Method to Provide Password Security Without Storing Password (01-Aug-1987)

Method to Provide Password Security Without Storing Password

A method is described to secure access to functions via a user password that is not stored on any media. Passwords that are stored are easy to find. Even encrypted passwords can be broken. The password is not stored on media. The password is long (30-80 characters); blanks are allowed. Therefore, the password may be a sentence, phrase, poem, or words to a song. When the user tries to access secured functions, the program prompts for the password. The password is entered and is "crunched" into a "key." The system then gets the previous system time from media. That time is encrypted with the key. The previous time and encrypted time have been stored on media, but the password itself is not (nor is it kept in memory). If the time encrypted with the just derived key equals that on media, the password is correct.

1