System and method for utilizing audit information for challenge/response during a password reset process

• US 7,861,287 B2
• Filed: 05/17/2006
• Issued: 12/28/2010
• Est. Priority Date: 05/17/2006
• Status: Expired due to Fees

• Current Assignee: LinkedIn Corporation (Microsoft Corporation)
• Original Assignee: International Business Machines Corporation
• Inventors: Pomerantz, Ori
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US11/435,524
• Publication Number:
  US 20070271601A1
• Time in Patent Office: 1,686 Days
• Field of Search: None
• US Class Current: 726/6
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords

Abstract

A system, method, and computer usable medium for utilizing audit information for challenge/response during a password reset process. In a preferred embodiment of the present invention, a client tracker compiles a log of user actions while a user accesses an account on a data processing system. In response to a user password reset request, the client tracker selects at least one user action from the log of user actions, forms a challenge question based on the selected user action, and in response to an acceptable response to the challenge question, resetting a password associated with the account.

Claims

1. A computer-implementable method for resetting a user password, said method comprising:

in response to a password reset request from a user,

selecting an user action from a session log configured to record a plurality of user actions when said user was previously signed on to an account stored on a server;

generating for said user a challenge question based on said selected user action; and

pending from said user an acceptable response to said challenge question; and

in response to an acceptable response to said challenge question from said user, resetting a password associated with said account.

2. The method of claim 1, wherein said method further includes

in response to an unacceptable response to said challenge question, sending an error message to said user.

3. The method of claim 1, wherein said method further includes

in response to an unacceptable response to said challenge question, notifying a system administrator of said server.

4. The method of claim 1, wherein said user action is depositing money on a banking account.

5. The method of claim 1, wherein said user action is paying bills online.