Patent ID: 9059989
Filing Date: 2015-06-16
Classification: H04L

Abstract:
1. A method for preventing unauthorized access to a server system using stolen passwords, the method comprising: storing, by the server system, an ordered set of hash values for a user, each hash value in the ordered set of hash values being generated by applying each hash function in the ordered set of hash functions to the user's password; receiving, by the server system, a login request for the user from a client device, the login request including a hashed version of the password, wherein the client device generates the hashed version of the password by: selecting, by the server system, a hash value in the ordered set of hash values using a server-side index that is synchronized with a client-side index on the client device; and granting, by the server system, the login request if the hash value matches the hashed version of the password wherein the server-side index and the client-side index are initialized to a common starting value, and wherein the server-side index and the client-side index are set to a next common value by the server system and client device respectively if the login request is granted wherein the next common value for the server-side index and the client-side index is determined using a common random number generation scheme.