Method for private personal identification number management

• US 20030229791A1
• Filed: 06/05/2002
• Published: 12/11/2003
• Est. Priority Date: 06/05/2002
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: De Jong, Eduard
• Granted Patent: US 7,162,456 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 30/018 Certifying business or products

Abstract

A method for private personal identification number (PIN) management comprises ascertaining a first delay period of a preceding PIN. The first delay period is greater than zero if the preceding PIN does not match a validated PIN and the first delay period equals zero if the preceding PIN matches the validated PIN. The method also includes receiving a current PIN after at least the first delay period and delaying for a second delay period if the current PIN does not match the validated PIN. The second delay period is greater than the first delay period.

Claims

1. A method for private personal identification number (PIN) management, comprising:

ascertaining a first delay period of a preceding PIN, said first delay period greater than zero if said preceding PIN does not match a validated PIN, said first delay period equal to zero if said preceding PIN matches said validated PIN;

receiving a current PIN after at least said first delay period; and

delaying for a second delay period if said current PIN does not match said validated PIN, said second delay period greater than said first delay period.

2. The method of claim 1, further comprising repeating said ascertaining, said receiving and said delaying until said current PIN matches said validated PIN.

3. The method of claim 2, further comprising granting access to a service having restricted access when said current PIN matches said validated PIN.

4. A method for private personal identification number (PIN) management, the method comprising:

receiving a first request for a service having restricted access, said first request comprising a first PIN entered by a user;

matching said first PIN with a second PIN that has been validated;

allowing access to said service based at least in part on said matching;

incrementing an exponent if said first PIN does not match said second PIN; and

delaying for a delay period based at least in part on said exponent if said first PIN does not match said second PIN.

5. The method of claim 4 wherein said delaying further comprises recording the start of said delay.

6. The method of claim 4 wherein said delaying further comprises recording the end of said delay.

7. The method of claim 6, further comprising resuming said delay if said end has not been recorded.

8. The method of claim 4 wherein said delaying further comprises delaying for said delay period based at least in part on said exponent after receiving a second request for said service if said first PIN does not match said second PIN.

9. The method of claim 4 wherein said delaying further comprises delaying for said delay period based at least in part on said exponent before determining whether a third PIN associated with a second request for said service matches said second PIN if said first PIN does not match said second PIN.

10. The method of claim 4 wherein said delaying further comprises delaying for said delay period based at least in part on said exponent before receiving a second request for said service if said first PIN does not match said second PIN.

11. The method of claim 4, further comprising initializing said exponent to 0 if said first PIN matches said second PIN.

12. The method of claim 4 wherein said delaying further comprises:

initializing a counter to the value “

1”

;

left-shifting said counter based at least in part on the value of said exponent, the least significant bit of said counter being populated with the value “

0”

upon each left-shift operation; and

delaying for a predetermined time and decrementing said counter while said counter is nonzero.

13. The method of claim 4 wherein said delaying further comprises:

initializing a counter to “

1”

;

left-shifting said counter based at least in part on the value of said exponent, the least significant bit of said counter being populated with the value “

1”

upon each left-shift operation; and

delaying for a predetermined time and decrementing said counter while said counter is nonzero.

14. The method of claim 4 wherein said receiving further comprises:

storing said first PIN in a mutable persistent mutable memory; and

marking said stored first PIN as untested.

15. The method of claim 14 wherein said delaying further comprises:

storing said exponent in said persistent mutable memory before initiation of said delay; and

storing an end-of-delay marker in said persistent mutable memory after completion of said delay.

16. The method of claim 4 wherein

said receiving further comprises:

storing said first PIN in a mutable persistent memory; and

marking said stored first PIN as untested; and

said delaying further comprises;

storing said exponent in said mutable persistent memory upon initiation of said delay; and

storing an end-of-delay marker in said persistent mutable memory after completion of said delay.

17. The method of claim 16 wherein said storing said first PIN further comprises:

allocating an entry in a list of entries in said persistent mutable memory; and

storing said first PIN in said allocated entry.

