Preventing password presentation by a computer system

A method, system or computer usable program product for preventing a password from being presented in a data entry field on a computer display including, responsive to user entry of a character set in the data entry field, comparing the character set to a securely stored password set for a potential match of the character set with leading characters of a password in the password set, responsive to detecting a match, inhibiting presentation of at least one character of the character set in the data entry field, and responsive to detecting a lack of a match, presenting the character set in the data entry field.

BACKGROUND

1. Technical Field

The present invention relates generally to managing password security for a computer system, and in particular, to a computer implemented method for preventing password presentation by a computer system.

2. Description of Related Art

Passwords are an intrinsic part of functioning within a computerized society. Computer systems often require that a user is authenticated or verified before the user is granted initial or continuing access. Often this authentication or verification is accomplished by requiring the user to enter a username and a password, each composed of a string of characters, known to both the computer system and the user.

Computer systems requiring authentication or verification may be computer devices and/or computer software applications. A computer device requiring a password may be a server, desktop computer, laptop, mobile phone, smart phone, or other type of stationary, portable or mobile device. A computer software application requiring a password for access may be an operating system, browser, website, software program, or other type of software such as a smart phone application.

Often a password is not displayed when it is being typed to prevent others in the vicinity from viewing that password, thereby maintaining the confidentiality of the password. Instead of displaying the password, often a dot, asterisk, or other character may be displayed in the password field as the password is being typed. Because the username may be less secure and to allow the user to verify what he or she is typing, the username may be displayed when being typed. However, if the user accidentally types their password in a displayed username field, then the password will be displayed and may be viewed by anyone within eyeshot of the user's display.

Some software applications and browsers utilize an autocomplete feature for providing and displaying previously submitted text in data entry fields such as the username field. However, if a user previously typed a password in the username field, then the password may be displayed by the autocomplete feature. For example, if the user types their username, fails to press the tab key, and types their password, then the password will be displayed alongside their username. In addition, with the autocomplete feature enabled, that combination may be displayed every time the user starts to type their username in the username field.

SUMMARY

The illustrative embodiments provide a method, system, and computer usable program product for preventing a password from being presented in a data entry field on a computer display including, responsive to user entry of a character set in the data entry field, comparing the character set to a securely stored password set for a potential match of the character set with leading characters of a password in the password set, responsive to detecting a match, inhibiting presentation of at least one character of the character set in the data entry field, and responsive to detecting a lack of a match, presenting the character set in the data entry field.

DETAILED DESCRIPTION

Steps may be taken to prevent the display or presentation of a password, even if the password is typed outside the password field. These steps may be taken as will be explained with reference to the various embodiments below.

FIG. 1depicts a pictorial representation of a network of data processing systems in which various embodiments may be implemented. Data processing environment100is a network of data processing systems also known as computers or computer devices in which the embodiments may be implemented. Software applications may execute on any computer or other type of data processing system in data processing environment100. Data processing environment100includes network110. Network110is the medium used to provide communications links between various devices and computers connected together within data processing environment100. Network110may include connections such as wire, wireless communication links, or fiber optic cables.

Servers120and122and clients140and142are coupled to network110along with storage unit130. In addition, laptops150and152are coupled to network110including wirelessly through a network router154. A mobile phone160is also coupled to network110through a mobile phone tower162. Data processing systems, such as server120and122, client140and142, laptops150and152, and mobile phone160, may contain data and may have software applications including software tools executing thereon. Other types of data processing systems such as personal digital assistants (PDAs), smartphones, tablets and netbooks may be coupled to network110.

Storage130may include login monitor136and password repository138for managing password security for the various computer devices or software applications in accordance with embodiments described herein. Client140may include software application144, login monitor146and password repository148. Laptop150and mobile phone160may also include software applications154and164, login monitors156and166, and password repositories158and168. Other types of data processing systems coupled to network110may also include software applications and security utilities. Software applications could include a web browser, email, or other software application that can process a web page, email, or other type of information to be processed.

Servers120and122, storage unit130, clients140and142, laptops150and152, and mobile phone160and other data processing devices may couple to network102using wired connections, wireless communication protocols, or other suitable data connectivity. Clients140and142may be, for example, personal computers or network computers.

