Method and system to securely change a password in a distributed computing system

• US 20030061520A1
• Filed: 09/21/2001
• Published: 03/27/2003
• Est. Priority Date: 09/21/2001
• Status: Abandoned Application

• Current Assignee: Sumtotal Systems Incorporated (Cornerstone Ondemand Incorporated)
• Original Assignee: Sumtotal Systems Incorporated (Cornerstone Ondemand Incorporated)
• Inventors: Goodwin, William D., Zellers, Mark H., Thompson, Mark A.
• Application Number:
  US09/960,845
• Publication Number:
  US 20030061520A1
• Time in Patent Office: Days
• US Class Current: 713/202
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords

Abstract

Systems and methods to securely change a password in a distributed computing system are presented. According to an exemplary method, a stored value and a destination address of a user are stored. A request to change the password is received from the user. A message, for example, an electronic mail message, is sent to the destination address. The message specifies a link to the stored value. If the link is valid, then the user is permitted to log in to the distributed computing system using the stored value as a log in password. Each time that the user logs in to the distributed computing system, the stored value is updated, thereby invalidating any previously issued link.

Claims

1. A method of securely changing a password in a distributed computing system, comprising:

storing a stored value and a destination address of a user;

receiving a request to change the password from the user;

sending a message to the destination address, the message specifying a link to the stored value;

if the link is valid, then;

permitting the user to log in to the distributed computing system using the stored value as a log in password; and

updating the stored value each time that the user logs in to the distributed computing system.

2. The method according to claim 1, further comprising:

associating an expiration time with the link when the message is sent; and

invalidating the link when the expiration time is reached.

3. The method according to claim 2, further comprising:

automatically invalidating the link following log in by updating the stored value.

4. The method according to claim 3, further comprising:

receiving a public encryption key from the user; and

encrypting the message according to the public encryption key.

5. The method according to claim 4, further comprising:

if the user successfully logs in with the stored value, then;

prompting the user for a new password; and

updating the password to the new password.

6. The method according to claim 4, further comprising:

if the user successfully logs in with the stored value, then;

generating a new password;

updating the password to the new password; and

revealing the password to the user.

7. The method according to claim 5, further comprising:

registering the user to obtain the destination address.

8. The method according to claim 5, wherein the destination address is accessed separately from an entity that the user uses to log in to the distributed computing system.

9. The method according to claim 5, further comprising:

for any link, permitting the user to log in using the stored value only one time

10. The method according to claim 9, wherein the stored value comprises the last login time of the user.

11. The method according to claim 9, further comprising:

applying a hashing algorithm to a most recent log in time of the user to generate the stored value.

12. The method according to claim 9, further comprising:

creating a replica of the stored value;

incorporating the replica into the link;

comparing the replica with the stored value to determine whether the link is valid.

13. The method according to claim 9, further comprising:

incorporating a log in time of the user into the link;

applying a hashing algorithm to the log in time value to generate a hash value;

comparing the hash value with the stored value to determine whether the link is valid.

14. The method according to claim 1, wherein the link to the stored value is a URL to a secure World Wide Web page that displays the stored value.

15. The method according to claim 1, wherein the message comprises an electronic mail message and the destination address comprises an electronic mail address.

16. The method according to claim 1, wherein the message comprises a hard copy mailing and the destination address comprises a physical mail delivery address.

17. The method according to claim 1, wherein the message comprises a digital communication and the destination address comprises an alphanumeric pager.

18. The method according to claim 1, wherein the message comprises a voice-synthesized telephone call and the destination address comprises a telephone.

19. The method according to claim 1, wherein the message comprises a digital communication and the destination address comprises a facsimile machine.

20. The method according to claim 1, wherein the message includes a username of the user.

21. A server in a distributed computing system to securely change a password, the server comprising:

a database to store a stored value and a destination address of a user;

an interface coupled to the database to receive a request to change the password from the user and to send a message to the destination address, the message specifying a link to the stored value; and

an authentication engine coupled to the interface and the database, the authentication engine configured to update the stored value each time that the user logs in to the distributed computing system, and, if the link is valid, to permit the user to log in to the distributed computing system using the stored value as a log in password.

22. The server according to claim 21, wherein the authentication engine associates an expiration time with the link when the message is sent so that the link is no longer valid when the expiration time is reached.

23. The server according to claim 22, wherein the authentication engine automatically invalidates the link by updating the stored value each time that the user logs in to the distributed computing system.

24. The server according to claim 23, wherein the server receives a public encryption key from the user and encrypts the message according to the public encryption key.

25. The server according to claim 24, wherein for any link, the authentication engine permits the user to log in using the stored value only one time.

26. The server according to claim 25, wherein the authentication engine applies a hashing algorithm to a most recent log in time of the user to generate the stored value.

27. The server according to claim 25, wherein the authentication engine creates a replica of the stored value, incorporates the replica into the link, and compares the replica with the stored value to determine whether the link is valid when a user attempts to log in to the distributed computing system.

28. The server according to claim 25, wherein the authentication engine incorporates a log in time of the user into the link, applies a hashing algorithm to the log in time value to generate a hash value, and compares the hash value with the stored value to determine whether the link is valid when a user attempts to log in to the distributed computing system.

31. The method according to claim 25, further comprising:

associating an expiration time with the link when the message is sent; and

expiring the link when the expiration time is reached.

32. The method according to claim 26, further comprising:

automatically expiring the link following log in by updating the stored value.

29. A distributed computing system to securely change a password, the distributed computing system in communication with the Internet, comprising:

means for storing a stored value and a destination address of a user;

means for receiving a request to change the password from the user;

means for sending a message to the destination address, the message specifying a link to the stored value;

means for permitting the user to log in to the distributed computing system using the stored value as a log in password if the link is valid; and

means for updating the stored value each time that the user logs in to the distributed computing system.

30. A method of securely changing a password in a distributed computing system, comprising:

storing a stored value and an electronic mail address of a user;

receiving a request to change the password from the user;

sending an electronic mail message to the electronic mail address, the electronic mail message specifying a link to a secure World Wide Web page that displays the stored value;

if the link is valid, then;

permitting the user to log in to the distributed computing system using the stored value as a log in password; and

if the user successfully logs in with the stored value, then;

prompting the user for a new password; and

updating the password to the new password; and

updating the stored value each time that the user logs in to the distributed computing system.