Methods, systems, and computer program products that centrally manage password policies

• US 20040250141A1
• Filed: 06/05/2003
• Published: 12/09/2004
• Est. Priority Date: 06/05/2003
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Casco-Arias, Luis Benicio, Kuehr-McLaren, David Gerard, Gupta, Pratik, Record, Andrew David
• Granted Patent: US 7,530,097 B2
• Time in Patent Office: Days
• US Class Current: 713/202
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A method of controlling password changes in a system having a plurality of data processing systems having separate password registries. Contents of passwords in the password registries of the data processing systems are controlled using password content policies that are centrally shared between the plurality of data processing systems.

Claims

1. A method of controlling password changes in a system having a plurality of data processing systems having separate password registry, the method comprising:

controlling the contents of passwords in the password registries for the plurality of data processing systems utilizing password content policies centrally shared between the plurality of data processing systems.

2. The method of claim 1, wherein controlling the contents of passwords further comprises:

validating a requested password associated with a password change request from a respective one of the plurality of data processing systems utilizing the shared password content policies to provide authorization of the password change request to the respective one of the plurality of data processing systems.

3. The method of claim 2, wherein validating a requested password associated with a password change request comprises comparing, a strength of the requested password associated with the password change request against one or more password strength rules.

4. The method of claim 2, wherein validating a requested password associated with a password change request comprises checking a format of the requested password associated with the password change request.

5. The method of claim 1, further comprising

providing the password content policies within at a central password policy manager;

receiving a first password channel request at a first one of the data processing systems;

transmitting the first password change request across a network to the central password policy manager;

checking compliance of the first password change request with the password content policies to generate a first password compliance indication;

transmitting the first password compliance indication to the First one of the data processing systems; and

modifying a password registry at the first one of the data processing systems based on the first password compliance indication.

6. The method of claim 5, further comprising:

receiving a second password change request at a second one of the data processing systems;

transmitting the second password change request across the network to the central password policy manager;

checking compliance of the second password change request with the password content policies to generate a second password compliance indication;

transmitting the second password compliance indication to the second one of the data processing systems; and

modifying a password registry at the second one of the data processing systems based on the second password compliance indication.

7. The method of claim 5, further comprising generating a notice to a user at the first one of the data processing systems based on the first password compliance indication indicating that the first password change request did not comply with the password content policies.

8. The method of claim 5, further comprising providing password policy rules from the password content policies to the first one of the data processing systems in response to receiving the first password change request.

9. The method of claim 5, further comprising providing password policy rules from the password content policies to the first one of the data processing systems in response to checking compliance of the first password change request with the password content policies.

12. The password management system of claim 1 wherein the plurality of local password controllers are further configured to generate a notice to a user based on the central password policy manager indicating that a password change request did not comply with the password content policies.

10. A password management system comprising:

a plurality of data processing systems having separate password registry and configured to generate a password change request; and

a central password policy manager that is configured to validate a requested password associated with a password change request from a respective one of the plurality of data processing Systems utilizing shared password content policies to provide authorization of the password change request to the respective one of the plurality of data processing systems.

11. The password management system of claim 10, wherein the plurality of data processing systems comprise local password controllers that are configured to modify the password registry based on authorization from the central password policy manager.

13. The password management system of claim 10, wherein the central password policy manager is further configured to check compliance of a password change request by comparing a strength of a requested password associated with the password change request with password strength rules in the password content policies.

14. A computer program product for managing passwords, the computer program product comprising program code embodied in a computer-readable storage medium, the computer program code comprising:

program code for controlling password changes in a system having a plurality of data processing systems having separate password registry, by controlling the contents of passwords in the password registries for the plurality of data processing systems utilizing password content policies centrally shared between the plurality of data processing systems.

15. The computer program product according to claim 14, further comprising:

program code for validating a requested password associated with a password change request from a respective one of the plurality of data processing systems utilizing the password content policies to provide authorization of the password change request to the respective one of the plurality of data processing systems.

16. The computer program product according to claim 14, further comprising program code for modifying a password in the password registry at one of the plurality of data processing systems when a requested password associated with a password change request from the respective one of the plurality of data processing systems complies with the password content policies.

17. A computer program product according to claim 14, wherein the program code for controlling password changes in a system having a plurality of data processing systems comprises program code for comparing a strength of a requested password associated with a password change request with password strength rules in the password content policies.