Method for enabling an administrator to configure a recovery password

• US 20070157032A1
• Filed: 12/29/2005
• Published: 07/05/2007
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Workday Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Paganetti, Robert, Kern, David
• Granted Patent: US 8,296,827 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords

Abstract

A method is provided for a enabling a user to initiate a password protected backup copy of the user'"'"'s credentials. The method includes providing a user with a credential store containing information relating to the user'"'"'s identity, generating a different recovery password of any length for each recovery authority, encrypting the recovery password for each recovery authority, storing the encrypted recovery passwords in the credential store, and sending a copy of the information by the user from the credential store to a central repository.

Claims

1. A method for enabling a user to protect a password stored in a central repository and maintained by a plurality of recovery authorities and to initiate a backup copy of the user'"'"'s credentials, the method comprising:

providing a user with a credential store containing information relating to the user'"'"'s identity;

generating a different recovery password of any length for each of said recovery authorities;

encrypting said recovery password for each of said recovery authorities;

storing said encrypted recovery passwords in said credential store; and

sending a portion of said information together with said password and said encrypted recovery password by the user from the credential store to the central repository.

2. The method according to claim 1, comprising the user manually initiating backup of the user'"'"'s credentials.

3. The method according to claim 1, comprising randomly generating a symmetric key, a public key and a private key.

4. The method according to claim 3, comprising encrypting said portion of information with said public key.

5. The method according to claim 3, comprising encrypting said private key with said symmetric key.

6. The method according to claim 3, wherein encrypting the recovery password comprises the steps of:

retrieving a public key of each of said recovery authorities;

encrypting said symmetric key with each of said recovery passwords; and

encrypting each of said recovery passwords with the public key of each of said recovery authorities.

7. The method of claim 1, wherein a Certifying Authority used for certifying the user, is configured with recovery information.

8. The method according to claim 7, wherein the recovery information comprises a quorum number of recovery authorities.

9. The method according to claim 7, wherein the recovery information comprises a location of the credential store.

10. The method according to claim 7, wherein the recovery information comprises a length of recovery passwords.

11. The method according to claim 7, wherein the recovery information comprises a list of recovery authorities.

12. A method for enabling a user to protect a password stored in a central repository and to initiate a backup copy of the user'"'"'s credentials, the method comprising:

providing a user with a credential store containing information relating to the user'"'"'s identity;

querying the user for a password for encrypting at least a portion of said information;

providing a user'"'"'s password in response to said query;

generating a recovery password of any length;

encrypting said recovery password;

linking said user'"'"'s password with said encrypted recovery password;

storing said user'"'"'s password and said encrypted recovery password in the credential store; and

sending said portion of said information together with said password and said encrypted recovery password by the user from the credential store to the central repository.

13. The method according to claim 12, comprising the user initiating backup of the user'"'"'s credentials by pushing a user interface button.

14. The method according to claim 12, comprising randomly generating a symmetric key, a public key and a private key.

15. The method according to claim 14, comprising encrypting said portion of information with said public key.

16. The method according to claim 14, comprising encrypting said private key with said symmetric key.

17. The method according to claim 14, wherein encrypting the recovery password comprises the steps of:

retrieving a public key of each of said recovery authorities;

encrypting said symmetric key with each of said recovery passwords; and

encrypting each of said recovery passwords with the public key of each of said recovery authorities.

18. The method of claim 12, wherein a Certifying Authority used for certifying the user, is configured with recovery information.

19. The method according to claim 18, wherein the recovery information comprises a quorum number of recovery authorities.

20. The method according to claim 18, wherein the recovery information comprises a location of the credential store.

21. The method according to claim 18, wherein the recovery information comprises a length of recovery passwords.

22. The method according to claim 18, wherein the recovery information comprises a list of recovery authorities.