In the depicted example, server120may provide data, such as boot files, operating system images, and applications to clients140and142and laptop150. Clients140and142and laptop150may be clients to server120in this example. Clients140and142, laptops150and152, mobile phone160, or some combination thereof, may include their own data, boot files, operating system images, and applications. Data processing environment100may include additional servers, clients, and other devices that are not shown.

Among other uses, data processing environment100may be used for implementing a client server environment in which the embodiments may be implemented. A client server environment enables software applications and data to be distributed across a network such that an application functions by using the interactivity between a client data processing system and a server data processing system. Data processing environment100may also employ a service oriented architecture where interoperable software components distributed across a network may be packaged together as coherent business applications.

FIG. 2depicts a block diagram of a data processing system in which various embodiments may be implemented. Data processing system200is an example of a computer device, such as server120, client140, laptop150or mobile phone160inFIG. 1, in which computer usable program code or instructions implementing the processes may be located for the illustrative embodiments.

In the depicted example, data processing system200includes a CPU or central processing unit210which may contain one or more processors and may be implemented using one or more heterogeneous processor systems including a graphics processor. The depicted example also includes a memory220which may be used for storing instructions and data to be processed by CPU210. Memory220may include a main memory composed of random access memory (RAM), read only memory (ROM), or other types of storage devices. Memory210could also include secondary storage devices such as a hard disk drive, DVD drive or other devices which may be internal or external to data processing system200. An input output device (I/O)230is also shown in the depicted example for managing communications with various input devices and output devices. However, other examples could use the CPU to communicate directly with various input or output devices or use separate input and output controllers.

In the depicted example, a computer display240is shown for the data processing system to communicate with a user or another data processing system. Other types of output devices may be used such as an audio device. An input device250is also shown which may be a keyboard, mouse, a touch sensitive display, or other types of input devices.

Data processing system200is shown with an internal section205and an external section206. Often input and output devices may be physically separate from but connected to the CPU and memory. However, that is often not the case with portable devices such as mobile phones.

An operating system may run on processor210. The operating system coordinates and provides control of various components within data processing system200inFIG. 2. The operating system may be a commercially available operating system. An object oriented programming system may run in conjunction with the operating system and provides calls to the operating system from programs or applications executing on data processing system200. Instructions for the operating system, the object-oriented programming system, and applications or programs may be located on secondary storage devices such a hard drive, and may be loaded into RAM for execution by processing unit210.

The hardware inFIGS. 1-2may vary depending on the implementation. Other internal hardware or peripheral devices, such as flash memory, equivalent non-volatile memory, or optical disk drives and the like, may be used in addition to or in place of the hardware depicted inFIGS. 1 and 2. In addition, the processes of the embodiments may be applied to a multiprocessor data processing system.

The depicted examples inFIGS. 1-2and above-described examples are not meant to imply architectural limitations. For example, data processing system200may also be a mobile phone160, tablet computer, laptop computer, or telephone device.

FIG. 3depicts a block diagram of software and data stored in a data processing system memory in which various embodiments may be implemented. In a data processing system memory300, various software applications may be used by the data processing system for initializing (booting) and running the data processing system. These software programs may be located in the local memory of the data processing system or in the memory of other connected data processing systems such as memory storage of a server.

A BIOS310may be used for initializing the data processing system and for various base functions. BIOS (basic input/output system is typically stored in a local non-volatile memory such as ROM or flash memory on a data processing system motherboard. An operating system (O/S)320is used for managing the various computer hardware resources and provides common services for efficient execution of application software. Software applications330may be used to perform singular or multiple related specific tasks or functions. An example of a software application would be an internet browser, spreadsheet program, email application, video game, or other function.

Login monitor340may be used to manage password entry for the data processing system in accordance with the various embodiments described below. Login monitor may be called or invoked by each of the types of software shown herein. That is, BIOS310may invoke login monitor340during system initialization. O/S320may invoke login monitor340upon certain conditions such as when the system is turned on (after BIOS has initialized the system) or when the user attempts to start any application. Any application330may also invoke login monitor340such as when the application is first started by the user. Login monitor may also be incorporated in any of the software used by the data processing system. For example, login monitor340could be included as part of BIOS310, O/S320, or any application330.

