Conditional supplemental password

• US 8,291,470 B2
• Filed: 12/10/2008
• Issued: 10/16/2012
• Est. Priority Date: 12/10/2008
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Delia, Wayne M., Kelley, Edward E., Motika, Franco
• Primary Examiner(s): POWERS, WILLIAM S
• Application Number:
  US12/331,497
• Publication Number:
  US 20100146602A1
• Time in Patent Office: 1,406 Days
• Field of Search: 726/2, 726/26, 726/28
• US Class Current: 726/2
• CPC Class Codes: G06F 21/31 User authentication

Abstract

A password protected machine where a primary alternative password and a secondary alternative password are assigned, but the secondary alternative password cannot be used to gain access unless and until the primary alternative password has been deactivated. Also, a password protected machine where a user is assigned at least two alternative passwords, and where the use of one alternative password will automatically deactivate the other password. Preferably, there is a primary password and a secondary password such that: (i) the use of the primary password does not deactivate the secondary password, but (ii) the use of the secondary password does deactivate the primary password.

Claims

1. A method of password protecting access control, the method comprising the following steps:

(a) assigning a primary password to a user, with the primary password, when activated, being usable to gain access comprising access to at least a first access controlled module;

(b) subsequent to or contemporaneous with step (a), activating the primary password;

(c) prior to, subsequent to or contemporaneous with step (a), assigning to the user a secondary password, with the secondary password, when activated, being usable to gain access comprising access to at least the first access controlled module;

(d) subsequent to or contemporaneous with step (c), deactivating the secondary password;

(e) subsequent to steps (a), (b), (c) and (d), performing pre-expiration deactivation of the primary password; and

(f) subsequent to or contemporaneous with step (e), activating the secondary password.

2. The method of claim 1 wherein the pre-expiration deactivation performed at step (e) is due to suspension of the primary password.

3. The method of claim 1 further comprising the step of:

subsequent to step (f), deactivating the secondary password upon at least one of the following conditions;

(i) predetermined number of logons using the secondary password;

or (ii) passage of a predetermined amount of time since the occurrence of step (f).

4. The method of claim 1 further comprising the step of:

subsequent to step (f), changing/resetting, by the user, of the primary password.

5. A password protected machine comprising:

a user input module structured or programmed to allow entry of passwords by a user;

an access controlled module structured or programmed to be accessed by the user only upon receipt of an assigned and activated password from the user;

a password database structured or programmed to store a plurality of passwords associated with the user and respective activation status of the plurality of passwords;

a password control module structured or programmed to;

(i) assign and store a primary password for the user in the password database, (ii) assign and store a secondary password for the user in the password database, (iii) on an ongoing basis, set the activation status of the primary password, and (iv) on an ongoing basis, set the activation status of the secondary password; and

an access control module structured or programmed to control the password control module to activate the secondary password directly in response to pre-expiration deactivation of the primary password without requiring the user to authenticate before using the secondary password to gain access to the access controlled module.

6. The machine of claim 5 wherein the access control module is further structured or programmed to deactivate the secondary password after a predetermined amount of time after its activation in response to deactivation of the primary password.

7. The machine of claim 5 wherein the access controlled module is further structured or programmed to deactivate the secondary password after a predetermined number of logons using the secondary password.

8. The machine of claim 5 wherein the access control module is further structured or programmed to notify a system administrator at least a first time the secondary password is used to log on subsequent to its activation in response to deactivation of the primary password.

9. A machine readable non-transitory medium for use with a password protected machine that includes a user input module structured or programmed to allow entry of passwords by a user, an access controlled module structured or programmed to be accessed by the user only upon receipt of an assigned and activated password from the user, and a password database structured or programmed to store a plurality of passwords associated with the user and respective activation status of the plurality of passwords, the machine readable medium being programmed with the following code:

password control software programmed to;

(i) assign and store a primary password for the user in the password database, (ii) assign and store a secondary password for the user in the password database, (iii) on an ongoing basis, set the activation status of the primary password, and (iv) on an ongoing basis, set the activation status of the secondary password; and

access control software programmed to control the password control software to activate the secondary password directly in response to pre-expiration deactivation of the primary password without requiring the user to authenticate before using the secondary password to gain access to the access controlled module.

10. The medium of claim 9 wherein the access control software is further to deactivate the secondary password after a predetermined amount of time after its activation in response to deactivation of the primary password.

11. The medium of claim 9 wherein the access control software is further programmed to deactivate the secondary password after a predetermined number of logons using the secondary password.

12. A method of password protecting access control, the method comprising the following steps:

(a) assigning a primary alternative password to a user, with the primary password, when activated, being usable to gain access comprising access to at least a first access controlled module;

(b) prior to, subsequent to armor contemporaneous with step (a), assigning to the user a secondary alternative password, with the secondary alternative password, when activated, being usable to gain access comprising access to at least the first access controlled module;

(c) subsequent to or contemporaneous with steps (a) and (b), receiving an entered password from the user;

(d) subsequent to step (c), determining that the entered password sufficiently matches the secondary alternative password; and

(e) subsequent to step (d), deactivating the primary alternative password in response to a determination that the secondary alternative password has been received at step (d).

13. The method of claim 12 further comprising the step of:

(f) subsequent to step (d), allowing the user to gain access to the first access controlled module in response to a determination that the secondary alternative password has been received at step (d).

14. The method of claim 12 further comprising the step of:

(f) subsequent to step (d), reassigning the secondary alternative password to be the primary alternative password in response to a determination that the secondary alternative password has been received at step (d).

15. A password protected machine comprising:

a user input module structured or programmed to allow entry of passwords by a user;

an access controlled module structured or programmed to be accessed by the user only upon receipt of an assigned and activated password from the user;

a password database structured or programmed to store a plurality of passwords associated with the user and respective activation status of the plurality of passwords;

a password control module structured or programmed to;

(i) assign and store a primary alternative password for the user in the password database, (ii) assign and store a secondary alternative password for the user in the password database, (iii) on an ongoing basis, set the activation status of the primary alternative password, and (iv) on an ongoing basis, set the activation status of the secondary alternative password; and

an access control module structured or programmed to;

(i) allow a user to access the access controlled module when the primary alternative password is received through the user input module and has activated status;

(ii) allow a user to access the access controlled module when the secondary alternative password is received through the user input module and has activated status; and

(iii) deactivate the primary password when the secondary alternative password is received through the user input module and has activated status.

16. The machine of claim 15 wherein:

the primary alternative password is alphanumeric; and

the secondary alternative password is alphanumeric.

17. The machine of claim 15 further comprising a communication network structured, connected or programmed to allow communication of passwords from the user input module to the access control module.

18. The machine of claim 15 wherein the access control module is further structured or programmed to control the password control module to reassign the secondary alternative password to be the primary alternative password in the password database in response to a determination that the secondary alternative password has been received through the user input module.