Password theft protection for controlling access to computer software

• US 9,984,247 B2
• Filed: 11/19/2015
• Issued: 05/29/2018
• Est. Priority Date: 11/19/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Farkash, Ariel, Jarrous, Ayman, Moffie, Micha
• Primary Examiner(s): Siddiqi, Mohammad A
• Application Number:
  US14/945,447
• Publication Number:
  US 20170147826A1
• Time in Patent Office: 922 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Accessing a password-secured computer software application by acquiring an input password, generating at a first computer an output password from the input password using password generation data, where the output password differs from the input password, and providing the output password to a second computer as part of a request to access a password-secured computer software application using the output password, where the password-secured computer software application is accessible using the output password, and where the password-secured computer software application is inaccessible using the input password.

Claims

1. A method for accessing a password-secured computer software application, the method comprising:

acquiring an input password;

generating at a first computer an output password from the input password using password generation data, wherein the output password differs from the input password, and

providing the output password accompanied by a user identifier that is associated with the output password to a second computer as part of a request to access a password-secured computer software application using the output password when accompanied by the user identifier,

wherein the password-secured computer software application is accessible using the output password when accompanied by the user identifier,

wherein the password-secured computer software application is inaccessible using the input password when accompanied by the user identifier,

wherein the acquiring comprises acquiring wherein the input password is input into a web page of the password-secured computer software application,

wherein the generating comprises generating the output password by using the password generation data in combination with data associated with the web page of the password-secured computer software application, and

wherein the generating comprises generating wherein the data associated with the web page includes any of a portion of a network address associated with the web page, and a certificate signature public key associated with the web page.

2. The method of claim 1 wherein the generating comprises generating wherein the password generation data includes an encryption key.

3. The method of claim 1 wherein the generating comprises generating wherein the password generation data includes a seed for use with a predefined data transformation algorithm.

4. The method of claim 1 wherein the generating comprises generating the output password in accordance with a predefined password format.

5. A system for accessing a password-secured computer software application, the system comprising:

a password acquirer configured to acquire an input password; and

a password generator configured to

generate at a first computer an output password from the input password using password generation data, wherein the output password differs from the input password, and

provide the output password accompanied by a user identifier that is associated with the output password to a second computer as part of a request to access a password-secured computer software application using the output password when accompanied by the user identifier,

wherein the password-secured computer software application is accessible using the output password when accompanied by the user identifier,

wherein the password-secured computer software application is inaccessible using the input password when accompanied by the user identifier,

wherein the input password is input into a web page of the password-secured computer software application,

wherein the password generator is configured to generate the output password by using the password generation data in combination with data associated with the web page of the password-secured computer software application, and

wherein the data associated with the web page includes any of a portion of a network address associated with the web page, and a certificate signature public key associated with the web page.

6. The system of claim 5 wherein the password generation data includes an encryption key.

7. The system of claim 5 wherein the password generation data includes a seed for use with a predefined data transformation algorithm.

8. The system of claim 5 wherein the password generator is configured to generate the output password in accordance with a predefined password format.

9. A computer program product for accessing a password-secured computer software application, the computer program product comprising:

a non-transitory, computer-readable storage medium; and

computer-readable program code embodied in the storage medium, wherein the computer-readable program code is configured to

acquire an input password,

generate at a first computer an output password from the input password using password generation data, wherein the output password differs from the input password, and

provide the output password accompanied by a user identifier that is associated with the output password to a second computer as part of a request to access a password-secured computer software application using the output password when accompanied by the user identifier,

wherein the password-secured computer software application is accessible using the output password when accompanied by the user identifier,

wherein the password-secured computer software application is inaccessible using the input password when accompanied by the user identifier,

wherein the input password is input into a web page of the password-secured computer software application,

wherein the computer-readable program code is configured to generate the output password by using the password generation data in combination with data associated with the web page of the password-secured computer software application, and

wherein the data associated with the web page includes any of a portion of a network address associated with the web page, and a certificate signature public key associated with the web page.

10. The computer program product of claim 9 wherein the password generation data includes an encryption key.

11. The computer program product of claim 9 wherein the password generation data includes a seed for use with a predefined data transformation algorithm.