Incorrect password management

Patent metadata

Field	Value
Publication number	US-9699173-B1
Application number	US-201514719419-A
Country	US
Kind code	B1
Filing date	May 22, 2015
Priority date	May 22, 2015
Publication date	Jul 4, 2017
Grant date	Jul 4, 2017

Abstract

The management of credentials subject to a lockout policy can include dynamically determining appropriate lockout thresholds and other such values appropriate for a current situation. For example, the number of incorrect password attempts allowed before an account lockout can be based at least in part upon the amount of time that has passed since a most recent password change. There might be an unlimited number of attempts allowed for a short period after a password change, followed by a decreasing number of permissible attempts over a subsequent period of time. In some embodiments the number of correct attempts received after a password change can affect the number of incorrect attempts allowed. Further, if an incorrect attempt matches a previously correct password then that attempt might not count toward the number of incorrect attempts compared against the threshold, at least for a determined period of time after a password change.

First claim

What is claimed is:

1. A system, comprising:
at least one processor;
at least one computing resource; and
memory including instructions that, when executed by the at least one processor, cause the system to:
receive a request requiring access to the at least one computing resource provided by a resource provider, the request including a request password and being associated with an account of a customer of the resource provider;
determine that the request password differs from a current password for the account;
determine a number of submissions of the current password since the current password was activated for the account;
determine, based at least in part upon the number of submissions, an incorrect attempt threshold for the account, the incorrect attempt threshold decreasing based on the time since the current password was activated;
utilize a threshold determination function to determine the incorrect attempt threshold, the threshold determination function causing a value of the incorrect attempt threshold to decrease over a determined period of time according to at least one of a linear function, an exponential function, or a step function;
determine an amount of time since the current password was activated for the account, wherein the threshold determination function further causes the value of the incorrect attempt threshold to be reduced by an amount proportional to the number of submissions of the current password since the current password was activated for the account; and
determine whether to lock access to the at least one computing resource based at least in part upon whether a number of incorrect passwords received for the account, including the request password, exceeds the incorrect attempt threshold.

2. The system of claim 1 , wherein the instructions when executed further cause the system to:
allow access to the at least one computing resource in response to the request being received within an initial period of time after the current password was activated.

3. A computer-implemented method, comprising:
receiving a request for access to a resource, the request associated with a user account and indicating a request password to be used to obtain the access;
determining, using at least one processor of a computer system, that the request password differs from a current password, associated with the user account, for obtaining the access to the resource;
determining, using the at least one processor, a length of time that has passed since the current password was activated for the user account;
determining, using the at least one processor, a current value of an incorrect attempt threshold for the user account based at least in part upon the length of time, the current value determined according to a threshold determination function that decreases a number of attempts specified by the incorrect attempt threshold based on the time since the current password was activated according to at least one of a linear function, an exponential function, or a step function, wherein the threshold determination function further causes the value of the incorrect attempt threshold to be reduced by an amount proportional to a number of submissions of the current password since the current password was activated for the account; and
determining, using the at least one processor, whether to lock out access to the resource, associated with the user account, based at least in part upon whether the receipt of the request password with the request causes a number of incorrect password submissions to exceed the current value of the incorrect attempt threshold.

4. The computer-implemented method of claim 3 , further comprising:
determining that the request password corresponds to a previously correct password for access to the resource associated with the user account; and
preventing the receipt of the request password with the request from counting as an incorrect password submission.

5. The computer-implemented method of claim 3 , further comprising:
determining a number of correct password submissions received since the current password was activated, wherein the threshold determination function reduces the value of the incorrect attempt threshold based at least in part upon the number of correct password submissions.

6. The computer-implemented method of claim 3 , further comprising:
causing the incorrect attempt threshold to be set to a fixed value after a period of decreasing threshold values determined according to the threshold determination function.

7. The computer-implemented method of claim 3 , further comprising:
selecting the threshold determination function from a plurality of determination functions based at least in part upon at least one of a type of user, a type of user account, a type of resource, or a type of access for the request.

8. The computer-implemented method of claim 3 , wherein the resource includes at least one of a computing resource or a data storage resource.

9. The computer-implemented method of claim 3 , further comprising:
receiving a subsequent request for access to the resource, the subsequent request associated with the user account and indicating a second request password to be used to obtain access;
determining, using the at least one processor of a computer system, that the second request password differs from the current password;
determining, using the at least one processor, a second length of time that has passed since the current password was activated for the user account;
determining, using the at least one processor, a second current value of the incorrect attempt threshold based at least in part upon the second length of time; and
determining to lock out the access for the user account for a least a period of time in response to the receipt of the second request password causing the number of incorrect password submissions to exceed the second current value of the incorrect attempt threshold.

10. The computer-implemented method of claim 3 , further comprising:
receiving a subsequent request for access to the resource, the subsequent request associated with the user account and indicating a second request password to be used to obtain access;
determining, using the at least one processor of a computer system, that the second request password corresponds to the current password; and
granting the access associated with the request.

11. The computer-implemented method of claim 3 , further comprising:
determining a type of password submission behavior associated with the user account, the current value being determined according to the threshold determination function based further in part upon the type of password submission behavior.

12. The computer-implemented method of claim 3 , further comprising:
enabling an administrator of the resource to select a security setting for the resource, the security setting determining the threshold determination function to be used to determine the current value of the incorrect attempt threshold.

13. The computer-implemented method of claim 3 , further comprising:
granting access to the resource in response to (1) the request being received within an initial period of time after the current password being activated and (2) the request password corresponding to a previously correct password.

14. The computer-implemented method of claim 3 , further comprising:
specifying a set of threshold values for the incorrect attempt threshold, wherein the set of threshold values includes a maximum number of incorrect password submissions and a maximum number of submissions of a previously valid password.

Assignees

• Amazon Tech Inc

Inventors

• Roth Gregory Branchek

Classifications

• G06F21/45

  Structures or tools for the administration of authentication · CPC title

• G06F2221/2131

  Lost password, e.g. recovery of lost or forgotten passwords · CPC title

• H04L63/0846

  using time-dependent-passwords, e.g. periodically changing passwords · CPC title

• G06F21/31 Primary

  User authentication · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title