Method for changing a security policy during processing of a transaction request

• US 6,341,352 B1
• Filed: 10/15/1998
• Issued: 01/22/2002
• Est. Priority Date: 10/15/1998
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Child, Garry L., Shrader, Theodore Jack London, Soper, Davis Kent
• Primary Examiner(s): Hayes, Gail
• Assistant Examiner(s): JACKSON, JENISE E
• Application Number:
  US09/173,041
• Time in Patent Office: 1,195 Days
• Field of Search: 713/201, 713/166, 713/183, 713/202, 713/165, 713/200, 713/2, 709/229, 709/223, 709/224, 709/225, 709/226, 705/26, 705/72, 705/76, 705/67, 705/64, 705/75, 705/70
• US Class Current: 726/1
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 20/3678 e-cash details, e.g. blinded, divisible or detecting double spending
• CPC Class Codes: G06Q 20/3821 Electronic credentials

Abstract

A method for changing a user password is preferably operative as a Web server impersonates a Web client to obtain access to files stored in a distributed file system space of a distributed computing environment. The method begins in response to receipt of a Web transaction request from the Web client to determine whether the user'"'"'s password has expired. If so, the method suspends processing of the Web transaction request and then enters a password change subprogram to enable the user to define a new password. Typically, the password change subprogram displays a password change dialog that interacts with the user. Upon definition of the new password by the user, the mechanism resumes processing of the original Web transaction request. Alternatively, the user may be prompted to terminate the original transaction request and select a new URL and/or document.

Claims

1. A method for changing a security policy for an application, the method comprising the steps of:

intercepting a user credential from a client sent to the application;

determining that a revised security policy for the application exists, wherein the revised security policy represents a security policy that was revised after the user credential was issued;

entering a security subprogram that interacts with a user, the security subprogram being independent of the application; and

upon satisfactory conclusion of the security interaction, invoking the application.

2. The method as described in claim 1 wherein the revised security policy is imposed without any change in the application.

3. The method as described in claim 1 wherein the application has no security policy.

4. The method as described in claim 1 wherein the intercepting step is performed by a server.

5. The method as described in claim 4 wherein the server is a Web server and the security subprogram is at a different URL than the application.

6. The method as described in claim 5 wherein the method further includes the steps of:

redirecting the user credential to the security subprogram URL when directed by the security policy; and

handling any needed interactions with the application by the security subprogram.

7. A method for changing a user password as a Web server accesses files stored in a distributed file system of a distributed computing environment, the method comprising the steps of:

responsive to receipt of a Web transaction request from a Web client, determining whether a credential for accessing files stored in the distributed file system has been associated with a user of the Web client during processing of a previous Web transaction request;

in response to a determination that a credential has been previously associated with the user, determining whether the user'"'"'s password has expired;

if the user'"'"'s password has expired, suspending processing of the Web transaction request and entering a password change subprogram to enable the user to define a new password; and

upon definition of the new password, resuming the processing of the Web transaction request.

8. The method as described in claim 7 wherein the step of suspending processing of the Web transaction request includes;

saving a user-requested Uniform Resource Locator (URL) in the Web transaction request; and

redirecting the user to a URL associated with the password change subprogram.

9. The method as described in claim 8 wherein the step of resuming the processing of the Web transaction request includes the step of restoring the user-requested URL back into the Web transaction request.

10. The method as described in claim 7 wherein the step of resuming the processing of the Web transaction request occurs automatically upon definition of the new password.

11. The method as described in claim 7 wherein the step of resuming the processing of the Web transaction requests occurs upon definition of the new password and completion of a given user action.

12. The method as described in claim 11 wherein the given user action is selection of a display button.

13. The method as described in claim 7 wherein the password change subprogram displays a change password dialog to the user.

14. The method as described in claim 7 wherein the distributed computing environment includes a security service for returning a credential to a user authenticated to access the distributed file system.