Login monitor340may utilize a password repository350stored in memory. A password repository may be created by a software application, such as an internet browser, or it may be system wide across multiple software applications. For example, a software application such as an internet browser may utilize a password repository for storing any passwords utilized by that internet browser. This could include passwords for various internet sites that a user may access using the internet browser such as a social networking site, an on-line banking site, a travel planning site, or any other site that may utilize a password. In addition, modern operating systems contain a password repository or vault which allows for the secure storage of a large number of passwords for a large number of applications and may be unlocked using one master password. Password repository350may be managed by an operating system and utilized by multiple types of software applications including BIOS310, O/S320, as well as various software applications that may be utilized by the data processing system. A password repository may be stored anywhere on the data processing system or in a location accessible by the system such as a server. A password repository may be stored in multiple locations such as with a collection of password repositories which may be treated a collective password repository.

Login monitor340may also utilize a username or userid repository360stored in memory. Username repository360may be stored in any data processing system memory similar to the password repositories shown inFIG. 1. A username repository may be created by a software application, such as an internet browser, or it may be system wide across multiple software applications. For example, a software application such as an internet browser may utilize a username repository for storing any username utilized by that internet browser. This could include usernames for various internet sites that a user may access using the internet browser. Username repository360may be managed by an operating system and utilized by multiple types of software applications including BIOS310, O/S320, as well as various software applications that may be utilized by the data processing system. A username repository may be stored anywhere on the data processing system or in a location accessible by the system such as a server. A username repository may be stored in multiple locations such as with a collection of username repositories which may be treated a collective username repository.

FIG. 4depicts a flowchart of the operation of the login monitor in which a first embodiment may be implemented. In this embodiment, characters entered in the username field of a login page may not be displayed or otherwise presented if those characters match known passwords. Alternative embodiments may implement this process with data entry fields other than the username field. In an additional alternative embodiment, the password field may be excluded from the data entry fields implementing this first embodiment.

In step400, the system detects that a user has typed or otherwise entered a character or character set in a username field such as for logging into a software application, webpage or other similar item. A character set may be one or multiple characters. This detection may be performed by the login monitor or it may be performed by another software application which calls or invokes the login monitor. The character set detected may be an alphabetic letter, a number, a special character, a combination thereof, or any other item which the user may enter into a username field.

In step410, the login monitor determines whether the character set matches the first or leading character(s) of any password in a password repository such as is described with reference toFIG. 3above. If the character set does not match the first or leading character(s) of any password in the password repository, then processing continues to step420, otherwise processing continues to step430in case of a match.

In step420, the character set that was typed or otherwise entered by the user is displayed or otherwise presented because it does not match the first or leading character(s) of any password. This allows a user to see what characters have been entered. Processing then continues to step490where processing login monitoring ends.

In case of a match in step410, then in step430the character set entered by the user is not presented and processing continues to step440. In an alternative embodiment, the first character entered by the user may be presented even though it matches the first character of a password in step410. This is to allow the user to see that characters other than a username have been entered. In addition, it would make it more difficult for an unauthorized person to slowly enter various characters to find a password by watching to see what characters may not be presented. In another alternative embodiment, a random number of characters matching a password may be presented. This would also help prevent an unauthorized person from slowly entering various characters to find a password.

In step440, a subsequent character or character set is received and combined or concatenated with the previous character set entered by the user into a new character set. The concatenated characters are then compared to the leading characters of the passwords in the password repository in step450. If the concatenated string of characters matches the starting or leading characters of any password, including any whole password, then processing returns to step430. However, if there is no match, then processing continues to step460.

In step460of the first embodiment, the string of characters may then be presented slowly, one character at a time. This is to help make it appear that the reason the characters were not presented was due to a slow system. The first character may be presented quickly to minimize the time before any characters are presented. However, subsequent characters should be presented more slowly, preferably in a somewhat random internals of time. Processing them continues to step490.

FIG. 5depicts a flowchart of the operation of the login monitor in which a second embodiment may be implemented. In this embodiment, passwords may be hidden from view or otherwise not presented even if the user previously entered other characters in the username entry field. As with the first embodiment, alternative embodiments may implement this process with data entry fields other than the username field. In an additional alternative embodiment, the password field may be excluded from the data entry fields implementing this second embodiment.

