Granted Patent B2

US 12,531,742 · App. 18/802,307 · Granted Jan 20, 2026

Inventors: Nikesh Pl (Bengaluru, IN); Vipin Sihare (Bengaluru, IN); Pavan Kumar (Bangalore, IN)

Assignee: JPMORGAN CHASE BANK, N.A.

H04L9/3226H04L9/0869H04L9/3213

Abstract

Claims (62)

1 . A method for securely performing a password migration between authentication servers, the method being implemented by at least one processor, the method comprising:

receiving, by the at least one processor from a user, a first authentication initiation request;

transmitting, by the at least one processor to a first server, the first authentication initiation request;

after the user has received a first public key and a first set of authentication parameters from the first server, receiving, by the at least one processor from the user, a second authentication initiation request;

transmitting, by at least one processor to a second server, the second authentication initiation request;

after the user has received a second public key and a second set of authentication parameters from the second server, and after the user has entered a username and a password and has stored, in a memory, a first encrypted version of the password that is encrypted by using the first public key and a second encrypted version of the password that is encrypted by using the second public key, receiving, by the at least one processor from the user, a request to perform an authentication of the user with the first server based on the first encrypted version of the password;

transmitting, by the at least one processor to the first server, the request to perform the authentication of the user with the first server;

after the authentication of the user has been completed and a token has been issued by the first server to the user, receiving, by the at least one processor from the user, a request to update the password in the second server based on the token;

transmitting, by the at least one processor to the first server, a request to validate the token;

receiving, by the at least one processor from the first server, a validation of the token; and

transmitting, by the at least one processor to the second server, the request to update the password in the second server, together with the second encrypted version of the password and a request to migrate the user to the second server.

2 . The method of claim 1 , further comprising:

after the user has been successfully migrated to the second server, receiving, from the user, a request to perform an authentication of the user with the second server based on the second encrypted version of the password;

transmitting, to the second server, the request to perform the authentication of the user with the second server; and

receiving, from the second server, a message indicating that the authentication of the user has been completed.

3 . The method of claim 1 , wherein each of the first encrypted version of the password and the second encrypted version of the password comprises a respective end-to-end fully encrypted version of the password.

4 . The method of claim 3 , wherein the first server stores the first encrypted version of the password and an additional version of the password that is generated by applying a predetermined hash algorithm to the first encrypted version of the password.

5 . The method of claim 4 , wherein the predetermined hash algorithm includes salting logic that adds randomness to an output of the predetermined hash algorithm.

6 . The method of claim 1 , wherein the authentication of the user comprises a multi-factor authentication that requires at least one additional information exchange between the user and the first server.

7 . The method of claim 1 , wherein the first server uses a first proprietary scheme for protecting the password, and the second server uses a second proprietary scheme for protecting the password that is different from the first proprietary scheme.

8 . A computing apparatus for securely performing a password migration between authentication servers, the computing apparatus comprising:

a processor;

a memory; and

a communication interface coupled to each of the processor and the memory, wherein the processor is configured to:

receive, via the communication interface from a user, a first authentication initiation request;

transmit, via the communication interface to a first server, the first authentication initiation request;

after the user has received a first public key and a first set of authentication parameters from the first server, receive, via the communication interface from the user, a second authentication initiation request;

transmit, via the communication interface to a second server, the second authentication initiation request;

after the user has received a second public key and a second set of authentication parameters from the second server, and after the user has entered a username and a password and has stored, in the memory, a first encrypted version of the password that is encrypted by using the first public key and a second encrypted version of the password that is encrypted by using the second public key, receive, via the communication interface from the user, a request to perform an authentication of the user with the first server based on the first encrypted version of the password;

transmit, via the communication interface to the first server, the request to perform the authentication of the user with the first server;

after the authentication of the user has been completed and a token has been issued by the first server to the user, receive, via the communication interface from the user, a request to update the password in the second server based on the token;

transmit, via the communication interface to the first server, a request to validate the token;

receive, via the communication interface from the first server, a validation of the token; and

transmit, via the communication interface to the second server, the request to update the password in the second server, together with the second encrypted version of the password and a request to migrate the user to the second server.

9 . The computing apparatus of claim 8 , wherein the processor is further configured to:

after the user has been successfully migrated to the second server, receive, via the communication interface from the user, a request to perform an authentication of the user with the second server based on the second encrypted version of the password;

transmit, via the communication interface to the second server, the request to perform the authentication of the user with the second server; and

receive, via the communication interface from the second server, a message indicating that the authentication of the user has been completed.

10 . The computing apparatus of claim 8 , wherein each of the first encrypted version of the password and the second encrypted version of the password comprises a respective end-to-end fully encrypted version of the password.

11 . The computing apparatus of claim 10 , wherein the first server stores the first encrypted version of the password and an additional version of the password that is generated by applying a predetermined hash algorithm to the first encrypted version of the password.

12 . The computing apparatus of claim 11 , wherein the predetermined hash algorithm includes salting logic that adds randomness to an output of the predetermined hash algorithm.

13 . The computing apparatus of claim 8 , wherein the authentication of the user comprises a multi-factor authentication that requires at least one additional information exchange between the user and the first server.

14 . The computing apparatus of claim 8 , wherein the first server uses a first proprietary scheme for protecting the password, and the second server uses a second proprietary scheme for protecting the password that is different from the first proprietary scheme.

15 . A non-transitory computer readable storage medium storing instructions for securely performing a password migration between authentication servers, the storage medium comprising executable code which, when executed by a processor, causes the processor to:

receive, from a user, a first authentication initiation request;

transmit, to a first server, the first authentication initiation request;

after the user has received a first public key and a first set of authentication parameters from the first server, receive, from the user, a second authentication initiation request;

transmit, to a second server, the second authentication initiation request;

after the user has received a second public key and a second set of authentication parameters from the second server, and after the user has entered a username and a password and has stored, in a memory, a first encrypted version of the password that is encrypted by using the first public key and a second encrypted version of the password that is encrypted by using the second public key, receive, from the user, a request to perform an authentication of the user with the first server based on the first encrypted version of the password;

transmit, to the first server, the request to perform the authentication of the user with the first server;

after the authentication of the user has been completed and a token has been issued by the first server to the user, receive, from the user, a request to update the password in the second server based on the token;

transmit, to the first server, a request to validate the token;

receive, from the first server, a validation of the token; and

transmit, to the second server, the request to update the password in the second server, together with the second encrypted version of the password and a request to migrate the user to the second server.

16 . The storage medium of claim 15 , wherein when executed, the executable code further causes the processor to:

after the user has been successfully migrated to the second server, receive, from the user, a request to perform an authentication of the user with the second server based on the second encrypted version of the password;

transmit, to the second server, the request to perform the authentication of the user with the second server; and

receive, from the second server, a message indicating that the authentication of the user has been completed.

17 . The storage medium of claim 15 , wherein each of the first encrypted version of the password and the second encrypted version of the password comprises a respective end-to-end fully encrypted version of the password.

18 . The storage medium of claim 17 , wherein the first server stores the first encrypted version of the password and an additional version of the password that is generated by applying a predetermined hash algorithm to the first encrypted version of the password.

19 . The storage medium of claim 18 , wherein the predetermined hash algorithm includes salting logic that adds randomness to an output of the predetermined hash algorithm.

20 . The storage medium of claim 15 , wherein the authentication of the user comprises a multi-factor authentication that requires at least one additional information exchange between the user and the first server.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (11)