PASSCODE BASED ACCESS-CONTROL WITH RANDOMIZED LIMITS

• US 20190068633A1
• Filed: 08/24/2017
• Published: 02/28/2019
• Est. Priority Date: 08/24/2017
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Tsirkin, Michael
• Granted Patent: US 10,924,505 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Systems and methods for enhancing the security of an account by reducing the ability of an attacker to determine that an account includes multiple passcodes for accessing the account. An example method may comprise: accessing an account that comprises a first passcode providing constrained access to a set of computing resources and a second passcode providing unconstrained access to the set of computing resources; associating the account with a randomized resource limit that restricts a quantity of passcodes associated with the account; receiving a request to create a third passcode for the account; and denying the creation of the third passcode for the account in view of the randomized resource limit.

Claims

1. A method comprising:

accessing an account that comprises a first passcode providing constrained access to a set of computing resources and a second passcode providing unconstrained access to the set of computing resources;

associating the account with a randomized resource limit that restricts a quantity of passcodes associated with the account;

receiving a request to create a third passcode for the account; and

denying the creation of the third passcode for the account in view of the randomized resource limit.

2. The method of claim 1, further comprising, establishing a first connection and a second connection in view of the account, wherein the first connection is in view of the first passcode and is associated with constrained access to the set of computing resources and wherein the second connection is in view of the second passcode and is associated with unconstrained access to the set of computing resources.

3. The method of claim 2, wherein the first connection and the second connection each comprise a login session for at least one of a web service, an operating system, or an application.

4. The method of claim 2, wherein the set of computing resources comprises a computing resource that is hidden from the first connection associated with the constrained access and is accessible to the second connection associated with the unconstrained access.

5. The method of claim 1, wherein the first passcode providing the constrained access and the second passcode providing the unconstrained access enable a respective computing thread to request a creation of an additional passcode.

6. The method of claim 1, further comprising:

receiving, from a computing thread, a request to establish a connection using the first passcode providing the constrained access, wherein the computing thread comprises malicious code; and

establishing a connection for the computing thread, wherein the computing thread is unable to detect that access to the set of computing resources is constrained and is unable to detect an existence of another passcode for the account.

7. The method of claim 1, wherein the randomized resource limit comprises a first limit that restricts a first computing resource comprising the quantity of passcodes associated with the account, wherein the first limit comprises a randomly generated value.

8. The method of claim 7, wherein the randomized resource limit further comprises a second limit that restricts a quantity of a second computing resource associated with the first passcode, wherein the second computing resource comprises one or more of a storage space, a processing power, or a network bandwidth, wherein the second limit comprises a randomly generated value.

9. The method of claim 1, further comprising:

receiving, from a computing thread, a request to create a passcode for the account; and

denying the request to create the passcode in view of the randomized resource limit, wherein the computing thread is unable to determine a value for the randomized resource limit.

10. A system comprising:

a memory;

a processing device operatively coupled to the memory, the processing device to;

access an account that comprises a first passcode providing constrained access to a set of computing resources and a second passcode providing unconstrained access to the set of computing resources;

associate the account with a randomized resource limit that restricts a quantity of passcodes associated with the account;

receive a request to create a third passcode for the account; and

deny the creation of the third passcode for the account in view of the randomized resource limit.

11. The system of claim 10, further comprising the processing device to establish a first connection and a second connection in view of the account, wherein the first connection is in view of the first passcode and is associated with constrained access to the set of computing resources and wherein the second connection is in view of the second passcode and is associated with unconstrained access to the set of computing resources.

12. The system of claim 11, wherein the first connection and the second connection each comprise a login session for at least one of a web service, an operating system, or an application.

13. The system of claim 11, wherein the set of computing resources comprises a computing resource that is hidden from the first connection associated with the constrained access and is accessible to the second connection associated with the unconstrained access.

14. The system of claim 10, wherein the first passcode providing the constrained access and the second passcode comprising the unconstrained access enable a respective computing thread to request a creation of an additional passcode.

15. A non-transitory machine-readable storage medium storing instructions that cause a processing device to:

generate a plurality of passcodes to access an account, the plurality of passcodes comprising a first passcode that provides constrained access to a set of computing resources and a second passcode that provides unconstrained access to the set of computing resources;

establish a connection for a computing thread in view of the account and the first passcode, wherein the computing thread is unable to detect an existence of the second passcode of the account;

associate the account with a randomized resource limit that restricts a quantity of passcodes associated with the account;

receive, over the connection, a request to create a third passcode for the account; and

deny the creation of the third passcode in view of the randomized resource limit, wherein the randomized resource limit is inaccessible to the computing thread.

16. The non-transitory machine-readable storage medium of claim 15, wherein the connection comprises a login session for at least one of a web service, an operating system, or an application.

17. The non-transitory machine-readable storage medium of claim 15, wherein the set of computing resources comprises a computing resource that is hidden from a computing thread using a connection comprising the constrained access and is accessible to a computing thread using a connection comprising unconstrained access.

18. The non-transitory machine-readable storage medium of claim 15, wherein the first passcode providing the constrained access and the second passcode providing the constrained access permit a respective computing thread to request a creation of an additional passcode.

19. The non-transitory machine-readable storage medium of claim 15, wherein the randomized resource limit comprises a first limit that restricts a first computing resource comprising the quantity of passcodes associated with the account.

20. The non-transitory machine-readable storage medium of claim 15, wherein the randomized resource limit further comprises a second limit that restricts a quantity of a second computing resource associated with the connection, wherein the second computing resource comprises one or more of a storage space, a processing power, or a network bandwidth, wherein the second limit comprises a randomly generated value.