Patent ID: 9223949
Filing Date: 2015-12-29
Classification: G06F,H04L

Abstract:
1. A computer implemented method for invalidating transformed passwords to protect a user's original password, the method comprising: associating, by one or more server computing devices, a first encryption key having a first value with a third party for use in accessing a user's account; creating, by the one or more server computing devices, a first transformed password by encrypting a user's original password using the first value of the associated first encryption key; providing, by the one or more server computing devices, the first transformed password to the third party for accessing the user's account, wherein the third party cannot obtain the user's original password; recognizing, by the one or more server computing devices, a breach associated with the third party or the associated first encryption key; changing, by the one or more server computing devices, the first value of the associated first encryption key to a new value based upon the breach; receiving, by the one or more server computing devices from the third party, a request for access including the first transformed password; using, by the one or more server computing devices, the new value of the first encryption key and the user's original password to create a second transformed password; comparing, by the one or more server computing devices, the received first transformed password to the second transformed password; and when the comparison indicates that the first transformed password and the second transformed password are different, denying, by the one or more server computing devices, the request for access.