SELF-SERVICE CREDENTIAL MANAGEMENT

• US 20080313731A1
• Filed: 06/15/2007
• Published: 12/18/2008
• Est. Priority Date: 06/15/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bequette, Bruce P., Elhassan, Ikrima, Iftimie, Sorin
• Granted Patent: US 8,474,022 B2
• Time in Patent Office: Days
• US Class Current: 726/18
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control

Abstract

A self-service system and method for credential reset permits an administrator to customize policies for credential reset based on any user or group of users. Administrators may choose to set a more stringent policy for credential reset for users or groups that have higher-level permissions to access sensitive information within the resource protected by the credential. Customizable, plug-in gates are provided to permit administrators fine grained control over reset policy definition. When the user initiates a credential reset, the reset policy applicable to that user is invoked, and the user is presented with gates to pass pursuant to the applicable reset policy. The user'"'"'s responses are compared to responses presented by the user at registration. If the responses meet the reset policy'"'"'s threshold for accuracy, the user is permitted to reset the credential.

Claims

1. A method for determining whether to permit a user to reset a credential used to access a resource, comprising the steps of:

receiving a request from a first user to reset a first credential, wherein the first request includes first user information;

determining, based at least on the first user information, an applicable reset policy from among at least a first reset policy and a second reset policy,

wherein the first reset policy is different from the second reset policy;

receiving a response from the first user;

granting the first request if the response satisfies the applicable reset policy.

2. The method of claim 1, wherein the credential includes a password and the first user information includes a user name.

3. The method of claim 1, wherein the request and response are received substantially simultaneously.

4. The method of claim 1, wherein the applicable reset policy is the first reset policy and the first reset policy includes a first gate, further comprising the step of:

after the step of determining, sending the first gate to the first user.

5. The method of claim 1, wherein:

the first reset policy includes at least a first gate and a second gate, and second gate is different from the first gate;

the step of receiving a response includes receiving a first response to the first gate and a second response to the second gate; and

the step of granting the first request comprises granting the first request if the first response satisfies the first gate and the second response satisfies the second gate.

6. The method of claim 1, wherein:

the first reset policy includes a first gate;

the second reset policy includes a second gate;

the first gate and the second gate are identical; and

the first reset policy includes a different pass/fail threshold than the second reset policy.

7. The method of claim 1, wherein the first reset policy includes at least a first gate, the second reset policy includes at least a second gate, and first gate is of a different type from the second gate.

8. The method of claim 1, wherein the first reset policy includes at least a first gate, the second reset policy includes at least a second gate, and the first gate is of the same type as the second gate but has different characteristics from the second gate.

9. The method of claim 1, wherein the first user information includes an identifier corresponding to the first user and the step of determining includes using the identifier to look up a first user registration stored in computer storage media.

10. The method of claim 1, wherein:

the first user is a member of a first group having a first set of permissions within the resource;

the first reset policy applies to all users in the first group; and

the applicable reset policy is the first reset policy.

11. The method of claim 1, wherein:

the first user is a member of both a first group having a first set of permissions within the resource and a second group having a second set of permissions within the resource;

the first reset policy is associated with users in the first group and the second reset policy is associated with users in the second group;

the first set of permissions allows greater access to the resource than the second set of permissions;

the first reset policy is more stringent than the second reset policy; and

the applicable reset policy is the first reset policy and not the second reset policy.

12. A computer readable medium, executable on a computing system, including at least one tangible medium and encoding a computer program of instructions for executing a computer implemented method for setting requirements to permit reset of a credential used to access a resource, comprising the steps of:

associating a first user with a first reset policy based on first user information; and

associating a second user with a second reset policy based on second user information;

wherein the first user is required to satisfy the first reset policy to reset a first credential used to access the resource; and

wherein the second user is required to satisfy the second reset policy to reset a first credential used to access the resource; and

wherein the first reset policy is different from the second reset policy.

13. The computer readable medium of claim 12, wherein the first user information includes identification of at least a first group to which the first user belongs.

14. The computer readable medium of claim 12, wherein the first user information includes a user name and the first credential includes a password.

15. The computer readable medium of claim 14, wherein:

the first user is entitled to a first set of permissions within the resource and a second user is entitled to a second set of permissions within the resource;

the first set of permissions allows greater access to the resource than the second set of permissions; and

the first reset policy is more stringent than the second reset policy.

16. The computer readable medium of claim 12, wherein the first reset policy includes at least a first gate, the second reset policy includes at least a second gate, and further comprising:

receiving a third gate; and

modifying the first reset policy to include the third gate.

17. The computer readable medium of claim 16, wherein the third gate comprises a dynamically linked library.

18. A system for determining whether to allow users to reset credentials protecting a resource, comprising:

a processing unit; and

a memory coupled with and readable by the processing unit and having stored therein instructions which, when executed by the processing unit, cause a credential reset module to perform the following acts;

receiving a first request from a first user to reset a first credential protecting the resource, wherein the first request includes first user information;

mapping the first user information to a first reset policy, wherein the first reset policy identifies at least a first gate;

receiving a first response from the first user;

granting the first user permission to reset the first credential if the first response satisfies the first reset policy;

receiving a second request from a second user to reset a second credential, wherein the second request includes second user information;

mapping the second user information to a second reset policy, wherein the second reset policy identifies at least a second gate;

receiving a second response from the second user;

granting the second user permission to reset the second credential if the second response satisfies the second reset policy;

wherein the first reset policy is different from the second reset policy.

19. The system of claim 18, wherein:

the first user is a member of both a first group and a second group;

the first reset policy is associated with users in the first group and the second reset policy is associated with users in the second group;

the first group has greater access rights within the resource than the second group; and

the first reset policy is more stringent than the second reset policy.

20. The system of claim 18, wherein the first reset policy also identifies a third gate, further comprising the act of:

receiving a third response from the first user, wherein the act of granting the first user permission comprises granting the first user permission to the reset the first credential if the first response satisfies the first gate and the third response satisfies the third gate.