Provision of risk information associated with compromised accounts

Abstract

Processes and systems described herein enable a computing device to detect compromised accounts. The computing device may obtain a user credential including a user ID, and further modify the user ID. The computing device may transmit the modified user ID to a service including a database related to compromised accounts, receive a record corresponding to the modified user ID that includes information of a compromised account, and further determine whether an account of the user ID is compromised based on the received record. Some implementations relate to the on-site provision of risk information associated with compromised accounts.

What is claimed is: 
     
         1 . A system comprising:
 one or more processors; and   memory to maintain a plurality of components executable by the one or more processors, the plurality of components comprising a compromised account detection application configured to:
 receive a request for detection of a compromised account from a computing device, the request including a username and a password corresponding to the username, 
 transmit the username to a hardware security module (HSM) such that the username is encrypted by the HSM to obtain an encrypted username, 
 receive the encrypted username from the HSM, 
 query a database to determine whether the database includes the encrypted username, 
 in response to a determination that the database includes the encrypted username:
 determine an encrypted password corresponding to the encrypted username in the database, and 
 transmit the encrypted password to the HSM such that the HSM determines whether the encrypted password corresponds to the password, 
 in response to a determination that the encrypted password corresponds to the password, return a result to the computing device, the result indicating that an account corresponding to the username is compromised, and 
 in response to a determination that the encrypted password does not correspond to the password, return a result to the computing device, the result indicating that an account corresponding to the username is not compromised, and 
 
 in response to a determination that the database does not include the encrypted username, return a result to the computing device, the result indicating that an account corresponding to the username is not compromised. 
   
     
     
         2 . The system of  claim 1 , wherein the computing device is associated with a client that desires to determine whether the account is compromised, and wherein the database is updated in a predetermined time period by an additional computing device associated with a service that determines whether the account is compromised. 
     
     
         3 . The system of  claim 1 , wherein the database includes usernames and passwords corresponding to the usernames, and wherein the usernames and the passwords are encrypted. 
     
     
         4 . The system of  claim 3 , wherein the usernames and the passwords are encrypted such that same usernames have a same encrypted username, and same passwords have different encrypted passwords. 
     
     
         5 . The system of  claim 1 , wherein the HSM determines whether the encrypted password corresponds to the password by:
 encrypting the password to generate an HSM encrypted password, and   comparing the HSM encrypted password with the encrypted password.   
     
     
         6 . The system of  claim 1 , wherein the HSM determines whether the encrypted password corresponds to the password by:
 decrypting the encrypted password to generate an HSM decrypted password, and   comparing the HSM decrypted password with the password.   
     
     
         7 . The system of  claim 1 , wherein the password is a password in plain text or a hashed password. 
     
     
         8 . A method for on-site provision of risk information associated with compromised accounts, the method comprising:
 receiving a request for detection of a compromised account from a computing device, the request including a username and a password corresponding to the username,   transmitting the username to a hardware security module (HSM) such that the username is encrypted by the HSM to obtain an encrypted username,   receiving the encrypted username from the HSM,   querying a database to determine whether the database includes the encrypted username,   in response to a determination that the database includes the encrypted username:
 determining an encrypted password corresponding to the encrypted username in the database, and 
 transmitting the encrypted password to the HSM such that the HSM determines whether the encrypted password corresponds to the password, 
   in response to a determination that the encrypted password corresponds to the password, returning a result to the computing device, the result indicating that an account corresponding to the username is compromised, and   in response to a determination that the encrypted password does not correspond to the password, returning the result to the computing device, the result indicating that an account corresponding to the username is not compromised, and   in response to a determination that the database includes the encrypted username, returning the result to the computing device, the result indicating that the account corresponding to the username is not compromised.   
     
     
         9 . The method of  claim 8 , wherein the computing device is associated with a client that desires to determine whether the account is compromised, and wherein the database is updated in a predetermined time period by an additional computing device associated with a service that determines whether the account is compromised. 
     
     
         10 . The method of  claim 8 , wherein the database includes usernames and passwords corresponding to the usernames, and wherein the usernames and the passwords are encrypted. 
     
     
         11 . The method of  claim 10 , wherein the usernames and the passwords are encrypted such that same usernames have a same encrypted username, and same passwords have different encrypted passwords. 
     
     
         12 . The method of  claim 8 , wherein the HSM determines whether the encrypted password corresponds to the password by:
 encrypting the password to generate an HSM encrypted password, and   comparing the HSM encrypted password with the encrypted password.   
     
     
         13 . The method of  claim 8 , wherein the HSM determines whether the encrypted password corresponds to the password by:
 decrypting the encrypted password to generate an HSM decrypted password, and   comparing the HSM decrypted password with the password.   
     
     
         14 . The method of  claim 8 , wherein the password is a password in plain text or a hashed password. 
     
     
         15 . An HSM comprising:
 one or more dedicated cryptographic processors; and   memory to maintain a plurality of components executable by the one or more processors to perform the following acts:
 receiving a username in plain text, 
 encrypting the username using a first predetermined algorithm to obtain an HSM encrypted username, 
 transmitting the HSM encrypted username to a computing device such that the computing device determines an encrypted password corresponding to the HSM encrypted username in a database, 
 receiving the encrypted password and a password corresponding to the username, 
 determining whether the encrypted password corresponds to the password, 
 in response to a determination that the encrypted password corresponds to the password, transmitting a result to the computing device, the result indicating that an account associated with the username is compromised, and 
 in response to a determination that the encrypted password does not correspond to the password, transmitting a result to the computing device, the result indicating that an account associated with the username is not compromised. 
   
     
     
         16 . The HSM of  claim 15 , wherein the password is a password in plain text or a hashed password. 
     
     
         17 . The HSM of  claim 15 , wherein the determining whether the encrypted password corresponds to the password comprises:
 determining that the password is plain text;   encrypting the password using a second predetermined algorithm to obtain an HSM encrypted password; and   determining whether the encrypted password corresponds to the password by comparing the HSM encrypted password with the encrypted password.   
     
     
         18 . The HSM of  claim 15 , wherein the determining whether the encrypted password corresponds to the password comprises:
 determining that the password is plain text;   decrypting the encrypted password using a third predetermined algorithm to obtain an HSM decrypted password; and   determining whether the encrypted password corresponds to the password by comparing the HSM decrypted password with the password.   
     
     
         19 . The HSM of  claim 15 , wherein the determining whether the encrypted password corresponds to the password comprises:
 determining that the password is a hashed password;   decrypting the encrypted password using a third predetermined algorithm to obtain an HSM decrypted password;   encrypting the HSM decrypted password using a predetermined hash algorithm to obtain an HSM hashed password; and   determining whether the encrypted password corresponds to the password by comparing the HSM hashed password with the hashed password.   
     
     
         20 . The HSM of  claim 15 , wherein the database includes usernames and passwords corresponding to the usernames, the usernames, and the passwords are encrypted, and the usernames and the passwords are encrypted such that same usernames have a same encrypted username, and same passwords have different encrypted passwords.