Computer access security

• US 20060236118A1
• Filed: 04/05/2005
• Published: 10/19/2006
• Est. Priority Date: 04/05/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Goldberg, Itzhack
• Granted Patent: US 7,779,452 B2
• Time in Patent Office: Days
• US Class Current: 713/185
• CPC Class Codes: G06F 21/31 User authentication

Abstract

A method is provided for improved computer access security, the method including protecting an access record to prevent password access to a computer via the access record, creating an alternate access record corresponding to the protected record, enabling password access to the computer via the alternate record, providing the alternate record with the access level of the protected record, and configuring the alternate record to indicate a supplemental security program to be executed once a correct password for the alternate record is provided.

Claims

1. A method for improved computer access security, the method comprising:

protecting an access record to prevent password access to a computer via said access record;

creating an alternate access record corresponding to said protected record;

enabling password access to said computer via said alternate record;

providing said alternate record with the access level of said protected record; and

configuring said alternate record to indicate a supplemental security program to be executed once a correct password for said alternate record is provided.

2. A method according to claim 1 and further comprising executing a shell program indicated by said protected record subsequent to said supplemental security program allowing access to said computer.

3. A method according to claim 1 wherein said protecting step comprises protecting said access record of said computer running the UNIX operating system.

4. A method according to claim 3 wherein said protecting step comprises protecting a root directory access record.

5. A method according to claim 3 wherein said protecting step comprises protecting by modifying said access record in a /etc/passwd file.

6. A method according to claim 5 wherein said protecting step comprises replacing a password of said access record with an entry indicating that password access is not allowed for said access record.

7. A method according to claim 5 wherein said creating step comprises creating said alternate record in said /etc/passwd file.

8. A method according to claim 4 wherein said providing step comprises assigning said alternate record with a UID=0.

9. A method according to claim 1 wherein said configuring step comprises configuring said supplemental security program to execute a one-time-password protocol.

10. A method according to claim 1 wherein said configuring step comprises configuring said supplemental security program to execute a challenge/response protocol.

11. A system for improved computer access security, the system comprising:

means for protecting an access record to prevent password access to a computer via said access record;

means for creating an alternate access record corresponding to said protected record;

means for enabling password access to said computer via said alternate record;

means for providing said alternate record with the access level of said protected record; and

means for configuring said alternate record to indicate a supplemental security program to be executed once a correct password for said alternate record is provided.

12. A system according to claim 11 wherein said supplemental security program is operative to execute a shell program indicated by said protected record subsequent to said supplemental security program allowing access to said computer.

13. A system according to claim 11 wherein said computer runs the UNIX operating system.

14. A system according to claim 13 wherein said access record is a root directory access record.

15. A system according to claim 13 wherein said means for protecting is operative to modify said access record in a /etc/passwd file.

16. A system according to claim 15 wherein said means for protecting is operative to replace a password of said access record with an entry indicating that password access is not allowed for said access record.

17. A system according to claim 15 wherein said means for creating is operative to create said alternate record in said /etc/passwd file.

18. A system according to claim 14 wherein said means for providing is operative to assign said alternate record with a UID=0.

19. A system according to claim 11 wherein said supplemental security program is operative to execute a one-time-password protocol.

20. A computer-implemented program embodied on a computer-readable medium, the computer program comprising:

a first code segment operative to protect an access record to prevent password access to a computer via said access record;

a second code segment operative to create an alternate access record corresponding to said protected record;

a third code segment operative to enable password access to said computer via said alternate record;

a fourth code segment operative to provide said alternate record with the access level of said protected record; and

a fifth code segment operative to configure said alternate record to indicate a supplemental security program to be executed once a correct password for said alternate record is provided.