Computer-implemented method, system, and program product for managing log-in strikes

• US 7,793,335 B2
• Filed: 09/12/2005
• Issued: 09/07/2010
• Est. Priority Date: 09/12/2005
• Status: Expired due to Fees

• Current Assignee: LinkedIn Corporation (Microsoft Corporation)
• Original Assignee: International Business Machines Corporation
• Inventors: Weingarten, Richard E., Poole, Howard E., Hsiao, Kan Y., Bali, Bahri B., Barnabo, Christopher E., Greenlee, Gordan G.
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): LEWIS, LISA C
• Application Number:
  US11/224,373
• Publication Number:
  US 20070061864A1
• Time in Patent Office: 1,821 Days
• Field of Search: 726/2, 726/21, 380/277
• US Class Current: 726/2
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

The present invention provides a computer-implemented method, system, and program product for managing log-in strikes in a geographically distributed computer infrastructure. Specifically, under the present invention, when a strike message is received on a strikeout server pursuant to an incorrect password input during an attempted log-in of a user, the incorrect password is compared to a strike list to determine if it was previously received on the strikeout server during a predetermined period of time. Based on this determination, the incorrect password and will be stored in a list on the strikeout server with a corresponding timestamp. Thereafter, the strike message and the timestamp will be replicated to all other strikeout servers in the infrastructure.

Claims

1. A computer-implemented method for managing log-in strikes, comprising:

receiving a strike message on a strikeout server from an authentication server pursuant to an incorrect password input during an attempted log-in of a user;

comparing the incorrect password to a list to determine if the incorrect password was previously received on the strikeout server during a predetermined period of time;

storing the incorrect password in the list on the strikeout server with a corresponding timestamp; and

replicating the strike message and the timestamp to at least one other strikeout server to be stored on the at least one other strikeout server, the at least one other strikeout server being a geographically remote server that provides the receiving, comparing and storing for a different authentication server in a geographically distributed computer environment.

2. The method of claim 1, further comprising storing the incorrect password and the timestamp in a list on each of the at least one other strikeout server.

3. The method of claim 1, wherein the strike message comprises a distinguished name, an IP address and the incorrect password.

4. The method of claim 3, wherein the IP address is an IP address corresponding to a computer location of the attempted log-in.

5. The method of claim 1, wherein the storing step comprises:

creating a new entry in the list if the incorrect password was not previously received on the strikeout server; and

storing the incorrect password with the timestamp in the new entry.

6. The method of claim 1, wherein if the incorrect password was previously received on the strikeout server, the storing step comprises replacing a previous timestamp corresponding to the incorrect password as previously received with the corresponding timestamp received with the strike message.

7. The method of claim 1, wherein the strikeout strike message is received on the strikeout server from a LDAP server.

8. The method of claim 1, wherein the strikeout server is a master strikeout server in a group of strikeout servers that includes the at least one other strikeout server, and wherein the method further comprises receiving a strikeout message on the master strikeout server when a predetermined quantity of uniquely incorrect passwords are accumulated for the user during a predetermined period of time.

9. The method of claim 8, wherein the master strikeout server clears the list after receiving the strikeout message, and wherein the strikeout message is replicated to the group of strikeout servers.

10. A system for managing log-in strikes, comprising:

a message reception system for receiving a strike message on a strikeout server from an authentication server pursuant to an incorrect password input during an attempted log-in of a user;

a list comparison system for comparing the incorrect password to a list maintained on the strikeout server to determine if the incorrect password was previously received in another strike message during a predetermined period of time;

a list storage system for storing the incorrect password in the list with a corresponding timestamp; and

a message replication system for replicating the strike message and the corresponding timestamp to at least one other strikeout server to be stored on the at least one other strikeout server, the at least one other strikeout server being a geographically remote server that provides the receiving, comparing and storing for a different authentication server in a geographically distributed computer environment.

11. The system of claim 10, wherein the list storage system will store the incorrect password with the corresponding timestamp in a new entry in the list if the incorrect password was not previously received during the predetermined period of time, and wherein the list storage system will replace a previous timestamp for the incorrect password in the list with the corresponding timestamp if the incorrect password was previously received during the predetermined period of time.

12. The system of claim 10, wherein the strike message comprises a distinguished name, an IP address and the incorrect password.

13. The system of claim 12, wherein the IP address is an IP address corresponding to a computer location of the failed log-in attempt.

14. The system of claim 10, wherein the strikeout strike message is received on the strikeout server from a LDAP server.

15. The system of claim 10, wherein the strikeout server is a master strikeout server in a group of strikeout servers that includes the at least one other strikeout server, wherein the master strikeout server clears the list after receiving a strikeout message, and wherein the strikeout message is replicated to the group of strikeout servers.

16. A program product stored on a non-transitory computer readable storage medium for managing log-in strikes, the program product comprising program code for causing a computer system to perform the following steps:

receiving a strike message on a strikeout server from an authentication server pursuant to an incorrect password input during an attempted log-in of a user;

comparing the incorrect password to a list maintained on the strikeout server to determine if the incorrect password was previously received in another strike message during a predetermined period of time;

storing the incorrect password in the list with a corresponding timestamp; and

replicating the strike message and the corresponding timestamp to at least one other strikeout server to be stored on the at least one other strikeout server, the at least one other strikeout server being a geographically remote server that provides the receiving, comparing and storing for a different authentication server in a geographically distributed computer environment.

17. The program product of claim 16, wherein the storing step comprises storing the incorrect password with the corresponding timestamp in a new entry in the list if the incorrect password was not previously received during the predetermined period of time, and wherein the storing step comprises replacing a previous timestamp for the incorrect password in the list with the corresponding timestamp if the incorrect password was previously received during the predetermined period of time.

18. The program product of claim 16, wherein the strike message comprises a distinguished name, an IP address and the incorrect password.

19. The program product of claim 18, wherein the IP address is an IP address corresponding to a computer location of the failed log-in attempt.

20. The program product of claim 16, wherein the strike message is received on the strikeout server from a LDAP server.

21. The program product of claim 16, wherein the strikeout server is a master strikeout server in a group of strikeout servers that includes the at least one other strike-out server, wherein the master strikeout server clears the list after receiving a strikeout message, and wherein the strikeout message is replicated to the group of strikeout servers.

22. A method for deploying an application for managing log-in strikes, comprising:

providing a computer infrastructure being operable to;

receive a strike message on a strikeout server from an authentication server pursuant to an incorrect password input during an attempted log-in of a user;

compare the incorrect password to a list maintained on the strikeout server to determine if the incorrect password was previously received in another strike message during a predetermined period of time;

store the strike message in the list with a corresponding timestamp; and

replicate the strike message and the corresponding timestamp to at least one other strikeout server to be stored on the at least one other strikeout server, the at least one other strikeout server being a geographically remote server that provides the receiving, comparing and storing for a different authentication server in a geographically distributed computer environment.