Method for performing password transitions

Patent metadata

Field	Value
Publication number	US-11301549-B2
Application number	US-202016860359-A
Country	US
Kind code	B2
Filing date	Apr 28, 2020
Priority date	Apr 28, 2020
Publication date	Apr 12, 2022
Grant date	Apr 12, 2022

Abstract

A method for changing a security credential, such as a password, for secure user authentication with respect to user access to an application is provided. The method includes: receiving, from a vault that is configured to periodically generate and change a credential for accessing the application, a current credential and a first future credential that is designated as a next credential; transmitting, to a user that has access to the vault, the current credential; when a first interval that corresponds to a periodicity of a changing of the credential elapses, receiving, from the vault, a message indicating that the current credential has expired and that the next credential has been redesignated as the current credential, and providing a newly designated next credential, and transmitting, to the user, a message indicating that the previous current credential has expired and providing the redesignated current credential.

First claim

What is claimed is:

1. A method for changing a credential for secure user authentication, the method being implemented by at least one processor that is configured to facilitate user access to an application, the method comprising:
receiving, from a user, a request for creating an account for accessing the application;
transmitting, to the user, a response indicating that the account has been created and prompting the user to obtain access to a vault that is configured to periodically generate and change a credential for accessing the application;
receiving, from the vault, a current credential and a first future credential that is designated as a next credential;
transmitting, to the user, the current credential;
when a request for accessing the application that includes the current credential is received from the user, providing, to the user, access to the application;
when a first interval that corresponds to a periodicity of a changing of the credential elapses, receiving, from the vault, a message indicating that the current credential has expired and that the next credential has been redesignated as the current credential, and providing a second future credential that has been designated as the next credential; and
transmitting, to the user, a message indicating that the previous current credential has expired and providing the redesignated current credential.

2. The method of claim 1 , wherein when the request for accessing the application is received from the user after the first interval has elapsed and before the transmitting the message providing the redesignated current credential, the method further includes:
denying access to the application; and
transmitting, to the user, the message indicating that the previous current credential has expired and providing the redesignated current credential.

3. The method of claim 1 , wherein the credential includes a password.

4. The method of claim 1 , wherein the credential includes a digital token.

5. The method of claim 1 , wherein the credential includes a public key/private key combination.

6. The method of claim 1 , wherein the credential is generated by using a pseudorandom number generator.

7. The method of claim 1 , wherein the credential is generated by the at least one processor using a pseudorandom number generation algorithm.

8. The method of claim 1 , wherein the credential changes at least once every 24 hours.

9. The method of claim 1 , wherein the credential changes at least once every thirty minutes.

10. The method of claim 1 , wherein the credential changes at least once every ten seconds.

11. A computing apparatus for changing a credential for secure user authentication with respect to user access to an application, the computing apparatus comprising:
a processor;
a memory; and
a communication interface coupled to each of the processor and the memory,
wherein the processor is configured to:
receive, from a user via the communication interface, a request for creating an account for accessing the application;
transmit, to the user via the communication interface, a response indicating that the account has been created and prompting the user to obtain access to a vault that is configured to periodically generate and change a credential for accessing the application;
receive, from the vault, a current credential and a first future credential that is designated as a next credential;
transmit, to the user via the communication interface, the current credential;
when a request for accessing the application that includes the current credential is received from the user, provide, to the user, access to the application;
when a first interval that corresponds to a periodicity of a changing of the credential elapses, receive, from the vault, a message indicating that the current credential has expired and that the next credential has been redesignated as the current credential, and providing a second future credential that has been designated as the next credential; and
transmit, to the user via the communication interface, a message indicating that the previous current credential has expired and providing the redesignated current credential.

12. The computing apparatus of claim 11 , wherein when the request for accessing the application is received from the user after the first interval has elapsed and before the the message providing the redesignated current credential has been transmitted to the user, the processor is further configured to deny access to the application, and to transmit, to the user via the communication interface, the message indicating that the previous current credential has expired and providing the redesignated current credential.

13. The computing apparatus of claim 11 , wherein the credential includes a password.

14. The computing apparatus of claim 11 , wherein the credential includes a digital token.

15. The computing apparatus of claim 11 , wherein the credential includes a public key/private key combination.

16. The computing apparatus of claim 11 , further comprising a pseudorandom number generator configured to generate the credential.

17. The computing apparatus of claim 11 , wherein the processor is further configured to generate the credential by using a pseudorandom number generation algorithm.

18. The computing apparatus of claim 11 , wherein the credential changes at least once every 24 hours.

19. The computing apparatus of claim 11 , wherein the credential changes at least once every thirty minutes.

20. The computing apparatus of claim 11 , wherein the credential changes at least once every ten seconds.

Assignees

• Jpmorgan Chase Bank Na

Inventors

• Asher Adrian

Classifications

• H04L63/0846

  using time-dependent-passwords, e.g. periodically changing passwords · CPC title

• H04L9/088

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title

• H04L9/3073

  involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• G06F21/46

  by designing passwords or checking the strength of passwords · CPC title