Local hash salt to prevent credential stuffing attacks
Aspects of the disclosure relate to authentication. A computing platform may send, to a wearable device, an internet of things (IoT) vector key. The computing platform may receive an application access request from the wearable device, which may include authentication credentials. The computing platform may send, to the wearable device, a reference key comprising a sequence of row-column combinations corresponding to the IoT vector key, and the wearable device may be configured to identify a hash salt value using the reference key and the IoT. The computing platform may receive, from the wearable device, the hash salt value. The computing platform may generate, based on the hash salt value and the authentication credentials, a password. The computing platform may hash the password to produce a password hash, and may send the password hash to an application server for validation.
1. A computing platform comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
send, to a wearable device, an internet of things (IoT) vector key comprising an N×N matrix of values for a client;
receive an application access request from the wearable device, wherein the application access request includes authentication credentials;
send, to the wearable device, a reference key comprising a sequence of row-column combinations corresponding to the IoT vector key, wherein the wearable device is configured to identify a hash salt value by identifying the values, in the IoT vector key, corresponding to the sequence of row-column combinations defined in the reference key;
receive, from the wearable device, the hash salt value;
generate, based on the hash salt value and the authentication credentials, a password;
hash the password to produce a password hash; and
send the password hash to an application server, wherein the application server is configured to validate the password hash by comparing the password hash to a reference password hash and grant the wearable device access to the application based on successful validation, wherein the application server is configured to:
update, after validating the password hash, the IoT vector key, and
provide, to the computing platform, the updated IoT vector key, wherein the computing platform distributes the updated IoT vector key to the wearable device for storage and use in subsequent application access requests.
2. The computing platform of claim 1 , wherein the IoT vector key is stored at the application server and the wearable device.
3. The computing platform of claim 1 , wherein the authentication credentials comprise one or more of: an alphanumeric passcode, biometric input, a retina scan, or a facial scan.
4. The computing platform of claim 1 , wherein the reference key is generated by the application server and stored at the application server.
5. The computing platform of claim 1 , wherein the application server is configured to generate the reference password hash by:
generating, based on the reference key and the IoT vector key, the hash salt value;
generating, based on the authentication credentials and the hash salt value, the password; and
hashing the password to produce the reference password hash.
6. The computing platform of claim 1 , wherein the authentication credentials are shared among a plurality of applications accessible at the computing platform.
7. The computing platform of claim 6 , wherein a plurality of wearable devices, including the wearable device, may be configured to access the plurality of applications.
8. The computing platform of claim 1 , wherein the password is further generated based on a second hash salt value, received from a different wearable device.
9. The computing platform of claim 1 , wherein:
the reference key is specific to the application,
a second reference key is assigned to a second application,
the authentication credentials for the application and the second application are the same; and
the password hashes for the application and the second application are different.
10. A method comprising:
at a computing platform comprising at least one processor, a communication interface, and memory:
sending, to a wearable device, an internet of things (IoT) vector key comprising an N×N matrix of values for a client;
receiving an application access request from the wearable device, wherein the application access request includes authentication credentials;
sending, to the wearable device, a reference key comprising a sequence of row-column combinations corresponding to the IoT vector key, wherein the wearable device is configured to identify a hash salt value by identifying the values, in the IoT vector key, corresponding to the sequence of row-column combinations defined in the reference key;
receiving, from the wearable device, the hash salt value;
generating, based on the hash salt value and the authentication credentials, a password;
hashing the password to produce a password hash; and
sending the password hash to an application server, wherein the application server is configured to validate the password hash by comparing the password hash to a reference password hash and grant the wearable device access to the application based on successful validation, wherein the application server is configured to:
update, after validating the password hash, the IoT vector key, and
provide, to the computing platform, the updated IoT vector key, wherein the computing platform distributes the updated IoT vector key to the wearable device for storage and use in subsequent application access requests.
11. The method of claim 10 , wherein the IoT vector key is stored at the application server and the wearable device.
12. The method of claim 10 , wherein the authentication credentials comprise one or more of: an alphanumeric passcode, biometric input, a retina scan, or a facial scan.
13. The method of claim 10 , wherein the reference key is generated by the application server and stored at the application server.
14. The method of claim 10 , wherein the application server is configured to generate the reference password hash by:
generating, based on the reference key and the IoT vector key, the hash salt value;
generating, based on the authentication credentials and the hash salt value, the password; and
hashing the password to produce the reference password hash.
15. The method of claim 10 , wherein the authentication credentials are shared among a plurality of applications accessible at the computing platform.
16. The method of claim 15 , wherein a plurality of wearable devices, including the wearable device, may be configured to access the plurality of applications.
17. The method of claim 10 , wherein the password is further generated based on a second hash salt value, received from a different wearable device.
18. The method of claim 10 , wherein:
the reference key is specific to the application,
a second reference key is assigned to a second application,
the authentication credentials for the application and the second application are the same; and
the password hashes for the application and the second application are different.
19. One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:
send, to a wearable device, an internet of things (IoT) vector key comprising an N×N matrix of values for a client;
receive an application access request from the wearable device, wherein the application access request includes authentication credentials;
send, to the wearable device, a reference key comprising a sequence of row-column combinations corresponding to the IoT vector key, wherein the wearable device is configured to identify a hash salt value by identifying the values, in the IoT vector key, corresponding to the sequence of row-column combinations defined in the reference key;
receive, from the wearable device, the hash salt value;
generate, based on the hash salt value and the authentication credentials, a password;
hash the password to produce a password hash; and
send the password hash to an application server, wherein the application server is configured to validate the password hash by comparing the password hash to a reference password hash and grant the wearable device access to the application based on successful validation, wherein the application server is configured to:
update, after validating the password hash, the IoT vector key, and
provide, to the computing platform, the updated IoT vector key, wherein the computing platform distributes the updated IoT vector key to the wearable device for storage and use in subsequent application access requests.