SECURE CREDENTIALS CONTROL METHOD

• US 20090064297A1
• Filed: 08/29/2008
• Published: 03/05/2009
• Est. Priority Date: 08/30/2007
• Status: Active Grant

• Current Assignee: Baimmt, LLC
• Original Assignee: Baimmt, LLC
• Inventors: Selgas, Thomas D., Cutrer, Jonathan
• Granted Patent: US 10,055,595 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords

Abstract

Methods, apparatus, and systems are provided to secure access to an account of a user. The account may have a system administrator. The user may have a credential for accessing the secure data on the account. The methods, apparatus, and systems involve setting a universal reset credential associated with the account, denying the system administrator of the account permission to change the first credential of the access feature, and permitting the system administrator to reset the access feature from the first credential to the universal reset credential.

Claims

1. A method for securing access to an account of a user, wherein the account comprises at least a first credential set as at least a portion of an access feature for authenticating the user, the method comprising:

setting a universal reset credential associated with the account;

denying a system administrator of the account permission to change the first credential of the access feature; and

permitting the system administrator to reset the access feature from the first credential to the universal reset credential.

2. The method of claim 1, the method further comprising:

recording information related to a change to the first credential in a secure database; and

sending a notification of the change to the first credential.

3. The method of claim 2, wherein sending a notification comprises requesting from the user a first response to the notification which indicates approval or disapproval of the change to the first credential.

4. The method of claim 3, wherein denying a system administrator further comprises denying the system administrator permission to change the access feature from the universal reset credential to the first credential.

5. The method of claim 4, wherein the first credential is a password.

6. The method of claim 4, wherein the first credential is selected from the group of a biometric, a key, and a combination.

7. The method of claim 4, the method further comprising:

recording information related to a reset of the first credential in a secure database; and

sending a notification of the reset of the first credential.

8. The method of claim 7, wherein sending a notification comprises requesting from the user a second response to the notification which indicates approval or disapproval of the reset to the first credential.

9. The method of claim 8, further comprising:

denying a system administrator of the account permission to access a second credential set as at least a portion of the access feature, wherein the second credential comprises a credential receiver and a code;

permitting the system administrator to reset the access feature from the second credential to the universal reset credential.

10. The method of claim 9, the method further comprising:

recording information related to a change to the second credential in the secure database; and

sending a notification of the change to the second credential.

11. The method of claim 10, wherein sending a notification comprises requesting from the user a response to the notification which indicates approval or disapproval of the change to the second credential.

12. A computer program product for enabling a computer to secure access to an account of a user, wherein the account comprises at least a first credential set as at least a portion of an access feature for authenticating the user, the computer program product comprising:

software instructions for enabling a computer to perform predetermined operations; and

a computer readable storage medium bearing the software instructions;

the predetermined operations including;

setting a universal reset credential associated with the account;

denying a system administrator of the account permission to change the first credential of the access feature; and

permitting the system administrator to reset the access feature from the first credential to the universal reset credential.

13. The computer program product of claim 12, wherein the predetermined operations further include:

recording information related to a change to the first credential in a secure database; and

sending a notification of the change to the user and a designee of the user.

14. The computer program product of claim 13, wherein the predetermined operations of denying a system administrator further comprises denying the system administrator permission to change the access feature from the universal reset credential to the first credential.

15. The computer program product of claim 14, wherein the first credential is a password.

16. The computer program product of claim 14, wherein the first credential is selected from the group of a biometric, a key, and a combination.

17. The computer program product of claim 14, wherein the predetermined operations further include:

recording information related to a reset of the first credential in a secure database; and

sending a notification of the reset of the first credential.

18. The computer program product of claim 17, wherein the predetermined operations further include:

denying a system administrator of the account permission to access a second credential set as at least a portion of the access feature, wherein the second credential comprises a credential receiver chosen by the user and a pass code; and

permitting the system administrator to reset the at least a portion of the access feature from the second credential to the universal reset credential.

19. The computer program product of claim 18, the method further comprising:

recording information related to a change of the portion of the access feature relating to the second credential in a secure location; and

sending a notification of the change to the access feature portion.

20. A method for securing access to an account of a user, wherein the account comprises at least a first credential set as at least a portion of an access feature for authenticating the user, the method comprising:

setting a universal reset credential associated with the account;

denying a system administrator of the account permission to change the first credential, wherein the system administrator is denied permission to change the access feature from the universal reset credential to the first credential;

permitting the system administrator to reset the access feature from the first credential to the universal reset credential.

recording information related to a change to the first credential in a secure table;

sending a notification of the change to the first credential;

recording information related to a reset of the first credential in a secure table; and

sending a notification of the reset of the first credential.