Password authentication

• US 9,367,678 B2
• Filed: 02/29/2012
• Issued: 06/14/2016
• Est. Priority Date: 02/29/2012
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Pal, Dmitri V., Gallagher, Stephen J.
• Primary Examiner(s): JHAVERI, JAYESH M
• Application Number:
  US13/408,747
• Publication Number:
  US 20130227677A1
• Time in Patent Office: 1,567 Days
• Field of Search: 726/19
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

A user credential comprising a user password and a one-time password (OTP) may be provided to access a computing system. The user password is authenticated and the network connection status of the computing system is determined. If the computing system is offline, the user password and the OTP are stored in memory and the user is granted a first level of access to the computing system. Upon detecting that the network connection status of the computing system has changed to online, the user password and the OTP are provided to an authentication server for authentication. If the authentication of the user password and the OTP is successful, the user is granted a second level of access to the computing system, the second level of access being higher than the first level of access.

Claims

1. A method, comprising:

receiving a credential to access a computer system, the credential comprising a user password and a one-time password (OTP);

authenticating, by a processor, the user password using a cached password;

when the computer system is unable to access an authentication server and unable to authenticate the OTP using the authentication server, storing the OTP and the user password in a memory of the computer system and granting, by the processor, a user a first level of access to the computer system, wherein the first level of access is granted in view of the authentication, by the processor, of the user password using the cached password and without authenticating the OTP;

checking whether the computer system is able to access the authentication server; and

when the computer system is able to access the authentication server, authenticating the stored OTP using the authentication server and granting, by the processor, the user a second level of access to the computer system, the second level of access being different than the first level of access, and wherein the second level of access grants the user an access ticket to access one or more of network resources.

2. The method of claim 1, further comprising:

after authenticating the stored OTP and the stored user password, granting the user the access ticket to access the one or more of network resources and network services.

3. The method of claim 1 further comprising:

after failing to authenticate the stored OTP or the stored user password, performing one or more security measures.

4. The method of claim 3, wherein performing the one or more security measures comprises locking the computer system when the stored user password is invalid.

5. The method of claim 3, wherein performing the one or more security measures comprises:

requesting a second OTP when the stored OTP is invalid;

receiving the second OTP;

authenticating the second OTP and the stored user password using the authentication server; and

after authenticating the second OTP and the stored user password, granting the user the second level of access to the computer system.

6. The method of claim 5, further comprising:

after failing to authenticate the second OTP or the stored user password, locking the computer system.

7. The method of claim 1, wherein the OTP comprises an event-based OTP.

8. An apparatus comprising:

a memory to store a plurality of one-time passwords; and

a processor, operatively coupled to the memory, to;

receive a credential to access a computer system, the credential comprising a user password and a one-time password (OTP);

authenticate the user password using a cached password;

when the computer system is unable to access an authentication server and unable to authenticate the OTP using the authentication server, store the OTP and the user password in a memory of the computer system and grant a user a first level of access to the computer system, wherein the first level of access is granted in view of the authentication, by the processor, of the user password using the cached password and without authenticating the OTP;

check whether the computer system is able to access the authentication server; and

when the computer system is able to access the authentication server, authenticating the stored OTP using the authentication server and granting the user a second level of access to the computer system, the second level of access being different than the first level of access, and wherein the second level of access grants the user an access ticket to access one or more of network resources.

9. The apparatus of claim 8, wherein the processor is further to:

after authenticating the stored OTP and the stored user password, grant the user the access ticket to access the one or more of network resources and network services.

10. The apparatus of claim 8, wherein the processor is further to:

after failing to authenticate the stored OTP or the stored user password, perform one or more security measures.

11. The apparatus of claim 10, wherein to perform the one or more security measures, the processor is to lock the computer system when the stored user password is invalid.

12. The apparatus of claim 10, wherein to perform the one or more security measures, the processor to:

request a second OTP when the stored OTP is invalid;

receive the second OTP;

authenticate the second OTP and the stored user password using the authentication server; and

after authenticating the second OTP and the stored user password, grant the user the second level of access to the computer system.

13. The apparatus of claim 12, wherein the processor is further to:

after failing to authenticate the second OTP or the stored user password, lock the computer system.

14. The apparatus of claim 8, wherein the OTP comprises an event-based OTP.

15. A non-transitory machine-readable storage medium including data that, when accessed by a processor, cause the processor to:

receive, by the processor, a credential to access a computer system, the credential comprising a user password and a one-time password (OTP);

authenticate the user password using a cached password;

when the computer system is unable to access an authentication server and unable to authenticate the OTP using the authentication server, store the OTP and the user password in a memory of the computer system and granting, by the processor, a user a first level of access to the computer system, wherein the first level of access is granted in view of the authentication, by the processor, of the user password using the cached password and without authenticating the OTP;

check whether the computer system is able to access the authentication server; and

when the computer system is able to access the authentication server, authenticate the stored OTP and the user password using the authentication server and granting, by the processor, the user a second level of access to the computer system, the second level of access being different than the first level of access, and wherein the second level of access grants the user an access ticket to access one or more of network resources.

16. The non-transitory machine-readable storage medium of claim 15, wherein the processor is further to:

after authenticating the stored OTP and the stored user password, grant the user the access ticket to access the one or more of network resources and network services.

17. The non-transitory machine-readable storage medium of claim 15, wherein the processor further to:

after failing to authenticate the stored OTP or the stored user password, perform one or more security measures.

18. The non-transitory machine-readable storage medium of claim 17, wherein to perform the one or more security measures the processor to lock the computer system when the stored user password is invalid.

19. The non-transitory machine-readable storage medium of claim 17, wherein to perform the one or more security measures the processor to:

request a second OTP when the stored OTP is invalid;

receive the second OTP;

authenticate the second OTP and the stored user password using the authentication server; and

after authenticating the second OTP and the stored user password, grant the user the second level of access to the computer system.

20. The non-transitory machine-readable storage medium of claim 19, wherein the processor further to:

after failing to authenticate the second OTP or the stored user password, lock the computer system.