Secure credentials control method

• US 10,055,595 B2
• Filed: 08/29/2008
• Issued: 08/21/2018
• Est. Priority Date: 08/30/2007
• Status: Active Grant

• Current Assignee: Baimmt, LLC
• Original Assignee: Baimmt, LLC
• Inventors: Selgas, Thomas D., Cutrer, Jonathan
• Primary Examiner(s): Zele, Krista
• Assistant Examiner(s): Chambers, Michael A
• Application Number:
  US12/201,150
• Publication Number:
  US 20090064297A1
• Time in Patent Office: 3,644 Days
• Field of Search: 726 17, 726 6, 726 5, 726 21, 726 28, 709229, 709223, 709226, 709203, 713202, 713184, 713186, 707100
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords

Abstract

Methods, apparatus, and systems are provided to secure access to an account of a user. The account may have a system administrator. The user may have a credential for accessing the secure data on the account. The methods, apparatus, and systems involve setting a universal reset credential associated with the account, denying the system administrator of the account permission to change the first credential of the access feature, and permitting the system administrator to reset the access feature from the first credential to the universal reset credential.

Claims

1. A method for securing access to an account of a user, wherein the account comprises at least a first credential set as at least a portion of an access feature in a credential database for authenticating the user, the method comprising:

permitting the user to set a universal reset credential associated with the account that is stored in the credential database;

permitting a system administrator of the account, who is not the user, to reset the access feature from the first credential in the credential database to the universal reset credential in the credential database without input across a computer network from the user;

denying the system administrator of the account, who is not the user, permission to change the first credential of the access feature in the credential database, wherein the first credential of the access feature is not known by the system administrator and wherein the first credential is within a secure area of the credential database restricting access from the system administrator to the first credential, wherein the system administrator is restricted from viewing the first credential;

and denying the system administrator of the account permission to change the universal reset credential that is stored in the credential database;

denying the system administrator permission to change the access feature from the universal reset credential to the first credential not known by the system administrator, after the universal reset credential is set;

and denying use of the first credential of the access feature, after the universal reset credential is set,

wherein the system administrator is restricted to resetting the access feature to the universal reset credential.

2. The method of claim 1, the method further comprising:

recording information related to a change to the first credential in a secure database; and

sending a notification of the change to the first credential.

3. The method of claim 2, wherein sending a notification comprises requesting from the user a first response to the notification which indicates approval or disapproval of the change to the first credential.

4. The method of claim 1, wherein the first credential is a password.

5. The method of claim 1, wherein the first credential is selected from the group of a biometric, a key, and a combination.

6. The method of claim 1, the method further comprising:

recording information related to a reset of the first credential in a secure database; and

sending a notification of the reset of the first credential.

7. The method of claim 6, wherein sending a notification comprises requesting from the user a second response to the notification which indicates approval or disapproval of the reset to the first credential.

8. The method of claim 7, further comprising:

denying the system administrator of the account permission to access a second credential set as at least a portion of the access feature, wherein the second credential comprises a credential receiver and a code; and

permitting the system administrator to reset the access feature from the second credential to the universal reset credential.

9. The method of claim 8, the method further comprising:

recording information related to a change to the second credential in the secure database; and

sending a notification of the change to the second credential.

10. The method of claim 9, wherein sending a notification comprises requesting from the user a response to the notification which indicates approval or disapproval of the change to the second credential.

20. The method of claim 1, wherein the universal reset credential stored in the credential database comprises at least one of a password, a key, a combination, a biometric, and an identity of a credential receiver.

