Protection and verification of user authentication credentials against server compromise

1. A computer-implemented method for authenticating a user, the computer-implemented method comprising:

receiving, by a computer, a data decryption key corresponding to an authentication account of the user of a client device and authentication credential data obtained from the user of the client device during authentication, wherein the authentication credential data obtained from the user during the authentication comprises a password and a biometric sample of the user;

decrypting, by the computer, encrypted authentication credential data retrieved from storage and corresponding to the user using the received data decryption key;

comparing, by the computer, the decrypted authentication credential data with the received authentication credential data to authenticate the user of the client device; and

deleting, by the computer, the received data decryption key, the received authentication credential data, and any unencrypted authentication credential data corresponding to the authentication account of the user.

2. The computer-implemented method of claim 1 further comprising:

determining, by the computer, whether the decrypted authentication credential data matches the received authentication credential data.

3. The computer-implemented method of claim 2 further comprising:

responsive to the computer determining that the decrypted authentication credential data does match the received authentication credential data, verifying, by the computer, the user as authentic; and

allowing, by the computer, the authentication of the verified user.

4. The computer-implemented method of claim 2 further comprising:

responsive to the computer determining that the decrypted authentication credential data does not match the received authentication credential data, rejecting, by the computer, the user as non-authentic; and

denying, by the computer, the authentication of the rejected user.

5. The computer-implemented method of claim 1 further comprising:

processing, by the computer, the received authentication credential data to generate and store an encrypted biometric template in response to the received authentication credential data being a biometric sample obtained from the user by the client device.

6. The computer-implemented method of claim 1 further comprising:

storing, by the computer, the encrypted authentication credential data as a credential blob in the authentication account corresponding to the user.

7. The computer-implemented method of claim 6 , wherein the credential blob includes an expiry date, and wherein the expiry date is a time when information contained in the credential blob expires such that the credential blob includes both encrypted and unencrypted data.

8. The computer-implemented method of claim 1 further comprising:

receiving, by the computer, a request from the client device to delete the authentication account corresponding to the user; and

deleting, by the computer, the authentication account from a storage device of the computer.

9. The computer-implemented method of claim 1 further comprising:

receiving, by the computer, an encrypted decryption key from a first client device to transfer the encrypted encryption key to a second client device;

receiving, by the computer, a request from the second client device for the encrypted decryption key corresponding to the first client device; and

sending, by the computer, the encrypted decryption key corresponding to the first client device to the second client device, wherein the second client device decrypts the encrypted decryption key corresponding to the first client device using a private key corresponding to a public key of the second client device used to encrypt the encrypted decryption key on the first client device.

10. A computer system for authenticating a user, the computer system comprising:

a bus system;

a storage device connected to the bus system, wherein the storage device stores program instructions; and

a processor connected to the bus system, wherein the processor executes the program instructions to:

receive a data decryption key corresponding to an authentication account of the user of a client device and authentication credential data obtained from the user of the client device during authentication, wherein the authentication credential data obtained from the user during the authentication comprises a password and a biometric sample of the user;

decrypt encrypted authentication credential data retrieved from storage and corresponding to the user using the received data decryption key; and

compare the decrypted authentication credential data with the received authentication credential data to authenticate the user of the client device; and

deleting, by the computer, the received data decryption key, the received authentication credential data, and any unencrypted authentication credential data corresponding to the authentication account of the user.

11. The computer system of claim 10 , wherein the processor further executes the program instructions to:

determine whether the decrypted authentication credential data matches the received authentication credential data.

12. The computer system of claim 11 , wherein the processor further executes the program instructions to:

verify the user as authentic in response to determining that the decrypted authentication credential data does match the received authentication credential data; and

allow the authentication of the verified user.

13. The computer system of claim 11 , wherein the processor further executes the program instructions to:

reject the user as non-authentic in response to determining that the decrypted authentication credential data does not match the received authentication credential data; and

deny the authentication of the rejected user.

14. A computer program product for authenticating a user, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:

receiving, by the computer, a data decryption key corresponding to an authentication account of the user of a client device and authentication credential data obtained from the user of the client device during authentication, wherein the authentication credential data obtained from the user during the authentication comprises a password and a biometric sample of the user;

decrypting, by the computer, encrypted authentication credential data retrieved from storage and corresponding to the user using the received data decryption key;

comparing, by the computer, the decrypted authentication credential data with the received authentication credential data to authenticate the user of the client device; and

deleting, by the computer, the received data decryption key, the received authentication credential data, and any unencrypted authentication credential data corresponding to the authentication account of the user.

15. The computer program product of claim 14 further comprising:

determining, by the computer, whether the decrypted authentication credential data matches the received authentication credential data.

16. The computer program product of claim 15 further comprising:

responsive to the computer determining that the decrypted authentication credential data does match the received authentication credential data, verifying, by the computer, the user as authentic; and

allowing, by the computer, the authentication of the verified user.

17. The computer program product of claim 15 further comprising:

responsive to the computer determining that the decrypted authentication credential data does not match the received authentication credential data, rejecting, by the computer, the user as non-authentic; and

denying, by the computer, the authentication of the rejected user.