Systems and methods of securing resources through passwords

• US 7,992,008 B2
• Filed: 02/20/2008
• Issued: 08/02/2011
• Est. Priority Date: 08/19/2004
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Nahar, Rahul, Dunki-Jacobs, Raymond P., Ashok, Guru S., Tandel, Shreesh S., Shah, Ashit M., Venkatachalam, Muthuswamy, Milne, Robert J.
• Primary Examiner(s): Lanier; Benjamin E
• Application Number:
  US12/033,937
• Publication Number:
  US 20080282091A1
• Time in Patent Office: 1,259 Days
• Field of Search: None
• US Class Current: 713/183
• CPC Class Codes: G06F 21/31 User authentication

Abstract

Disclosed is a method of authorizing access to an item that maintains a lockout count and blocks access to the item if the lockout count exceeds a predetermined value. One feature is that the invention “variably” increments the lockout count if the presented password fails to exactly match the stored password. In this process the invention increments the lockout count different amounts depending upon how closely the presented password matches the stored password. The invention also provides a methodology that allocates a plurality of the same passwords to a plurality of users who share the same userid. The invention allows continuous operation of the item being accessed by providing that each of the passwords has a different expiration date. Also, when dealing with situations where a plurality of users who share the same userid also share the same password, the invention maps information associated with the users to the password in a data file and periodically updates the data file.

Claims

1. A method of authorizing access to an item, said method comprising:

allocating at a first time a plurality of passwords to a user, wherein each of said passwords has a different expiration date;

allowing access to said item when said user supplies any one of said passwords before the password supplied has expired;

allocating additional passwords to said user; and

requiring that an expiration date for said additional passwords be different than expiration dates for any other passwords,

wherein if, during said process of allowing access, said user enters an expired password prior to entering an unexpired password, said method further comprises notifying said user that said expired password has expired, after said user has entered said unexpired password.

2. The method in claim 1, further comprising notifying said user when each password expires.

3. The method in claim 1, further comprising resetting said expiration dates such that said expirations dates are evenly spaced in time.

4. The method in claim 1, wherein said allocating is done at the request of at least one of said user, said item, and a third party.

5. The method in claim 1, wherein during said allocating process, said passwords are selected by at least one of said user, said item, and a third party.

6. A method of authorizing access to an item, said method comprising:

allocating at a first time a plurality of the same passwords to a plurality of users who share the same userid, wherein each of said passwords has a different expiration date;

allowing access to said item when any of said users supplies any of said passwords before the password supplied has expired;

allocating additional passwords to said users; and

requiring that an expiration date for said additional passwords be different than expiration dates for any other passwords,

wherein if, during said process of allowing access, one user of said users enters an expired password prior to entering an unexpired password, said method further comprises notifying said user that said expired password has expired after said user has entered said unexpired password.

7. The method in claim 6, further comprising notifying all of said users when each password expires.

8. The method in claim 6, further comprising resetting said expiration dates such that said expirations dates are evenly spaced in time.

9. The method in claim 6, wherein said allocating is done at the request of at least one of:

one of said users;

said item; and

a third party.

10. The method in claim 6, wherein during said allocating process, said passwords are selected by at least one of:

one of said users;

said item; and

a third party.

11. A method of authorizing access to an item, said method comprising:

allocating at a first time a same password to a plurality of users who share a same userid, wherein said password has a different expiration date for each of said plurality of users;

allowing access to said item when any of said users supply said password before said password has expired;

mapping information associated with said users to said password in a data file;

periodically updating said data file;

allocating additional passwords to said users; and

requiring that an expiration date for said additional passwords be different than expiration dates for any other passwords,

wherein if, during said process of allowing access, any of said users enters an expired password prior to entering an unexpired password, said method further comprises notifying said user that said expired password has expired, after said user has entered said unexpired password.

12. The method in claim 11, further comprising notifying said users of expiration of said password a predetermined period before said password expires.

13. The method in claim 11, further comprising periodically contacting said users to confirm accuracy of said information within said data file.

14. The method in claim 11, wherein said information associated with said users identifies third parties responsible for said users, and

wherein said method further comprises notifying at least one corresponding third party if said user is denied access to said item because of an invalid password.

15. The method in claim 11, wherein said users comprise individuals, applications, and application owners.

16. The method in claim 11, further comprising updating said data file as said password is changed by said users in said userid.

17. The method in claim 11, further comprising checking for inconsistencies between a password being maintained by a user and a password within said data file;

and correcting one of user data and said data file when said inconsistencies are found.