15. A method for changing a security policy as a server accesses files stored in a distributed file system of a distributed computing environment, the method comprising the steps of:

responsive to receipt of a transaction request from a client, determining whether a credential for accessing files stored in the distributed file system has been associated with a user of the client during processing of a previous transaction request;

in response to a determination that a credential has been previously associated with the user, determining whether a revised security policy exists;

if the revised security policy exists, suspending processing of the transaction request;

displaying a change security policy dialog to the user to enable the user to conform to the revised security policy; and

upon satisfactory conformance to the revised security policy, resuming the processing of the Web transaction request.

16. The method as described in claim 15 wherein the step of suspending processing of the transaction request includes;

saving a user-requested Uniform Resource Locator (URL) in the transaction request; and

redirecting the user to a URL associated with a change security policy subprogram.

17. The method as described in claim 16 wherein the step of resuming the processing of the transaction request includes the step of restoring the user-requested URL back into the transaction request.

18. The method as described in claim 15 wherein the step of resuming the processing of the transaction request occurs automatically upon satisfactory conformance to the revised security policy.

19. The method as described in claim 15 wherein the server is a Web server, the client is a Web client having a browser, and the transaction request is a Web transaction.

20. A computer program product in a computer-readable medium method for use in changing a user password as a Web server accesses files stored in a distributed file system of a distributed computing environment, the computer program product comprising:

means responsive to receipt of a Web transaction request from a Web client for determining whether a credential for accessing files stored in the distributed file system has been associated with a user of the Web client during processing of a previous Web transaction request;

means responsive to a determination that a credential has been previously associated with the user for determining whether the user'"'"'s password has expired;

means for suspending processing of the Web transaction request if the user'"'"'s password has expired;

means for transferring control to a password change subprogram to enable the user to define a new password; and

means responsive to definition of the new password for resuming the processing of the Web transaction request.

21. The computer program product as described in claim 20 wherein the means for suspending processing of the Web transaction request includes means for saving a user-requested Uniform Resource Locator (URL) in the Web transaction request.

22. The computer program product as described in claim 20 wherein the means for transferring control includes means for redirecting the user to a URL associated with the password change subprogram.

23. The computer program product as described in claim 22 wherein the means for resuming the processing of the Web transaction request includes means for restoring the user-requested URL back into the Web transaction request.

24. In a computer network in which a client is connectable to a server to enable access to documents within a secure database, the improvement comprising:

means responsive to receipt of a transaction request from the client for determining whether a credential for accessing the documents within the secure database has been associated with a user of the client during processing of a previous transaction request;

means responsive to a determination that a credential has been previously associated with the user for determining whether the user'"'"'s password has expired;

means for suspending processing of the transaction request if the user'"'"'s password has expired;

means for transferring control to a password change subprogram to enable the user to define a new password; and

means responsive to definition of the new password for resuming the processing of the transaction request.

25. In the computer network as described in claim 24 wherein the means for suspending processing of the transaction request includes means for saving a user-requested Uniform Resource Locator (URL) in the transaction request.

26. In the computer network described in claim 24 wherein the means for transferring control includes means for redirecting the user to a URL associated with the password change subprogram.

27. In the computer network as described in claim 26 wherein the means for resuming the processing of the Web transaction request includes means for restoring the user-requested URL back into the transaction request.

28. In the computer network as described in claim 24 wherein the client includes a Web browser.

29. A computer connectable to a secure database, comprising:

a processor;

an operating system;

a Web server program for processing client requests; and

means for changing a security policy, comprising;

means responsive to receipt of a transaction request from a client for determining whether a credential for accessing information in the secure database has been associated with a user of the client during processing of a previous transaction request;

means responsive to a determination that a credential has been previously associated with the user for determining whether the user'"'"'s password has expired;

means for suspending processing of the transaction request if the user'"'"'s password has expired;

means for transferring control to a password change subprogram to enable the user to define a new password; and

means responsive to definition of the new password for resuming the processing of the transaction request.