In step500, the system detects that a user has typed or otherwise entered a character or character set in a username field. A character set may be one or multiple characters. This detection may be performed by the login monitor or it may be performed by another software application which calls or invokes the login monitor. The character set detected may be an alphabetic letter, a number, a special character, a combination thereof, or any other item which the user may enter into a username field.

In step510, the login monitor determines whether the character set matches the first or leading character(s) of any password in a password repository. As with the first embodiment, this password repository may be created by the software application, such as an internet browser, or it may be system wide across multiple software applications. If the character set does not match the first or leading character(s) of any password in the password repository, then processing continues to step520, otherwise processing continues to step540in case of a match.

In step520, the character set that was typed or otherwise entered by the user may be presented because it does not match the first or leading characters of any password. Processing then continues to step530where the next character set may be received. Once received, the processing returns to step510to determine whether that subsequent character set may match the first or leading characters of any password in the password repository.

In case of a match in step510, then in step540the matching character set entered by the user may not be presented with processing continues to step550. In an alternative embodiment, the first character entered by the user may be presented even though it matches the first character of a password in step510. This is to allow the user to see that characters other than a username have been entered. In addition, it would make it more difficult for an unauthorized person to slowly enter various characters to find a password by watching to see what characters may not be presented. In another alternative embodiment, a random number of characters matching a password may be presented. This would also help prevent an unauthorized person from slowly entering various characters to find a password.

In step550, a subsequent character set is then received and combined or concatenated with the previous character set entered by the user. The combined characters are then compared to passwords in the password repository in step560. If the combined string of characters matches the starting characters of any password, including any whole password, then processing returns to step540. However, if there is no match, then processing continues to step570.

In step570, the string of characters may then be presented slowly, one character at a time. As with the first embodiment, this is to help make it appear that the reason the characters were not presented was due to a slow system.

FIG. 6depicts a flowchart of the operation of the login monitor in which a third embodiment may be implemented. In this embodiment, characters entered in the username field of a login page may not be displayed or otherwise presented if those characters match known passwords. Alternative embodiments may implement this process with data entry fields other than the username field. In an additional alternative embodiment, the password field may be excluded from the data entry fields implementing this third embodiment.

In step600, the system detects that a user has typed or otherwise entered a character or character set in a username field such as for logging into a software application, webpage or other similar item. A character set may be one or multiple characters. This detection may be performed by the login monitor or it may be performed by another software application which calls or invokes the login monitor. The character set detected may be an alphabetic letter, a number, a special character, a combination thereof, or any other item which the user may enter into a username field.

In step605, the login monitor determines whether the character set matches the first or leading character(s) of any username in a username repository such as is described with reference toFIG. 3above. If the character set does not match the first or leading character(s) of any username in the username repository, then processing continues to step630, otherwise processing continues to step610in case of a match.

In step610, the character set that was typed or otherwise entered by the user is displayed or otherwise presented because it matches the first or leading character(s) of a username. This allows a user to see what characters have been entered. Processing then continues to step615for receiving another character. Once a character is received, then in step620the set of characters received so far are compared to the usernames in the username repository. If there is a match, then processing returns to step610, otherwise processing continues to step630.

In case of no match in step605or620, then in step630the login monitor determines whether the character set (not including the characters matching a complete username name in previous steps) matches the first or leading character(s) of any password in a password repository such as is described with reference toFIG. 3above. If the character set does not match the first or leading character(s) of any password in the username repository, then processing continues to step650, otherwise processing continues to step635in case of a match.

In step635, because the character set match at least a leading portion of a password, those characters may not be displayed. However, in this embodiment, a blinking question mark or other symbol may be displayed instead. In an alternative embodiment, a pop up box or other method may be used to query the user about the characters being entered such as “Are you sure you are entering the username?”. In another alternative embodiment, the character set entered by the user may be presented even though it matches the leading character(s) of a password in step630. This is to allow the user to see that characters other than a username have been entered. In addition, it would make it more difficult for an unauthorized person to slowly enter various characters to find a password by watching to see what characters may not be presented. In another alternative embodiment, a random number of characters matching a password may be presented. This would also help prevent an unauthorized person from slowly entering various characters to find a password.

