Method for automatically deleting a user password upon successful use of a multi-factor authentication modality

Patent metadata

Field	Value
Publication number	US-2018063128-A1
Application number	US-201615252818-A
Country	US
Kind code	A1
Filing date	Aug 31, 2016
Priority date	Aug 31, 2016
Publication date	Mar 1, 2018
Grant date	—

Abstract

A method is provided for automatically deleting user passwords. Upon receiving a password-less user authentication a password grace period timer is started. Upon expiration of the password grace period timer the password is deleted if a user confidence score associated with the user is greater than a confidence threshold.

First claim

We claim:

1 . A method for automatically deleting user passwords, the method comprising:
receiving a successful password-less user authentication; starting a password grace period timer; and upon expiration of the password grace period timer, deleting the user password if a user confidence score associated with the user is greater than a confidence threshold.

2 . The method of claim 1 , the method further comprising extending the password grace period timer if the user confidence score is less than the confidence threshold.

3 . The method of claim 1 , the method further comprising flagging the user for training in using multi-factor authentication if the user confidence score is less than the confidence threshold.

4 . The method of claim 1 , wherein the user confidence score is calculated at least in part on a count of failed user verification.

5 . The method of claim 1 , wherein the user confidence score is calculated at least in part on a count of false rejection rate.

6 . The method of claim 1 , wherein the user confidence score is calculated at least in part on a password-less login frequency of the user.

7 . The method of claim 1 , wherein the user confidence score is calculated at least in part on a count of password authentication attempts during the grace period time.

8 . The method of claim 1 , the method further comprising the step of recalculating the confidence threshold using the user confidence score.

9 . A method for calculating a user confidence score. the method comprising:
receiving a user False Rejection Rate (FRR) associated with the user; comparing the user FRR to a population FRR to determine an initial user confidence score; combining confidence factors with the initial user confidence score to create a user confidence; and increasing a user confidence score associated with the user if the user confidence is greater than a previous user confidence.

10 . The method of claim 9 , wherein the step of combining confidence factors with the initial user confidence score to create a user confidence comprises combining a password-less login frequency of the user with the initial confidence score to create a user confidence.

11 . The method of claim 9 , wherein the step of combining confidence factors with the initial user confidence score to create a user confidence comprises combining a password authentication usage of the user with the initial confidence score to create a user confidence.

12 . The method of claim 9 , the method further comprising the step of decreasing the user confidence score associated with the user if the user confidence is less than a previous user confidence.

Assignees

• Motorola Solutions Inc

Inventors

• Korus Michael F
• Kleyman Irina
• Lewis Adam C

Classifications

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06F21/40 Primary

  by quorum, i.e. whereby two or more security principals are required · CPC title

• G06F2221/2143

  Clearing memory, e.g. to prevent the data from being stolen · CPC title

• G06F2221/2137

  Time limited access, e.g. to a computer or data · CPC title