18. The method of claim 16 wherein said matching further comprises marking said stored first PIN with the result of the test.

19. The method of claim 16 wherein said delaying further comprises:

storing said exponent with said stored first PIN;

performing a delay determined by said stored exponent; and

marking said stored first PIN as tested successfully and said delay completed by setting said stored exponent to 0.

20. A method for private personal identification number (PIN) management, the method comprising:

receiving a first request for a service, said first request comprising a first PIN entered by a user;

allowing access to said service if said service is not PIN-protected;

determining a PIN status if said service is PIN-protected, said determining including delaying for a delay period that increases exponentially with each successive failed access request; and

allowing access to said service based at least in part on said PIN status if said service is PIN-protected.

21. The method of claim 20 wherein said determining further comprises:

ascertaining a first PIN test result;

indicating a successful PIN status if said first PIN test result indicates a successful PIN test;

testing said first PIN against a second PIN stored in a memory if said first PIN test result is unavailable or if said first PIN test result indicates an unsuccessful PIN test, said second PIN comprising a PIN that has been validated;

ascertaining a second PIN test result after said testing;

indicating a successful PIN status if said second PIN test result indicates a successful PIN test; and

indicating an unsuccessful PIN status if said second PIN test result indicates an unsuccessful PIN test.

22. The method of claim 21 wherein

said delaying comprises:

storing an exponent in a persistent mutable memory before initiation of said delay; and

storing an end-of-delay marker in said persistent mutable memory after completion of said delay; and

said ascertaining a first PIN test result comprises;

determining the presence of an end-of-delay marker in said persistent mutable memory; and

delaying for a delay period based at least in part on said stored exponent if said marker is not present in said persistent mutable memory.

23. The method of claim 21 wherein

said delaying comprises:

storing an exponent in a persistent mutable memory before initiation of said delay; and

storing an end-of-delay marker in said persistent mutable memory after completion of said delay; and

said ascertaining a second PIN test result is based at least in part on the presence of said end-of-delay marker in said persistent mutable memory and upon the result of said testing.

24. The method of claim 21 wherein

said first PIN test result comprises a flag stored in a non-persistent mutable memory;

and

said second PIN test result comprises a flag stored in a non-persistent mutable memory.

25. The method of claim 24 wherein said flag indicates an unsuccessful PIN test upon initialization of said non-persistent mutable memory.

26. The method of claim, 21 wherein said testing further comprises:

incrementing an exponent and delaying a delay period based at least in part on said exponent if said first PIN does not match said second PIN;

marking a session PIN flag to indicate a successful PIN test if said first PIN matches said second PIN; and

setting said exponent value to “

0”

if said first PIN matches said second PIN.

27. The method of claim 21 wherein

said delaying comprises:

storing an exponent in a persistent mutable memory before initiation of said delay, said exponent stored in the last entry of a buffer comprising a plurality of entries, each entry comprising a PIN, an exponent and an attempt reference ID, said attempt reference ID associated with a session used to enter said PIN; and

storing an end-of-delay marker in said persistent mutable memory after completion of said delay;

said ascertaining a first PIN test result comprises;

determining the presence of said end-of-delay marker in said persistent mutable memory; and

delaying for a delay period based at least in part on said exponent if said marker is not present in said persistent mutable memory; and

said ascertaining a second PIN test result is based at least in part on the presence of said end-of-delay marker in said persistent mutable memory and upon the result of said testing.

28. The method of claim 27, further comprising delaying for a delay period based at least in part on said exponent of said last entry if the current delay has been interrupted.

29. The method of claim 27 wherein said last entry is validated if said exponent of said last entry is 0.

30. The method of claim 27 wherein said last entry is invalid if said exponent of said last entry is nonzero.

31. The method of claim 27, further comprising indicating a previous delay has been interrupted if the exponent of a buffer entry immediately preceding said last buffer does not equal the exponent of said last buffer entry.

32. The method of claim 27, further comprising indicating said last entry is associated with said current session if the session ID of said last buffer entry equals the session ID of the current session.

