Automated password generation and change

Patent metadata

Field	Value
Publication number	US-10762191-B2
Application number	US-201816200543-A
Country	US
Kind code	B2
Filing date	Nov 26, 2018
Priority date	Aug 1, 2014
Publication date	Sep 1, 2020
Grant date	Sep 1, 2020

Abstract

An identity management system detects the occurrence of a trigger event, such as a time period expiration, or an action on the identity management system. The identity management system accordingly generates a new password for an account of a user on a third-party service and causes the account of the user on the third-party service to use the new password. The identity management system can also detect a manual user change of a password for a third-party service and cause configuration of client devices of the user to reflect the new password.

First claim

What is claimed is:

1. A computer-implemented method performed by an identity management system, the method comprising:
identifying client devices of a user, each client device including third-party applications for interfacing with third-party service systems;
responsive to exceeding a length of time that passwords are valid, generating, by the identity management system, a first set of passwords and a second set of passwords for a user to access the third-party service systems, the first set of passwords comprising a distinct password for each third-party application that does not support per-device passwords, and the second set of passwords comprising a distinct password for each pair comprising a third-party application that supports per-device passwords and a client device from the client devices;
configuring the client devices of the user with the first set of passwords for accessing the third-party service system; and
configuring the client devices of the user with the second set of passwords by storing the distinct password for each pair on a client device to which the distinct password corresponds.

2. The computer-implemented method of claim 1 , further comprising detecting, by the identity management system, that the user has changed one of the first set of passwords for accessing a third-party service system on a client device included in the client devices of the user.

3. The computer-implemented method of claim 1 , further comprising identifying that a password for the user to access a third-party service system has been changed within a web-based user interface provided by a third-party application on a client device of the user.

4. The computer-implemented method of claim 1 , further comprising receiving a notification of a change to a password for the user to access a third-party service system from a remote agent that queries a user directory.

5. The computer-implemented method of claim 1 , further comprising:
providing the client devices of the user with a browser plug-in that detects changes to passwords for the user to access the third-party service systems within web-based user interfaces provided by the third-party applications; and
receiving a notification of a change to a password for the user to access a third-party service by the browser plug-in.

6. The computer-implemented method of claim 1 , wherein the configuring of a client device comprises sending a request to a remote device management system to configure the client device.

7. The computer-implemented method of claim 1 , further comprising generating new passwords for the user to access the third-party service systems responsive to detecting that a password for the user to access a third-party service system is updated.

8. A non-transitory computer-readable storage medium storing instructions executable by a computer processor and that when executed by the computer processor perform actions comprising:
identifying client devices of a user, each client device including third-party applications for interfacing with third-party service systems;
responsive to exceeding a length of time that passwords are valid, generating, by the identity management system, a first set of passwords and a second set of passwords for a user to access the third-party service systems, the first set of passwords comprising a distinct password for each third-party application that does not support per-device passwords, and the second set of passwords comprising a distinct password for each pair comprising a third-party application that supports per-device passwords and a client device from the client devices;
configuring the client devices of the user with the first set of passwords for accessing the third-party service system; and
configuring the client devices of the user with the second set of passwords by storing the distinct password for each pair on a client device to which the distinct password corresponds.

9. The non-transitory computer-readable storage medium of claim 8 , the actions further comprising detecting, by the identity management system, that the user has changed one of the first set of passwords for accessing a third-party service system on a client device included in the client devices of the user.

10. The non-transitory computer-readable storage medium of claim 8 , the actions further comprising identifying that a password for the user to access a third-party service system has been changed within a web-based user interface provided by a third-party application on a client device of the user.

11. The non-transitory computer-readable storage medium of claim 8 , the actions further comprising receiving a notification of a change to a password for the user to access a third-party service system from a remote agent that queries a user directory.

12. The non-transitory computer-readable storage medium of claim 8 , the actions further comprising:
providing the client devices of the user with a browser plug-in that detects changes to passwords for the user to access the third-party service systems within web-based user interfaces provided by the third-party applications; and
receiving a notification of a change to a password for the user to access a third-party service by the browser plug-in.

13. The non-transitory computer-readable storage medium of claim 8 , wherein the configuring of a client device comprises sending a request to a remote device management system to configure the client device.

14. The non-transitory computer-readable storage medium of claim 8 , the actions further comprising generating new passwords for the user to access the third-party service systems responsive to detecting that a password for the user to access a third-party service system is updated.

15. A computer system comprising:
a computer processor; and
a storage medium storing instructions executable by a computer processor and that when executed by the computer processor perform actions comprising:
identifying client devices of a user, each client device including third-party applications for interfacing with third-party service systems;
responsive to exceeding a length of time that passwords are valid, generating, by the identity management system, a first set of passwords and a second set of passwords for a user to access the third-party service systems, the first set of passwords comprising a distinct password for each third-party application that does not support per-device passwords, and the second set of passwords comprising a distinct password for each pair comprising a third-party application that supports per-device passwords and a client device from the client devices;
configuring the client devices of the user with the first set of passwords for accessing the third-party service system; and
configuring the client devices of the user with the second set of passwords by storing the distinct password for each pair on a client device to which the distinct password corresponds.

16. The computer system of claim 15 , the actions further comprising detecting, by the identity management system, that the user has changed one of the first set of passwords for accessing a third-party service system on a client device included in the client devices of the user.

17. The computer system of claim 15 , the actions further comprising identifying that a password for the user to access a third-party service system has been changed within a web-based user interface provided by a third-party application on a client device of the user.

18. The computer system of claim 15 , the actions further comprising

Assignees

• Okta Inc

Inventors

• Aguilar-Macias Hector
• Child Reman P
• Gu Xin
• Todd Jonathan R
• Belote Thomas M

Classifications

• H04L67/53

  using third party service providers · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06F21/45 Primary

  Structures or tools for the administration of authentication · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title