Computer access security

• US 8,171,530 B2
• Filed: 06/28/2010
• Issued: 05/01/2012
• Est. Priority Date: 04/05/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Goldberg, Itzhack
• Primary Examiner(s): Dinh, Minh
• Assistant Examiner(s): Okeke, Izunna
• Application Number:
  US12/824,256
• Publication Number:
  US 20100269163A1
• Time in Patent Office: 673 Days
• Field of Search: 726/17, 726/4, 726/1, 726/3, 726/5, 726/6, 726/7, 726/18, 726/19, 713/183, 713/185, 713/161, 713/168, 713/152, 713/165
• US Class Current: 726/4
• CPC Class Codes: G06F 21/31 User authentication

Abstract

A method is provided for improved computer access security, the method including protecting an access record to prevent password access to a computer via the access record, creating an alternate access record corresponding to the protected record, enabling password access to the computer via the alternate record, providing the alternate record with the access level of the protected record, and configuring the alternate record to indicate a supplemental security program to be executed once a correct password for the alternate record is provided.

Claims

1. A system for improved computer access security, the system comprising:

a computer configured to

modify an access record, having a password embedded therein, by removing said password from said access record, thereby preventing said access record from which said password was removed from being used to allow access to said computer, wherein said access record is stored within a file, and wherein said modifying is performed upon said access record within said file,

create within said file an alternate access record corresponding to said access record, wherein said alternate record is separate from said access record,

enable password access to said computer via said alternate record,

embed within said alternate record an indicator indicating an access level embedded within said access record, and

embed within said alternate record the name of a supplemental security program to be executed once a correct password for said alternate record is provided.

2. A system according to claim 1 wherein said supplemental security program is operative to execute a shell program indicated by said modified record subsequent to said supplemental security program allowing access to said computer.

3. A system according to claim 1 wherein said access record is a root directory access record.

4. A system according to claim 1 wherein said computer is operative to modify said access record in a /etc/passwd file.

5. A system according to claim 4 wherein said computer is operative to replace said password of said access record with an entry indicating that password access is not allowed for said access record.

6. A system according to claim 4 wherein said computer is operative to create said alternate record in said /etc/passwd file.

7. A system according to claim 3 wherein said computer is operative to embed within said alternate record said indicator indicating said access level comprises assigning said alternate record with a UID=0.

8. A system according to claim 1 wherein said supplemental security program is operative to execute a one-time-password protocol.

9. A system according to claim 1 and further comprising a data storage device that is accessible to said computer, wherein said access record is stored on said data storage device.

10. A computer program product for improved computer access security, the computer program product comprising:

a non-transitory, computer-readable storage medium; and

computer-readable program code embodied in the non-transitory, computer-readable storage medium, where the computer-readable program code is configured to

modify an access record, having a password embedded therein, by removing said password from said access record, thereby preventing said access record from which said password was removed from being used to allow access to a computer, wherein said access record is stored within a file, and wherein said modifying is performed upon said access record within said file,

create within said file an alternate access record corresponding to said access record, wherein said alternate record is separate from said access record,

enable password access to said computer via said alternate record,

embed within said alternate record an indicator indicating an access level embedded within said access record, and

embed within said alternate record the name of a supplemental security program to be executed once a correct password for said alternate record is provided.