System and method for generating and managing administrator passwords

• US 8,321,682 B1
• Filed: 01/26/2009
• Issued: 11/27/2012
• Est. Priority Date: 01/24/2008
• Status: Active Grant

• Current Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Original Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Inventors: Read, Matthew J., Ames, Craig S., Nangia, Vinit, Lobashov, Pavel, Lam, Josiah
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): Almamun, Abdullah
• Application Number:
  US12/360,100
• Time in Patent Office: 1,401 Days
• Field of Search: 713/183, 713/184, 380/44, 235/382, 235/382.5
• US Class Current: 713/183
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

A password management system and method for securing networked client terminals and mobile devices is provided. More specifically, the present invention provides a system and method for encrypting randomly generated administrator-level passwords and providing a means for decrypting the randomly generated passwords for single-use unrestricted access to a designated terminal or mobile device. When unrestricted access to the terminal or mobile device is required, the encrypted administrator-level password is decrypted using a shared symmetric key, which is generated during encryption of the administrator password, to reveal the administrator-level password for the terminal or mobile device. The administrator-level password is a single-use password, wherein upon use of the administrator-level password a new administrator-level password may be automatically generated for the corresponding terminal or mobile device.

Claims

1. A computer-implemented method for securing access to a networked user computer, said method comprising:

generating a random string of characters representative of a first administrator-level password, wherein said first administrator-level password is unique to said networked user computer;

encrypting said first administrator-level password using a symmetric key, wherein said encrypted first administrator-level password generates a first breakglass string;

storing said first breakglass string in association with said networked user computer for which said encrypted first administrator-level password was created; and

upon decryption of said first breakglass string, generating a second administrator-level password for encryption into a second breakglass string of characters.

2. The computer-implemented method of claim 1, wherein said networked user computer is a hardware workstation terminal or mobile device.

3. The computer-implemented method of claim 1, wherein encrypting said first administrator-level password using said symmetric key further comprises:

identifying said networked user computer for which said first administrator-level password was created;

generating a public key and a private key associated with said networked user computer;

retrieving a server public key associated with said networked user computer; and

generating said symmetric key using said private key and said retrieved server public key.

4. A computer-implemented method for obtaining access to a secured network user computer, said method comprising:

retrieving an encrypted first administrator-level password, wherein said encrypted administrator-level password is represented by a first breakglass string unique to said secured network user computer;

decrypting said first breakglass string using a symmetric key; and

revealing said first administrator-level password for obtaining unrestricted access to said secured network user computer, wherein upon decryption of said first administrator-level password, a second administrator-level password for encryption into a second breakglass string is generated.

5. The computer-implemented method of claim 4, wherein retrieving said encrypted administrator-level password further comprises the steps of:

accessing a secure network database, said secure network database configured to store an encrypted administrator-level password for a plurality of secured network user computers; and

querying said secure network database for said encrypted first administrator-level password corresponding to said unique system identifier for said secured network user computer to which unrestricted access is desired.

6. The computer-implemented method of claim 4, wherein decrypting said first breakglass string using said symmetric key further comprises the steps of:

retrieving a unique system identifier for said secured network user computer;

deriving a public key, wherein said public key is derived from said first breakglass string;

retrieving a server private key associated with said networked user computer; and

generating said symmetric key using said derived public key and said retrieved server private key.

7. The computer-implemented method of claim 4, wherein upon use of said first administrator-level password for obtaining unrestricted access to said secured network user computer, said first administrator-level password is rendered obsolete for future use.

8. The computer-implemented method of claim 4, wherein activities corresponding to said encrypted first administrator-level password are logged to maintain an audit trail.

9. A computer-implemented method for securing access to a networked workstation, said method comprising the steps of:

providing at least one client terminal employing a random password management agent, said random password management agent being configured to generate a random string of characters representative of a first administrator-level password, and further being configured to encrypt said first administrator-level password using a shared symmetric key to generate a first breakglass string of characters;

providing at least one database server configured to store said first breakglass string of characters in association with a client terminal for which the first administrator-level password was encrypted; and

providing at least one controller terminal employing a random password recovery system application, said random password recovery system application retrieving said first breakglass string of characters and deriving said symmetric key to decrypt said first breakglass string of characters and reveal said first administrator-level password;

wherein upon decryption of said first administrator-level password, said random password management agent employed by said client terminal is configured to generate a second administrator-level password for encryption into a second breakglass string of characters and render said first administrator-level password obsolete.