33. The method of claim 27 wherein said testing further comprises:

recording a PIN compare attempt in said buffer;

delaying if said first PIN does not match the PIN in a validated entry; and

marking a delay result in said buffer.

34. The method of claim 33 wherein said recording further comprises:

determining empty entries in said buffer;

determining the last entered entry in said buffer based at least in part on the entry number of each entry in said buffer;

creating a new entry comprising an exponent that equals one plus the exponent of said last entered entry.

storing said new entry in one of said empty entries; and

marking said new entry as the last entry.

35. The method of claim 34 wherein said delaying further comprises:

locating a validated entry in said buffer, said validated entry having an exponent value of 0;

loading the PIN value from said last buffer entry; and

delaying for a delay period based at least in part on said exponent value read from said last entry.

36. The method of claim 33 wherein said marking a delay result further comprises:

copying the buffer entry stored immediately prior to said delaying to create a new entry;

setting the exponent value of said new entry to 0 if said first PIN equals said second PIN; and

storing said new entry in said persistent mutable memory.

37. The method of claim 21 wherein

said delaying comprises:

storing said exponent in said persistent mutable memory before initiation of said delay, said exponent stored in the last entry of a buffer comprising a plurality of entries, each entry comprising a scrambled PIN, an exponent and an attempt reference ID, said attempt reference ID associated with a session used to enter said PIN; and

storing an end-of-delay marker in said persistent mutable memory after completion of said delay;

said ascertaining a first PIN test result comprises;

determining the presence of said end-of-delay marker in said persistent mutable memory; and

delaying for a delay period based at least in part on said exponent if said marker is not present in said persistent mutable memory; and

said ascertaining a second PIN test result is based at least in part on the presence of said end-of-delay marker in said persistent mutable memory and upon the result of said testing.

38. The method of claim 37, further comprising delaying for a delay period based at least in part on said exponent in said last entry if the current delay has been interrupted.

39. The method of claim 37 wherein said last entry is validated if said exponent of said last entry is 0.

40. The method of claim 37 wherein said last entry is invalid if said exponent of said last entry is nonzero.

41. The method of claim 37, further comprising indicating a previous delay has been interrupted if the exponent of an entry immediately preceding said last does not equal the exponent of said last entry.

42. The method of claim 37, further comprising indicating said last entry is associated with said current session if the session ID of said last entry equals the session ID of the current session.

43. The method of claim 37 wherein said testing further comprises:

recording a PIN compare attempt in said buffer;

delaying if a first scrambled PIN does not match a second scrambled PIN that has been validated, said first scrambled PIN comprising said first PIN scrambled with a first key, said second scrambled PIN comprising a second PIN scrambled with said first key, said second scrambled PIN and said first key stored in a validated entry; and

marking a delay result in said buffer.

44. The method of claim 43 wherein said first key comprises a randomized key.

45. The method of claim 43 wherein said first key comprises a session ID.

46. The method of claim 43 wherein said recording further comprises:

determining empty entries in said buffer;

determining the last entered entry in said buffer based at least in part on the entry number of each entry in said buffer;

creating a new entry comprising a PIN that equals said first PIN, said new entry further comprising an exponent that equals one plus the exponent of said last entered entry.

scrambling the PIN of said new entry with a second key;

storing said new entry in one of said empty entries; and

marking said new entry as the last entry.

47. The method of claim 46 wherein said delaying further comprises:

locating said validated entry in said buffer;

loading said first PIN from said last entry;

scrambling said first PIN with said first key to create said first scrambled PIN; and

delaying for a delay period based at least in part on said exponent value read from said last entry.

48. The method of claim 47 wherein said scrambling said first PIN further comprises applying an exclusive “

OR”

operation to said first PIN and said first key.

49. The method of claim 47 wherein said delaying for a delay period further comprises performing a number of unit delays, said number based at least in part on said exponent, each of said unit delays comprising:

initializing a result to 0; and

applying a bit-wise exclusive “

OR”

operation to said result, said first scrambled PIN and said second scrambled PIN.

50. The method of claim 43 wherein said marking a delay result further comprises:

copying said PIN compare attempt entry to create a new entry;

setting the exponent value of said new entry to 0 if said result is 0; and

storing said new entry in said persistent mutable memory.

51. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for private personal identification number (PIN) management, the method comprising:

ascertaining a first delay period of a preceding PIN, said first delay period greater than zero if said preceding PIN does not match a validated PIN, said first delay period equal to zero if said preceding PIN matches said validated PIN;

receiving a current PIN after at least said first delay period; and

delaying for a second delay period if said current PIN does not match said validated PIN, said second delay period greater than said first delay period.

52. The program storage device of claim 51, said method further comprising repeating said ascertaining, said receiving and said delaying until said current PIN matches said validated PIN.

53. The program storage device of claim 52, said method further comprising granting access to a service having restricted access when said current PIN matches said validated PIN.

54. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for private personal identification number (PIN) management, the method comprising:

receiving a first request for a service having restricted access, said first request comprising a first PIN entered by a user;

matching said first PIN with a second PIN that has been validated;

allowing access to said service based at least in part on said matching;

incrementing an exponent if said first PIN does not match said second PIN; and

delaying for a delay period based at least in part on said exponent if said first PIN does not match said second PIN.

55. The program storage device of claim 54 wherein said delaying further comprises recording the start of said delay.

56. The program storage device of claim 54 wherein said delaying further comprises recording the end of said delay.

57. The program storage device of claim 56 wherein said method further comprises resuming said delay if said end has not been recorded.

58. The program storage device of claim 54 wherein said delaying further comprises delaying for said delay period based at least in part on said exponent after receiving a second request for said service if said first PIN does not match said second PIN.

59. The program storage device of claim 54 wherein said delaying further comprises delaying for said delay period based at least in part on said exponent before determining whether a third PIN associated with a second request for said service matches said second PIN if said first PIN does not match said second PIN.

60. The program storage device of claim 54 wherein said delaying further comprises delaying for said delay period based at least in part on said exponent before receiving a second request for said service if said first PIN does not match said second PIN.

61. The program storage device of claim 54 wherein said method further comprises initializing said exponent to 0 if said first PIN matches said second PIN.

62. The program storage device of claim 54 wherein said delaying further comprises:

initializing a counter to the value “

1”

;

left-shifting said counter based at least in part on the value of said exponent, the least significant bit of said counter being populated with the value “

0”

upon each left-shift operation; and

delaying for a predetermined time and decrementing said counter while said counter is nonzero.

63. The program storage device of claim 54 wherein said delaying further comprises:

initializing a counter to “

1”

;

left-shifting said counter based at least in part on the value of said exponent, the least significant bit of said counter being populated with the value “

1”

upon each left-shift operation; and

delaying for a predetermined time and decrementing said counter while said counter is nonzero.

64. The program storage device of claim 54 wherein said receiving further comprises:

storing said first PIN in a mutable persistent mutable memory; and

marking said stored first PIN as untested.

65. The program storage device of claim 64 wherein said delaying further comprises:

storing said exponent in said persistent mutable memory before initiation of said delay; and

storing an end-of-delay marker in said persistent mutable memory after completion of said delay.

66. The program storage device of claim 54 wherein

said receiving further comprises:

storing said first PIN in a mutable persistent memory; and

marking said stored first PIN as untested; and

said delaying further comprises;

storing said exponent in said mutable persistent memory upon initiation of said delay; and

storing an end-of-delay marker in said persistent mutable memory after completion of said delay.

67. The program storage device of claim 66 wherein said storing said first PIN further comprises:

allocating an entry in a list of entries in said persistent mutable memory; and

storing said first PIN in said allocated entry.

68. The program storage device of claim 66 wherein said matching further comprises marking said stored first PIN with the result of the test.

69. The program storage device of claim 66 wherein said delaying further comprises:

storing said exponent with said stored first PIN;

performing a delay determined by said stored exponent; and

marking said stored first PIN as tested successfully and said delay completed by setting said stored exponent to 0.

70. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for private personal identification number (PIN) management, the method comprising:

receiving a first request for a service, said first request comprising a first PIN entered by a user;

allowing access to said service if said service is not PIN-protected;

determining a PIN status if said service is PIN-protected, said determining including delaying for a delay period that increases exponentially with each successive failed access request; and

allowing access to said service based at least in part on said PIN status if said service is PIN-protected.

71. The program storage device of claim 70 wherein said determining further comprises:

ascertaining a first PIN test result;

indicating a successful PIN status if said first PIN test result indicates a successful PIN test;

testing said first PIN against a second PIN stored in a memory if said first PIN test result is unavailable or if said first PIN test result indicates an unsuccessful PIN test, said second PIN comprising a PIN that has been validated;

ascertaining a second PIN test result after said testing;

indicating a successful PIN status if said second PIN test result indicates a successful PIN test; and

indicating an unsuccessful PIN status if said second PIN test result indicates an unsuccessful PIN test.

72. The program storage device of claim 71 wherein

said delaying comprises:

storing an exponent in a persistent mutable memory before initiation of said delay; and

storing an end-of-delay marker in said persistent mutable memory after completion of said delay; and

said ascertaining a first PIN test result comprises;

determining the presence of an end-of-delay marker in said persistent mutable memory; and

delaying for a delay period based at least in part on said stored exponent if said marker is not present in said persistent mutable memory.

73. The program storage device of claim 71 wherein

said delaying comprises:

storing an exponent in a persistent mutable memory before initiation of said delay; and

storing an end-of-delay marker in said persistent mutable memory after completion of said delay; and

said ascertaining a second PIN test result is based at least in part on the presence of said end-of-delay marker in said persistent mutable memory and upon the result of said testing.

74. The program storage device of claim 71 wherein

said first PIN test result comprises a flag stored in a non-persistent mutable memory;

and

said second PIN test result comprises a flag stored in a non-persistent mutable memory.

75. The program storage device of claim 74 wherein said flag indicates an unsuccessful PIN test upon initialization of said non-persistent mutable memory.

76. The program storage device of claim 71 wherein said testing further comprises:

incrementing an exponent and delaying a delay period based at least in part on said exponent if said first PIN does not match said second PIN;

marking a session PIN flag to indicate a successful PIN test if said first PIN matches said second PIN; and

setting said exponent value to “

0”

if said first PIN matches said second PIN.

77. The program storage device of claim 71 wherein

said delaying comprises:

storing an exponent in a persistent mutable memory before initiation of said delay, said exponent stored in the last entry of a buffer comprising a plurality of entries, each entry comprising a PIN, an exponent and an attempt reference ID, said attempt reference ID associated with a session used to enter said PIN; and

storing an end-of-delay marker in said persistent mutable memory after completion of said delay;

said ascertaining a first PIN test result comprises;

determining the presence of said end-of-delay marker in said persistent mutable memory; and

delaying for a delay period based at least in part on said exponent if said marker is not present in said persistent mutable memory; and

said ascertaining a second PIN test result is based at least in part on the presence of said end-of-delay marker in said persistent mutable memory and upon the result of said testing.

78. The program storage device of claim 77 wherein said method further comprises delaying for a delay period based at least in part on said exponent of said last entry if the current delay has been interrupted.

79. The program storage device of claim 77 wherein said last entry is validated if said exponent of said last entry is 0.

80. The program storage device of claim 77 wherein said last entry is invalid if said exponent of said last entry is nonzero.

81. The program storage device of claim 77 wherein said method further comprises indicating a previous delay has been interrupted if the exponent of a buffer entry immediately preceding said last buffer does not equal the exponent of said last buffer entry.

82. The program storage device of claim 77 wherein said method further comprises indicating said last entry is associated with said current session if the session ID of said last buffer entry equals the session ID of the current session.

83. The program storage device of claim 77 wherein said testing further comprises:

recording a PIN compare attempt in said buffer;

delaying if said first PIN does not match the PIN in a validated entry; and

marking a delay result in said buffer.

