Handling Expired Passwords

• US 20110029782A1
• Filed: 04/01/2009
• Published: 02/03/2011
• Est. Priority Date: 04/04/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Havercan, Peter E.
• Granted Patent: US 9,705,878 B2
• Time in Patent Office: Days
• US Class Current: 713/183
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068

Abstract

A method of operating a server comprises receiving an authorisation request comprising a password, accessing an expiry date for the password, transmitting a response comprising the expiry date, ascertaining whether the password has expired, and receiving a new password, if the password has expired. Optionally, the transmitted response further comprises a date representing the last use of the password and/or an integer value representing a retry parameter.

Claims

1. A method of operating a server comprising:

receiving an authorisation request comprising a password,

accessing an expiry date for the password,

transmitting a response comprising the expiry date, so as to allow a client to modify a way that a user is prompted for credentials,

ascertaining whether the password has expired, and

receiving a new password, if the password has expired.

2. A method according to claim 1, wherein the transmitted response further comprises a date representing the last use of the password.

3. A method according to claim 1, wherein the transmitted response further comprises an integer value representing a retry parameter.

4. A method according to claim 3, and further comprising receiving a request comprising a new password, ascertaining that the new password is unacceptable, and transmitting a response including the integer value representing the retry parameter, the integer value being unchanged.

5. A method according to claim 3, and further comprising receiving a request comprising the old password, and transmitting a response including the integer value representing the retry parameter, the integer value being decremented by 1.

6. A method according to claim 1, wherein the step of transmitting a response comprising the expiry date comprises transmitting a message including a header, the header comprising the expiry date.

7. A method according to claim 6, and further comprising operating the server according to a request and reply transfer protocol, wherein the transmitted response is a reply according to the protocol.

8. A method according to claim 7, wherein the transmitted response, being a reply according to the protocol, is transmitted by the server every time an authorisation request is received.

23. A computer program product according to claim 6, and further comprising instructions for operating the server according to a request and reply transfer protocol, wherein the transmitted response is a reply according to the protocol.

24. A computer program product according to claim 7, wherein the transmitted response, being a reply according to the protocol, is transmitted by the server every time an authorisation request is received.

25. A computer program comprising computer program code to, when loaded into a computer system and executed thereon, cause said computer system to perform the method of claim 1.

9. A server arranged to:

receive an authorisation request comprising a password,

access an expiry date for the password,

transmit a response comprising the expiry date, so as to allow a client to modify a way that a user is prompted for credentials,

ascertain whether the password has expired, and

receive a new password, if the password has expired.

10. A server according to claim 9, wherein the transmitted response further comprises a date representing the last use of the password.

11. A server according to claim 9, wherein the transmitted response further comprises an integer value representing a retry parameter.

12. A server according to claim 11, and further arranged to receive a request comprising a new password, ascertain that the new password is unacceptable, and transmit a response including the integer value representing the retry parameter, the integer value being unchanged.

13. A server according to claim 11, and further arranged to receive a request comprising the old password, and transmit a response including the integer value representing the retry parameter, the integer value being decremented by 1.

14. A server according to claim 9, wherein the server is arranged, when transmitting a response comprising the expiry date, to transmit a message including a header, the header comprising the expiry date.

15. A server according to claim 14, wherein the server is operated according to a request and reply transfer protocol, and wherein the transmitted response is a reply according to the protocol.

16. A server according to claim 15, wherein the transmitted response, being a reply according to the protocol, is transmitted by the server every time an authorisation request is received.

17. A computer program product on a computer readable medium for operating a server, the product comprising instructions for:

receiving an authorisation request comprising a password,

accessing an expiry date for the password,

transmitting a response comprising the expiry date, so as to allow a client to modify a way that a user is prompted for credentials,

ascertaining whether the password has expired, and

receiving a new password, if the password has expired.

18. A computer program product according to claim 17, wherein the transmitted response further comprises a date representing the last use of the password.

19. A computer program product according to claim 17, wherein the transmitted response further comprises an integer value representing a retry parameter.

20. A computer program product according to claim 19, and further comprising instructions for receiving a request comprising a new password, ascertaining that the new password is unacceptable, and transmitting a response including the integer value representing the retry parameter, the integer value being unchanged.

21. A computer program product according to claim 19, and further comprising instructions for receiving a request comprising the old password, and transmitting a response including the integer value representing the retry parameter, the integer value being decremented by 1.

22. A computer program product according to claim 17, wherein the instructions for transmitting a response comprising the expiry date comprise instructions for transmitting a message including a header, the header comprising the expiry date.