Enforcement of password uniqueness

Patent metadata

Field	Value
Publication number	US-2021034735-A1
Application number	US-201916526449-A
Country	US
Kind code	A1
Filing date	Jul 30, 2019
Priority date	Jul 30, 2019
Publication date	Feb 4, 2021
Grant date	—

Abstract

Embodiments provide a computer implemented method of enforcing password uniqueness for different user accounts of a particular user. The method includes: receiving a first new password from a first user account of the particular user, wherein the first user account is associated with a first system/object referenced by a first Password Relationship Object (PRO); evaluating a uniqueness policy to determine whether password uniqueness is required by one or more other PROs, wherein each system/object referenced by the one or more other PROs has a different user account of the particular user; if the password uniqueness is required by the one or more other PROs, evaluating a matching policy to determine whether the first new password matches any password of each different user account associated with one or more systems/objects referenced by the one or more other PROs; if there is a match, enforcing an enforcement policy.

First claim

What is claimed is:

1 . A computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement the method of enforcing password uniqueness for different user accounts of a particular user, the method comprising:
receiving, by the processor, a first new password from a first user account of the particular user, wherein the first user account is associated with a first object referenced by a first Password Relationship Object (PRO); evaluating, by the processor, a uniqueness policy to determine whether password uniqueness is required by one or more other PROs, wherein each object referenced by the one or more other PROs is associated with a different user account of the particular user; if the password uniqueness is required by the one or more other PROs,
evaluating, by the processor, a matching policy to determine whether the first new password matches any password of each different user account associated with one or more objects referenced by the one or more other PROs; and
if there is a match,
enforcing, by the processor, an enforcement policy.

2 . The method as recited in claim 1 , further comprising:
if there is a match, the step of enforcing the enforcement policy further comprising:
blocking, by the processor, the first new password;
requesting, by the processor, a second new password from the particular user;
evaluating, by the processor, the matching policy to determine whether the second new password matches any password of each different user account associated with the one or more objects referenced by the one or more other PROs, wherein the step of blocking to the step of checking are repeated until an acceptable new password does not match any password of each different user account associated with the one or more objects referenced by the one or more other PROs; and
storing the acceptable new password for the first user account.

3 . The method as recited in claim 1 , wherein each PRO comprises a plurality of fields including a unique identifier, a relationship with one or more passwords, a type of referenced object, and a reference, wherein the reference includes at least one of an Internet Protocol (IP) address, a port, a protocol, a connection string, a query string, a reference string, a file, and a Uniform Resource Locator (URL).

4 . The method as recited in claim 1 , the step of enforcing the enforcement policy further comprising reporting a password uniqueness violation,
wherein the password uniqueness violation includes the one or more other PROs on which the password uniqueness violation is found, a user account on which the password uniqueness violation is found, and a violated password uniqueness policy.

5 . The method as recited in claim 1 , wherein a password of each different user account is stored in a password vault, and the password of each different user account is a hashed password, wherein each character of the password of each different user account is stored in the password vault, and each character of the password of each different user account is a hashed character.

6 . The method as recited in claim 1 , wherein the matching policy includes a partial match, wherein in the partial match, a predetermined number of characters of the first new password are the same as the predetermined number of characters of any password of each different user account associated with the one or more objects referenced by the one or more other PROs.

7 . The method as recited in claim 1 , wherein the first PRO includes a reference to the first object having a relationship with the first new password, wherein the first object is at least one of a local authentication repository, a centralized authentication repository, a user account, a group of user accounts, a file storing a list of passwords, a URL storing the list of passwords, and a database storing the list of passwords.

8 . The method as recited in claim 7 , wherein the centralized authentication repository is accessible via an authentication protocol including one of Lightweight Directory Access Protocol (LDAP), Remote Authentication Dial-In User Service (RADIUS), Terminal Access Controller Access Control System (TACACS+), Open Authorization (OAuth), and Security Assertion Markup Language (SAML).

9 . A computer program product for enforcing password uniqueness for different user accounts of a particular user, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:
receive a first new password from a first user account of the particular user, wherein the first user account is associated with a first object referenced by a first Password Relationship Object (PRO); evaluate a uniqueness policy to determine whether password uniqueness is required by one or more other PROs, wherein each object referenced by the one or more other PROs has a different user account of the particular user; if the password uniqueness is required by the one or more other PROs,
evaluate a matching policy to determine whether the first new password matches any password of each different user account associated with one or more objects referenced by the one or more other PROs; and
if there is a match,
enforce an enforcement policy.

10 . The computer program product as recited in claim 9 , wherein the processor is further caused to:
if there is a match, the step of enforcing the enforcement policy further comprising:
block the first new password;
request a second new password from the particular user;
evaluate the matching policy to determine whether the second new password matches any password of each different user account associated with the one or more objects referenced by the one or more other PROs, wherein the step of blocking to the step of checking are repeated until an acceptable new password does not match any password of each different user account associated with the one or more objects referenced by the one or more other PROs; and
store the acceptable new password for the first user account.

11 . The computer program product as recited in claim 10 , wherein the one or more other PROs are included in a Password Uniqueness Group (PUG).

12 . The computer program product as recited in claim 11 , wherein a password of each different user account is stored in a password vault, wherein the password of each different user account is a hashed password using a secret salt.

13 . The computer program product as recited in claim 9 , wherein the first user account has a different user name than the other user accounts of the particular user.

14 . The computer program product as recited in claim 9 , wherein the first PRO includes a reference to the first object having a relationship with the first new password, wherein the first object is at least one of a local authentication repository, a centralized authentication repository, a user account, a group of user accounts, a file storing a list of passwords, a URL storing the list of passwords, and a database storing the list of passwords.

15 . The computer program product as recited in claim 14 , wherein the centralized authentication repository is accessible via an authentication protocol including one of Lightweight Directory Access Protocol (LDAP), Remote Authentication Dial-In User Service (RADIUS), Terminal Access Controller Access Control System (TACACS+), Open Authorization (OAuth), and Security Assertion Ma

Assignees

• IBM

Inventors

• Tkaczyk Gregory M J H
• Rodriguez Mahecha Juan Hernan
• Padilha Krishna Oliveira De Hollanda

Classifications

• G06F21/46 Primary

  by designing passwords or checking the strength of passwords · CPC title

• G06F21/45 Primary

  Structures or tools for the administration of authentication · CPC title