11. A computer program product for enabling a computer to secure access to an account of a user, wherein the account comprises at least a first credential set as at least a portion of an access feature for authenticating the user, the computer program product comprising:

software instructions for enabling a computer to perform predetermined operations; and

a non-transitory computer readable storage medium bearing the software instructions;

the predetermined operations including;

permitting the user to set a universal reset credential associated with the account that is stored in a credential database;

permitting a system administrator of the account, who is not the user, to reset the access feature from the first credential in the credential database to the universal reset credential in the credential database without input across a computer network from the user;

denying the system administrator of the account, who is not the user, permission to change the first credential of the access feature, wherein the first credential of the access feature is not known by the system administrator and wherein the first credential is within a secure area of the credential database restricting access from the system

administrator to the first credential, wherein the system administrator is restricted from

viewing the first credential;

denying the system administrator of the account permission to change the universal reset credential that is stored in the credential database;

denying the system administrator of the account permission to change the access feature from the universal reset credential to the first credential not known by the system administrator, after the universal reset credential is set; and

denying use of the first credential, after the resetting the access feature from the first credential in the credential database to the universal reset credential,

wherein the system administrator is restricted to resetting the access feature to the universal reset credential.

12. The computer program product of claim 11, wherein the predetermined operations further include:

recording information related to a change to the first credential in a secure database; and

sending a notification of the change to the user and a designee of the user.

13. The computer program product of claim 11, wherein the first credential is a password.

14. The computer program product of claim 11, wherein the first credential is selected from the group of a biometric, a key, and a combination.

15. The computer program product of claim 11, wherein the predetermined operations further include:

recording information related to a reset of the first credential in a secure database; and

sending a notification of the reset of the first credential.

16. The computer program product of claim 15, wherein the predetermined operations further include:

denying the system administrator of the account permission to access a second credential set as at least a portion of the access feature, wherein the second credential comprises a credential receiver chosen by the user and a pass code; and

permitting the system administrator to reset the at least a portion of the access feature from the second credential to the universal reset credential.

17. The computer program product of claim 16, the method further comprising:

recording information related to a change of the portion of the access feature relating to the second credential in a secure location; and

sending a notification of the change to the access feature portion.

21. The computer program product of claim 11, wherein the universal reset credential comprises at least one of a password, a key, a combination, a biometric, and an identity of a credential receiver.

18. A method for securing access to an account of a user, wherein the account comprises at least a first credential set as at least a portion of an access feature in a credential database for authenticating the user, the method comprising:

permitting the user to set a universal reset credential associated with the account that is stored in the credential database;

permitting a system administrator of the account, who is not the user, to reset the access feature from the first credential in the credential database to the universal reset credential in the credential database without input across a computer network from the user;

denying the system administrator of the account, who is not the user, permission to change the first credential of the access feature that is stored in the credential database, wherein the first credential of the access feature is not known by the system administrator and wherein the first credential is within a secure of the credential database restricting access from system administrator to the first credential, wherein the system administrator is restricted from viewing the first credential;

denying the system administrator permission to change the access feature from the universal reset credential to the first credential not known by the system administrator and in the credential database;

denying the system administrator permission to change the universal reset credential that is stored in the credential database;

denying use of the first credential of the access feature, after the resetting the access feature from the first credential in the credential database to the universal reset credential,

wherein the system administrator is restricted to resetting the access feature to the universal reset credential;

recording information related to a change to the first credential in a secure table;

electronically sending a notification of the change to the first credential to the user;

recording information related to a reset of the first credential in the secure table; and

electronically sending a notification of the reset of the first credential to the user.

22. The method of claim 18, wherein the universal reset credential comprises at least one of a password, a key, a combination, a biometric, and an identity of a credential receiver.

19. A method for securing access to an email account of a user, the method comprising:

requiring the user to provide a first password to access the email account prior to a requiring the user to provide a universal reset password;

permitting the user to set the universal reset password associated with the email account to be stored in a credential database;

denying a system administrator of the email account, who is not the user, permission to view the first password;

denying the system administrator of the email account permission to change the first password;

permitting the system administrator of the email account to view the universal reset password;

denying the system administrator of the email account permission to change the universal reset password stored in the credential database; and

permitting the system administrator of the email account, without input from the user, to require the user to provide the universal reset password stored in the credential database, rather than the first password, to access the email account;

denying the system administrator permission to require the user to provide the first password after the requiring the user to provide the universal reset password; and

denying the system administrator permission to provide the first credential to access the email account after the requiring the user to provide the universal reset password.