PRIVILEGED SHARED ACCOUNT PASSWORD SANITATION

• US 20150248544A1
• Filed: 03/03/2014
• Published: 09/03/2015
• Est. Priority Date: 03/03/2014
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Fadida, Itzhak, Balzam, Guy, Jerbi, Amir, Barak, Nir
• Granted Patent: US 9,367,673 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Sanitizing passwords used in a shared, privileged account includes providing a password of a shared account to a user; identifying a first machine logged into using the password; determining when the first machine enters an inconsistent state; and modifying a memory area associated with the first machine to eliminate occurrences of the password in the memory area.

Claims

1. A computer-implemented method for sanitizing passwords, comprising:

providing, by a computer, a password of a shared account to a user;

identifying, by the computer, a first machine logged into using the password;

determining, by the computer, when the first machine enters an inconsistent state; and

modifying, by the computer, a memory area associated with the first machine to eliminate occurrences of the password in the memory area.

2. The method of claim 1, comprising:

receiving, by the computer, a request from the user for the password.

3. The method of claim 2, comprising:

determining, by the computer, that the request originated from a second machine.

4. The method of claim 3, comprising:

determining, by the computer, when the second machine enters an inconsistent state; and

modifying, by the computer, a memory area associated with the second machine to eliminate occurrences of the password in the memory area associated with the second machine.

5. The method of claim 1, wherein the machine is one of a virtual machine and a physical machine.

6. The method of claim 1, wherein the inconsistent state is a virtual machine snapshot of the first machine.

7. The method of claim 1, wherein the inconsistent state is an operating system crash.

8. The method of claim 1, wherein the inconsistent state is an application crash.

9. The method of claim 1, wherein the inconsistent state is a suspended-activity state.

10. The method of claim 1, comprising:

determining, by the computer, when the first machine enters an active state; and

modifying, by the computer, the memory area associated with the first machine to replace occurrences of the password in the memory area that had been previously eliminated.

11. A system for sanitizing passwords, comprising:

a computer processor;

a memory in communication with the computer processor storing instructions that when executed by the computer processor implement;

a communications module providing a password of a shared account to a user;

an access control module identifying a first machine logged into using the password;

a password sanitation module determining when the first machine enters an inconsistent state; and

the password sanitation module modifying a memory area associated with the first machine to eliminate occurrences of the password in the memory area.

12. The method of claim 11, comprising:

a receiving module receiving a request from the user for the password.

13. The system of claim 12, wherein the access control module determines that the request originated from a second machine.

14. The system of claim 13, wherein the password sanitation module:

determines when the second machine enters an inconsistent state; and

modifies a memory area associated with the second machine to eliminate occurrences of the password in the memory area associated with the second machine.

15. The system of claim 11, wherein the machine is one of a virtual machine and a physical machine.

16. The system of claim 11, wherein the inconsistent state is a virtual machine snapshot of the first machine.

17. The system of claim 11, wherein the inconsistent state is an operating system crash.

18. The system of claim 11, wherein the inconsistent state is an application crash.

19. The system of claim 11, wherein the inconsistent state is a suspended-activity state.

20. The system of claim 11, wherein the password sanitation module:

determines when the first machine enters an active state; and

modifies the memory area associated with the first machine to replace occurrences of the password in the memory area that had been previously eliminated.

21. A computer program product for sanitizing passwords, comprising:

a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising;

computer readable program code for providing a password of a shared account to a user;

computer readable program code for identifying a first machine logged into using the password;

computer readable program code for determining when the first machine enters an inconsistent state; and

computer readable program code for modifying a memory area associated with the first machine to eliminate occurrences of the password in the memory area.

22. The computer program product of claim 21, comprising:

computer readable program code for receiving a request from the user for the password.

23. The computer program product of claim 22, comprising:

computer readable program code for determining that the request originated from a second machine.

24. The computer program product of claim 23, comprising:

computer readable program code for determining when the second machine enters an inconsistent state; and

computer readable program code for modifying a memory area associated with the second machine to eliminate occurrences of the password in the memory area associated with the second machine.

25. The computer program product of claim 21, wherein the machine is one of a virtual machine and a physical machine.

26. The computer program product of claim 21, wherein the inconsistent state is a virtual machine snapshot of the first machine.

27. The computer program product of claim 21, wherein the inconsistent state is an operating system crash.

28. The computer program product of claim 21, wherein the inconsistent state is an application crash.

29. The computer program product of claim 21, wherein the inconsistent state is a suspended-activity state.

30. The computer program product of claim 21, comprising:

computer readable program code for determining when the first machine enters an active state; and

computer readable program code for modifying the memory area associated with the first machine to replace occurrences of the password in the memory area that had been previously eliminated.