SYSTEMS AND METHODS OF SECURING RESOURCES THROUGH PASSWORDS

• US 20060041756A1
• Filed: 08/19/2004
• Published: 02/23/2006
• Est. Priority Date: 08/19/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Milne, Robert J., Nahar, Rahul, Dunki-Jacobs, Raymond P., Ashok, Guru S., Tandel, Shreesh S., Shah, Ashit M., Venkatachalam, Muthuswamy
• Granted Patent: US 7,373,516 B2
• Time in Patent Office: Days
• US Class Current: 713/183
• CPC Class Codes: G06F 21/31 User authentication

Abstract

Disclosed is a method of authorizing access to an item that maintains a lockout count and blocks access to the item if the lockout count exceeds a predetermined value. One feature is that the invention “variably” increments the lockout count if the presented password fails to exactly match the stored password. In this process the invention increments the lockout count different amounts depending upon how closely the presented password matches the stored password. The invention also provides a methodology that allocates a plurality of the same passwords to a plurality of users who share the same userid. The invention allows continuous operation of the item being accessed by providing that each of the passwords has a different expiration date. Also, when dealing with situations where a plurality of users who share the same userid also share the same password, the invention maps information associated with the users to the password in a data file and periodically updates the data file.

Claims

1. A method of authorizing access to an item, said method comprising:

receiving a presented password from an entity desiring access to said item;

comparing said presented password with a stored password;

authorizing access if said presented password exactly matches said stored password;

denying access if said presented password fails to exactly match said stored password;

variably incrementing a lockout count if said presented password fails to exactly match said stored password; and

locking out access to said item if said lockout count exceeds a predetermined value,

wherein said variably incrementing process increments said lockout count different amounts depending upon how closely said presented password matches said stored password.

2. The method in claim 1, wherein, in said variably incrementing process, said lockout count is incremented a lesser amount as said presented password matches said stored password more closely and is incremented a greater amount as said presented password matches said stored password less closely.

3. The method in claim 1, further comprising determining how closely said presented password matches said stored password by evaluating whether the difference between said presented password and said stored password relates to typographical errors.

4. The method in claim 1, further comprising determining how closely said presented password matches said stored password by classifying the difference between said presented password and said stored password into different types of password errors.

5. The method in claim 4, wherein said different types of password errors cause said lockout count to be incremented by different values.

6. The method in claim 4, wherein said types of password errors comprise missing characters, extra characters, transposed characters, and incorrect case usage.

7. The method in claim 1, wherein said denying process allows additional passwords to be presented and said locking out process prevents additional passwords from being presented.

8. A method of authorizing access to an item, said method comprising:

receiving a presented password from an entity desiring access to said item;

comparing said presented password with a stored password;

authorizing access if said presented password exactly matches said stored password;

denying access if said presented password fails to exactly match said stored password;

variably incrementing a lockout count if said presented password fails to exactly match said stored password; and

locking out access to said item if said lockout count exceeds a predetermined value,

wherein said variably incrementing process does not increment said lockout count if said presented password is the same as a previously presented password that was entered within a predetermined previous time period.

9. The method in claim 8, wherein, wherein said variably incrementing process increments said the lockout count different amounts depending upon how closely said presented password matches said stored password, such that said lockout count is incremented a lesser amount as said presented password matches said stored password more closely and is incremented a greater amount as said presented password matches said stored password less closely.

10. The method in claim 9, further comprising determining how closely said presented password matches said stored password by evaluating whether the difference between said presented password and said stored password relates to typographical errors.

11. The method in claim 9, further comprising determining how closely said presented password matches said stored password by classifying the difference between said presented password and said stored password into different types of password errors.

12. The method in claim 11, wherein said different types of password errors cause said lockout count to be incremented by different values.

13. The method in claim 11, wherein said types of password errors comprise missing characters, extra characters, transposed characters, and incorrect case usage.

14. The method in claim 8, wherein said denying process allows additional passwords to be presented and said locking out process prevents additional password from being presented.

15. A method of authorizing access to an item, said method comprising:

allocating a plurality of passwords to a user, wherein each of said passwords has a different expiration date; and

allowing access to said item when said user supplies any one of said passwords before the password supplied has expired.

