Configurable password integrity servers for use in a shared resource environment

• US 5,838,903 A
• Filed: 11/13/1995
• Issued: 11/17/1998
• Est. Priority Date: 11/13/1995
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Blakely, III, George Robert, Milman, Ivan Matthew, Sigler, Wayne Dube
• Primary Examiner(s): Lall, Parshotam S.
• Assistant Examiner(s): Maung, Zarni
• Application Number:
  US08/556,724
• Time in Patent Office: 1,100 Days
• Field of Search: 380/23, 380/20, 380/48, 395/200.1, 395/200.6, 395/200.5, 395/200.01, 395/186, 395/188.01, 395/187.01
• US Class Current: 726/5
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords

Abstract

A network system server that provides password composition checking for a plurality of clients is disclosed. The network system server includes a main data store, a security server, which is coupled to the main data store and the plurality of clients, a password synchronization server, which is coupled to the security server, a plurality of password strength servers, each of which is coupled to the password synchronization server, that provides password integrity among the plurality of clients so that each client maintains a password whose composition is consistent with the network server system. Each of the password strength servers is uniquely programmable with respect to performing password composition checking.

Claims

1. A method of managing passwords in a network including a plurality of clients, a main data store, and a remote registry, said method comprising:

maintaining password synchronization between passwords stored in said main data store and passwords stored within said remote registry; and

checking password integrity among said plurality of clients utilizing a password strength server so that each client maintains a password having a composition consistent with a format specified by a network server of said network.

2. The method of claim 1, and further comprising:

providing an information account for each of said plurality of clients that includes a user'"'"'s password.

3. The method of claim 2, and further comprising:

propagating a clear-text password to each of said plurality of secondary data stores.

4. The method of claim 3, and further comprising:

encrypting said clear-text password; and

storing said encrypted clear-text password in said information account.

5. The method of claim 1, and further comprising:

binding each of said plurality of password strength servers with at least one of said plurality of clients.

6. The method of claim 1, and wherein said password checking step further comprises:

modifying a set of password composition rules utilized by said set of clients to perform password composition checking.

7. A computer program product that provides password composition checking for a plurality of clients in a network having a main data store and a remote registry, said computer program product comprising:

computer usable code means for selecting a password by a user associated with a particular client among said plurality of clients;

a security server coupled to said main data store and said plurality of clients;

a password synchronization server that maintains password synchronization between a copy of said password stored in said main data store and a copy of said password stored in said remote registry; and

a password strength server associated with said particular client that checks the integrity of said selected password so that said particular client maintains a password having a composition consistent with a format specified by a network server of said network.

8. The computer program product of claim 7, and further comprising:

computer usable code means for providing an information account for each of said plurality of clients, said information account including a user'"'"'s password.

9. The computer program product of claim 8, and further comprising:

computer usable code means for routing a clear-text password to said password strength server.

10. The computer program product of claim 9, and further comprising:

computer usable code means for encrypting said clear-text password for storage in said information account.

11. The computer program product of claim 7, and further comprising:

computer usable code means for binding said password strength server with at least one of said plurality of clients.

12. The computer program product of claim 7, wherein said password strength server is one of a plurality of password strength servers, each of said plurality of password strength servers being associated with a respective one of said plurality of clients and being uniquely programmable with respect to performing password composition checking.

13. A network server that provides password composition checking for a plurality of clients in a network having a main data store and a remote registry, said network server comprising:

a security server coupled to said main data store and said plurality of clients;

a password synchronization server coupled to said security server that maintains password synchronization between passwords stored in said main data store and passwords stored within said remote registry; and

a plurality of password strength servers coupled to said password synchronization server, wherein said plurality of password strength servers ensure that each of said plurality of clients maintains a password having a composition consistent with a format specified by said network server.

14. The network server of claim 13, and further comprising said main data store, wherein said main data store includes an information account for each of said plurality of clients that includes a user'"'"'s password.

15. The network server of claim 14, wherein said security server provides a clear-text password to said password synchronization server for subsequent routing to at least one of said plurality of password strength servers.

16. The network server of claim 15, wherein said security server includes means for encrypting said clear-text password for storage in said information account.

17. The network server of claim 13, and further comprising said main data store, wherein said main data store includes an information account for each of said plurality of password strength servers that binds each of said plurality of password strength servers with at least one of said plurality of clients.

18. The network server of claim 13, wherein each of said password strength servers is uniquely programmable with respect to performing password composition checking.