In step640, a subsequent character or character set is received and combined or concatenated with any previous character sets entered by the user into a new character set. This concatenation should not include any characters that matched a username in steps605or620above. The concatenated characters are then compared to the leading characters of the passwords in the password repository in step645. If the concatenated string of characters matches the starting or leading characters of any password, including any whole password, then processing returns to step635. However, if there is no match, then processing continues to step650.

In step650of the third embodiment, the string of characters may then be presented slowly, one character at a time. This is to help make it appear that the reason the characters were not presented was due to a slow system. The first character may be presented quickly to minimize the time before any characters are presented. However, subsequent characters should be presented more slowly, preferably in a somewhat random internals of time. These characters may be blinking in an alternative embodiment. Processing them continues to step655for receiving the next character entered by the user in the data field. Once received, then processing returns to step630.

FIG. 7depicts a flowchart of various password hacking prevention processes in which various embodiments may be implemented. An unauthorized user of a computer may attempt to use the above described embodiments to identify one or more passwords stored in a password repository. As a result, various techniques may be used to prevent such an occurrence.

In a first step710, the system may determine whether the feature is being used in a username field or other data entry field associated with a system password. This could be an initial logon to the system or it could be when the system is being awoken up from a sleep mode. If that is the case, then processing continues to step780where the password protection feature is suspended, turned off, discontinued, or otherwise temporarily disabled. This suspension may continue until the condition causing the suspension has changed. For example, in the case of a system password being entered upon logon or after the system has been awoken from a sleep mode, the password protection feature may be turned on after the system password has been entered correctly. Processing then ends in step790until the user attempts to enter characters into another username or other data entry field.

If the user is not attempting to enter a system password, then processing continues to step720. In step720, the system determines whether the ambient noise levels around the user, then processing continues to step730. If ambient noise levels are high, then there is a strong likelihood that the user is in an environment where other persons are nearby such that the password security feature is needed. In such an environment with other persons present, it is less likely that an unauthorized user may be trying to determine passwords stored in the password repository. If ambient noise levels are low, then there is a lower likelihood that other persons are nearby, thereby limiting the need for password protection features.

In step730, if ambient noise levels are low or below a certain threshold, then processing continues to step680for disabling the password protection feature, otherwise processing continues to step740. In step780, the password protection feature may be suspended until the ambient noise has reduced to a certain threshold. The ambient noise threshold may be preset such as by a programmer of software implementing an embodiment. The ambient noise threshold may also be set by the user or an administrator of a network of systems implementing embodiments.

In step740, the character set entered by the user in a username or other data entry field may be compared with certain patterns to help determine whether an unauthorized user may be attempting to identify passwords. Such patterns could be alphabetic (e.g. A B C D E or Q W E R T Y) or numeric (e.g. 1 2 3 4 5) or combinations thereof (e.g. A 1 B 2) or other patterns. In addition, if the user types a character set then backspaces and enters another character set repeatedly, then an unauthorized user may be using the system. Processing then continues to step750to determine whether a pattern has been found. If yes, then processing continues to step780, otherwise to step790. In this case, the password protection feature may be turned off until the system password has been correctly entered.

Other methods of determining whether an unauthorized user may be using the system may be implemented. In addition, other methods of determining whether other persons besides the user entering data are present may be implemented. If an unauthorized user is present or if no other person besides the person entering data is present, then the password protection feature may be disabled.

The invention can take the form of an entirely software embodiment, or an embodiment containing both hardware and software elements. In a preferred embodiment, the invention is implemented in software or program code, which includes but is not limited to firmware, resident software, and microcode.

Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing. Further, a computer storage medium may contain or store a computer-readable program code such that when the computer-readable program code is executed on a computer, the execution of this computer-readable program code causes the computer to transmit another computer-readable program code over a communications link. This communications link may use a medium that is, for example without limitation, physical or wireless.

A data processing system may act as a server data processing system or a client data processing system. Server and client data processing systems may include data storage media that are computer usable, such as being computer readable. A data storage medium associated with a server data processing system may contain computer usable code such as the login monitor. A client data processing system may download that computer usable code, such as for storing on a data storage medium associated with the client data processing system, or for using in the client data processing system. The server data processing system may similarly upload computer usable code from the client data processing system such as a password repository. The computer usable code resulting from a computer usable program product embodiment of the illustrative embodiments may be uploaded or downloaded using server and client data processing systems in this manner.