computing a message authentication code (MAC) or a digital signature every iteration.

10. The non-transitory computer readable medium of claim 9 , wherein computation of the hash includes using a pseudorandom function that relies on a hardware-backed MAC or a hardware-backed digital signature.

11. The non-transitory computer readable medium of claim 9 , wherein a hardware-backed MAC or a hardware-backed digital signature are utilized as a pseudorandom function used by the password hash computation.

12. A device, comprising:

a memory storing instructions, and

a computer processor executing the instructions for:

receiving, by the device, a request to access software of the device utilizing password-based authentication;

receiving, by the device, a password for the password-based authentication;

responsive to receiving the password, computing, by the device, a hardware-backed secret in a hardware-backed storage of the device;

computing, by the device, a hash utilizing the password and the hardware-backed secret, wherein the hardware-backed secret is utilized to bind the computation of the hash to the hardware of the device; and

verifying, by the device, that the hash computed utilizing the password and the hardware-based authenticator is correct for accessing the software by comparing the hash computed utilizing the password and the hardware-based authenticator to a hash associated with the software that is stored in memory of the device;

granting, by the device, access to the software only when the hash computed utilizing the password and the hardware-based authenticator is verified as being correct for accessing the software.

13. The system of claim 12 , wherein the hardware-backed secret is generated utilizing one of: ARM TrustZone, Trusted Platform Module (TPM), or a smart card.

14. The system of claim 12 , wherein computing the hash further includes computing a message authentication code (MAC) or a digital signature every iteration.

15. The system of claim 14 , wherein computation of the hash includes using a pseudorandom function that relies on a hardware-backed MAC or a hardware-backed digital signature.

16. The system of claim 14 , wherein a hardware-backed MAC or a hardware-backed digital signature are utilized as a pseudorandom function used by the password hash computation.