84. The program storage device of claim 83 wherein said recording further comprises:

determining empty entries in said buffer;

determining the last entered entry in said buffer based at least in part on the entry number of each entry in said buffer;

creating a new entry comprising an exponent that equals one plus the exponent of said last entered entry.

storing said new entry in one of said empty entries; and

marking said new entry as the last entry.

85. The program storage device of claim 84 wherein said delaying further comprises:

locating a validated entry in said buffer, said validated entry having an exponent value of 0;

loading the PIN value from said last buffer entry; and

delaying for a delay period based at least in part on said exponent value read from said last entry.

86. The program storage device of claim 83 wherein said marking a delay result further comprises:

creating a new buffer entry that equals the buffer entry stored immediately prior to said delaying;

setting the exponent value of said new entry to 0 if said first PIN equals said second PIN; and

storing said new entry in said persistent mutable memory.

87. The program storage device of claim 71 wherein

said delaying comprises:

storing said exponent in said persistent mutable memory before initiation of said delay, said exponent stored in the last entry of a buffer comprising a plurality of entries, each entry comprising a scrambled PIN, an exponent and an attempt reference ID, said attempt reference ID associated with a session used to enter said PIN; and

storing an end-of-delay marker in said persistent mutable memory after completion of said delay;

said ascertaining a first PIN test result comprises;

determining the presence of said end-of-delay marker in said persistent mutable memory; and

delaying for a delay period based at least in part on said exponent if said marker is not present in said persistent mutable memory; and

said ascertaining a second PIN test result is based at least in part on the presence of said end-of-delay marker in said persistent mutable memory and upon the result of said testing.

88. The program storage device of claim 87 wherein said method further comprises delaying for a delay period based at least in part on said exponent in said last entry if the current delay has been interrupted.

89. The program storage device of claim 87 wherein said last entry is validated if said exponent of said last entry is 0.

90. The program storage device of claim 87 wherein said last entry is invalid if said exponent of said last entry is nonzero.

91. The program storage device of claim 87 wherein said method further comprises indicating a previous delay has been interrupted if the exponent of an entry immediately preceding said last does not equal the exponent of said last entry.

92. The program storage device of claim 87 wherein said method further comprises indicating said last entry is associated with said current session if the session ID of said last entry equals the session ID of the current session.

93. The program storage device of claim 87 wherein said testing further comprises:

recording a PIN compare attempt in said buffer;

delaying if a first scrambled PIN does not match a second scrambled PIN that has been validated, said first scrambled PIN comprising said first PIN scrambled with a first key, said second scrambled PIN comprising a second PIN scrambled with said first key, said second scrambled PIN and said first key stored in a validated entry; and

marking a delay result in said buffer.

94. The program storage device of claim 93 wherein said first key comprises a randomized key.

95. The program storage device of claim 93 wherein said first key comprises a session ID.

96. The program storage device of claim 93 wherein said recording further comprises:

determining empty entries in said buffer;

determining the last entered entry in said buffer based at least in part on the entry number of each entry in said buffer;

creating a new entry comprising a PIN that equals said first PIN, said new entry further comprising an exponent that equals one plus the exponent of said last entered entry.

scrambling the PIN of said new entry with a second key;

storing said new entry in one of said empty entries; and

marking said new entry as the last entry.

97. The program storage device of claim 96 wherein said delaying further comprises:

locating said validated entry in said buffer;

loading said first PIN from said last entry;

scrambling said first PIN with said first key to create said first scrambled PIN; and

delaying for a delay period based at least in part on said exponent value read from said last entry.

98. The program storage device of claim 97 wherein said scrambling said first PIN further comprises applying an exclusive “

OR”

operation to said first PIN and said first key.

99. The program storage device of claim 97 wherein said delaying for a delay period further comprises performing a number of unit delays, said number based at least in part on said exponent, each of said unit delays comprising:

initializing a result to 0; and

applying a bit-wise exclusive “

OR”

operation to said result, said first scrambled PIN and said second scrambled PIN.

100. The program storage device of claim 93 wherein said marking a delay result further comprises:

copying said PIN compare attempt entry to create a new entry;

setting the exponent value of said new entry to 0 if said result is 0; and

storing said new entry in said persistent mutable memory.