SYSTEMS AND METHODS FOR MANAGING CREDENTIALS USED TO AUTHENTICATE ACCESS IN DATA PROCESSING SYSTEMS

• US 20180139193A1
• Filed: 11/15/2016
• Published: 05/17/2018
• Est. Priority Date: 11/15/2016
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: EDWARDS, Daniel
• Granted Patent: US 10,462,152 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time

Abstract

A system receives a first request to replace a first credential used by an entity to access one or more resources with a second credential to be used by the entity to access the one or more resources. In response to receiving the first request, the system replaces the first credential with the second credential and allows use of the first credential for a predetermined period. In response to receiving a second request from the entity to access the one or more resources using the first credential after replacing the first credential with the second credential, the system allows the entity to access the one or more resources using the first credential during the predetermined period, and generates an indication that the entity used the first credential to access the one or more resources and that the entity is to be updated with the second credential within the predetermined period.

Claims

1. A system comprising:

a processor and memory; and

machine readable instructions stored in the memory and executed by the processor, configured to;

receive a first request to replace a first credential used by an entity to access one or more resources with a second credential to be used by the entity to access the one or more resources;

in response to receiving the first request, replace the first credential with the second credential and allow use of the first credential for a predetermined period; and

in response to receiving a second request from the entity to access the one or more resources using the first credential after replacing the first credential with the second credential;

allow the entity to access the one or more resources using the first credential during the predetermined period; and

generate an indication that the entity used the first credential to access the one or more resources and that the entity is to be updated with the second credential within the predetermined period.

2. The system of claim 1 wherein the machine readable instructions are further configured to allow the entity to use the second credential to access the one or more resources.

3. The system of claim 1 wherein the machine readable instructions are further configured to:

invalidate the first credential after the predetermined period expires; and

deny the entity access to the one or more resources using the first credential after the predetermined period expires.

4. The system of claim 1 wherein the machine readable instructions are further configured to indicate an attempt by the entity to access the one or more resources using the first credential after the predetermined period expires.

5. The system of claim 1 wherein the machine readable instructions are further configured to identify one or more devices from which the entity makes an unauthorized attempt to access the one or more resources by detecting an attempt by the entity from the one or more devices to access the one or more resources using the first credential after the predetermined period expires.

6. The system of claim 1 wherein after replacing the first credential with the second credential, allowing the entity to use the first credential to access the one or more resources during the predetermined period prevents the replacement from causing a failure during the predetermined period.

7. The system of claim 1 wherein after replacing the first credential with the second credential, allowing the entity to use the first credential to access the one or more resources during the predetermined period provides time within the predetermined period for updating the entity with the second credential.

8. The system of claim 1 wherein the machine readable instructions are further configured to identify one or more devices that use the entity by detecting an attempt by the entity from the one or more devices to access the one or more resources using the first credential.

9. A method comprising:

receiving a first request to replace a first credential used by an entity to access one or more resources with a second credential to be used by the entity to access the one or more resources;

in response to receiving the first request, replacing the first credential with the second credential and allow use of the first credential for a predetermined period; and

in response to receiving a second request from the entity to access the one or more resources using the first credential after replacing the first credential with the second credential;

allowing the entity to access the one or more resources using the first credential during the predetermined period; and

indicating that the entity used the first credential to access the one or more resources and that the entity is to be updated with the second credential within the predetermined period.

10. The method of claim 9 further comprising allowing the entity to use the second credential to access the one or more resources.

11. The method of claim 9 further comprising:

invalidating the first credential after the predetermined period expires; and

denying the entity access to the one or more resources using the first credential after the predetermined period expires.

12. The method of claim 9 further comprising indicating an attempt by the entity to access the one or more resources using the first credential after the predetermined period expires.

13. The method of claim 9 further comprising identifying one or more devices from which the entity makes an unauthorized attempt to access the one or more resources by detecting an attempt by the entity from the one or more devices to access the one or more resources using the first credential after the predetermined period expires.

14. The method of claim 9 further comprising after replacing the first credential with the second credential, by allowing the entity to use the first credential to access the one or more resources during the predetermined period, preventing the replacement from causing a failure during the predetermined period.

15. The method of claim 9 further comprising after replacing the first credential with the second credential, by allowing the entity to use the first credential to access the one or more resources during the predetermined period, providing time within the predetermined period for updating the entity with the second credential.

16. The method of claim 9 further comprising identifying one or more devices that uses the entity by detecting an attempt by the entity from the one or more devices to access the one or more resources using the first credential.

17. A system comprising:

a processor and memory; and

machine readable instructions, when executed by the processor and memory, configured to;

replace a first identifying information used by an entity to access a resource with a second identifying information to be used by the entity to access the resource; and

in response to receiving a request from the entity to access the resource using the first identifying information after replacing the first identifying information with the second identifying information;

allow the entity to access the resource using the first identifying information for a predetermined period; and

indicate that the entity used the first identifying information to access the resource and that the entity is to be updated with the second identifying information within the predetermined period.

18. The system of claim 17 wherein the machine readable instructions are further configured to deny the entity access to the resource using the first identifying information after the predetermined period expires.

19. The system of claim 17 wherein the machine readable instructions are further configured to indicate an attempt by the entity to access the resource using the first identifying information after the predetermined period expires as an unauthorized attempt.

20. The system of claim 17 wherein after replacing the first identifying information with the second identifying information, allowing the entity to use the first identifying information to access the resource during the predetermined period prevents the replacement from causing a failure during the predetermined period and provides time within the predetermined period for updating the entity with the second identifying information.