Patent Application
20070079143
The present invention relates to computer security in general, and, more particularly, to a secure method of storing recoverable passwords.
Many operating systems enable a system administrator (or superuser) to create a plurality of user accounts on a computer. Each user account typically has an associated identifier called a username, and a password that must be provided in combination with the username to log in to the computer with that account.
A computer operating system typically maintains a password table in persistent storage (e.g., in a disk file, in a directory, etc.) and consults the password table when a user attempts to log in to the computer. Because a malicious user (which could be a user with an account on the computer, or an external “cracker”) might attempt to access the password table to get another user's password, hashed passwords are typically stored in the password table instead of the actual passwords. A hashed password is the value that is obtained when a cryptographic hash function is applied to a password. A cryptographic hash function is a function h that converts a first string (e.g., a password, etc.) to a second string (e.g., a hashed password, etc.), and exhibits the following three properties:
In some operating systems a user account might have two passwords, where the user can log in by providing either of the passwords with his or her username. Typically when a user forgets his “primary” password, he logs in with his “secondary” password, and the primary password is reset to a default string (e.g., “john123”, “password”, etc.). The user can then log in using the default string and change the primary password accordingly. (Because the password table stores only hashed passwords for security purposes, the unhashed primary password cannot be simply revealed to the user.) In some systems the secondary password might be a particular piece of information that presumably is not known to other users (e.g., mother's maiden name, birthplace, telephone number at a previous residence, etc.), while in some other systems the secondary password is, like the primary password, an arbitrarily-selected string.
Telecommunications network 105 is a network such as the Public Switched Telephone Network [PSTN], the Internet, etc. that transports messages between computer 110 and other devices (e.g., desktop computers, notebook computers, servers, wireless telecommunications terminals, etc.).
Computer 110 is a desktop computer, notebook computer, server, etc. whose operating system is capable of providing one or more user accounts. A user who has an account on computer 110 can log in to the computer via an input device (e.g., keyboard, etc.), or from a remote computer via telecommunications network 105. A user must provide a valid username/password combination in order to log in to computer 110.
Receiver 201 receives signals from clients (e.g., desktop computers, notebook computers, etc.) via telecommunications network 105 and forwards the information encoded in the signals to processor 202.
Processor 202 is a general-purpose processor that is capable of receiving information from receiver 201, of executing instructions stored in memory 203, of reading data from and writing data into memory 203, and of transmitting information to transmitter 204.
Memory 203 is capable of storing data, including a password table that is described below and with respect to
Transmitter 204 receives information from processor 202 and transmits signals that encode this information to clients (e.g., desktop computers, notebook computers, etc.) via telecommunications network 105.
Input device 205 is a keyboard, mouse, microphone, etc. that receives input from a user (e.g., username, password, etc.) and transmits signals that represent the input to processor 202.
The present invention enables a user who forgets one of his two passwords to securely recover the forgotten password. In particular, after a user logs in using one of his two passwords, the illustrative embodiment reveals the other password to the user, without either of the two original unhashed passwords being saved in persistent storage (e.g., in a disk file, in an LDAP directory, etc.). The illustrative embodiment thus overcomes two major disadvantages of the prior art:
The illustrative embodiment of the present invention employs a password table that adds two columns to password table 300 of the prior art. The first additional column stores an encrypted version p′ of a user's first password p, where the encryption key is based on:
In accordance with the illustrative embodiment, when a user attempts to log in by providing (1) a username and (2) an input x for matching one of the username's passwords (say p), input x is hashed and compared with corresponding hashed password h(p) in the password table. If h(x) matches h(p), then the user is logged in, input x (which with very high probability equals password p) and datum d are used to decrypt q′, and the result, q, is revealed to the user. Similarly, if h(x) matches h(q), then the user is logged in, input x (which with very high probability equals password q) and datum d are used to decrypt p′, and the result, p, is revealed to the user.
The illustrative embodiment comprises: a first memory location that stores the value of a cryptographic hash function applied to a first datum, and a second memory location that stores an encrypted version of said first datum.