16. The method in claim 15, further comprising notifying said user when each password expires.

17. The method in claim 15, further comprising:

allocating additional passwords to said user; and

requiring that an expiration date for said additional passwords be different than expiration dates for any other passwords.

18. The method in claim 17, further comprising resetting said expiration dates such that said expirations dates are evenly spaced in time.

19. The method in claim 18, wherein if, during said process of allowing access, said user enters an expired password prior to entering an unexpired password, said method further comprises notifying said user that said expired password has expired, after said user has entered said unexpired password.

20. The method in claim 15, wherein said allocating is done at the request of at least one of said user, said item, and a third party.

21. The method in claim 15, wherein during said allocating process, said passwords are selected by at least one of said user, said item, and a third party.

22. A method of authorizing access to an item, said method comprising:

allocating a plurality of the same passwords to a plurality of users who share the same userid, wherein each of said passwords has a different expiration date; and

allowing access to said item when any of said users supplies any of said passwords before the password supplied has expired.

23. The method in claim 22, further comprising notifying all of said users when each password expires.

24. The method in claim 22, further comprising:

allocating additional passwords to said users; and

requiring that an expiration date for said additional passwords be different than expiration dates for any other passwords.

25. The method in claim 24, further comprising resetting said expiration dates such that said expirations dates are evenly spaced in time.

26. The method in claim 25, wherein if, during said process of allowing access, one user of said users enters an expired password prior to entering an unexpired password, said method further comprises notifying said user that said expired password has expired after said user has entered said unexpired password.

27. The method in claim 22, wherein said allocating is done at the request of at least one of:

one of said users;

said item; and

a third party.

28. The method in claim 22, wherein during said allocating process, said passwords are selected by at least one of:

one of said users;

said item; and

a third party.

29. A method of authorizing access to an item, said method comprising:

allocating the same password to a plurality of users who share the same userid, wherein said password has an expiration date;

allowing access to said item when any of said users supply said password before said password has expired;

mapping information associated with said users to said password in a data file; and

periodically updating said data file.

30. The method in claim 29, further comprising notifying said users of expiration of said password a predetermined period before said password expires.

31. The method in claim 29, further comprising periodically contacting said users to confirm accuracy of said information within said data file.

32. The method in claim 29, wherein said information associated with said users identifies third parties responsible for said users, and

wherein said method further comprises notifying at least one corresponding third party if said user is denied access to said item because of an invalid password.

33. The method in claim 29, wherein said users comprise individuals, applications, and application owners.

34. The method in claim 29, further comprising updating said data file as said password is changed by said users in said userid.

35. The method in claim 29, further comprising checking for inconsistencies between a password being maintained by a user and a password within said data file;

and correcting one of user data and said data file when said inconsistencies are found.

36. A program storage device readable by machine, tangibly embodying a program of instructions executable by said machine to perform a method of authorizing access to an item, said method comprising:

receiving a presented password from an entity desiring access to said item;

comparing said presented password with a stored password;

authorizing access if said presented password exactly matches said stored password;

denying access if said presented password fails to exactly match said stored password;

variably incrementing a lockout count if said presented password fails to exactly match said stored password; and

locking out access to said item if said lockout count exceeds a predetermined value,

wherein said variably incrementing process increments said lockout count different amounts depending upon how closely said presented password matches said stored password.

37. The program storage device in claim 36, wherein, in said variably incrementing process, said lockout count is incremented a lesser amount as said presented password matches said stored password more closely and is incremented a greater amount as said presented password matches said stored password less closely.

38. The program storage device in claim 36, wherein said method further comprises determining how closely said presented password matches said stored password by evaluating whether the difference between said presented password and said stored password relates to typographical errors.

39. The program storage device in claim 36, wherein said method further comprises determining how closely said presented password matches said stored password by classifying the difference between said presented password and said stored password into different types of password errors.

40. The program storage device in claim 39, wherein said different types of password errors cause said lockout count to be incremented by different values.

41. The program storage device in claim 39, wherein said types of password errors comprise missing characters, extra characters, transposed characters, and incorrect case usage.

42. The program storage device in claim 36, wherein said denying process allows additional passwords to be presented and said locking out process prevents additional passwords from being presented.