Computer 410 is a computer that enables users to log in from remote clients and securely recover their passwords, as described below and with respect to
Receiver 501 receives signals from clients (e.g., desktop computers, notebook computers, etc.) via telecommunications network 105 and forwards the information encoded in the signals to processor 502, in well-known fashion. It will be clear to those skilled in the art, after reading this specification, how to make and use receiver 501.
Processor 502 is a general-purpose processor that is capable of receiving information from receiver 501 and input device 505, of executing instructions stored in memory 503, of reading data from and writing data into memory 503, of executing the tasks described below and with respect to
Memory 503 stores data, including a password table as described below and with respect to
Transmitter 504 receives information from processor 502 and transmits signals that encode this information to clients (e.g., desktop computers, notebook computers, etc.) via telecommunications network 105, in well-known fashion. It will be clear to those skilled in the art, after reading this specification, how to make and use transmitter 504.
Input device 505 is a keyboard, mouse, microphone, etc. that receives input from a user (e.g., username, password, etc.) and transmits signals that represent the input to processor 502, in well-known fashion.
Clock 506 transmits the current time and date to processor 502 in well-known fashion.
Column 604 stores an encrypted version p′ of each user's first password p, where the encryption key is based on (i) a datum d that is accessible to computer 410 but is unknown to the user, and (ii) the user's second password q, such that p′ can be decrypted when both (i) and (ii) above are known. By encrypting first password p in this fashion, neither the system administrator of computer 410, nor a cracker who gains access to computer 410, can (easily) decrypt the values in column 604 and obtain a user's first password. The reason for this is that the users' second passwords are stored on computer 410 only in hashed and encrypted forms, and the value of datum d alone (if discovered by the system administrator or cracker) is insufficient for decrypting p′.
Column 605 stores an encrypted version q′ of each user's second password q, where the encryption key is based on datum d and first password p. For the same reason as above, encrypting second password q in this fashion prevents a malicious user from (easily) decrypting q′, even if the malicious user has discovered the value of datum d.
At task 710, computer 410 receives a username, and an input x that is for matching first password p.
At task 720, computer 410 generates h(x), the value of cryptographic hash function h applied to input x.
At task 730, computer 410 reads the value of the entry of table 600 at column 602 and the row that corresponds to username.
At task 740, computer 410 checks whether the entry value equals h(x). If so, execution continues at task 750, otherwise the method of
At task 750, computer 410 decrypts, based on input x and datum d, the entry of table 600 at column 605 and username's row (i.e., q′).
At task 760, computer 410 transmits the decrypted entry (i.e., password q) to the device at which x was input. After task 760, the method of
Although the illustrative embodiment is disclosed in the context of passwords for an operating system, it will be clear to those skilled in the art how to make and use embodiments of the present invention for other kinds of passwords (e.g., for access to websites, applications, databases, etc.) Similarly, although the illustrative embodiment is disclosed in the context of two-password user accounts, it will be clear to those skilled in the art how to make and use embodiments of the present invention for user accounts that have three or more passwords.
It is to be understood that the above-described embodiments are merely illustrative of the present invention and that many variations of the above-described embodiments can be devised by those skilled in the art without departing from the scope of the invention. For example, in this Specification, numerous specific details are provided in order to provide a thorough description and understanding of the illustrative embodiments of the present invention. Those skilled in the art will recognize, however, that the invention can be practiced without one or more of those details, or with other methods, materials, components, etc.
Furthermore, in some instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the illustrative embodiments. It is understood that the various embodiments shown in the Figures are illustrative, and are not necessarily drawn to scale. Reference throughout the specification to “one embodiment” or “an embodiment” or “some embodiments” means that a particular feature, structure, material, or characteristic described in connection with the embodiment(s) is included in at least one embodiment of the present invention, but not necessarily all embodiments. Consequently, the appearances of the phrase “in one embodiment,” “in an embodiment,” or “in some embodiments” in various places throughout the Specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments. It is therefore intended that such variations be included within the scope of the following claims and their equivalents.
