Previous password based authentication

Illustrative embodiments provide a computer implemented method, a data processing system, and a computer program product for previous password based authentication. In one illustrative embodiment, the computer implemented method comprises obtaining a combination of an identifier and a password and determining whether the password is current and correct. The computer implemented method responsive to determining the password is other than current and correct, prompting for an old password and determining whether the old password matches a previous password. Responsive to the old password matching a previous password, thereby creating a password match, permitting access to a resource.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates generally to an improved data processing system, and in particular to a computer implemented method, an apparatus and a computer program product for previous password based authentication.

2. Description of the Related Art

In current data processing systems, rigorous password rules and good security policy require a user to change an associated password at predetermined intervals. The need to make changes based on this policy may be responsible for many help desk calls, especially in the time immediately following the changing of a password. Shortly after a password has been changed, many users cannot remember the new password and are unable to log into the desired systems. The changed password must then be reset. The resetting of a password is time consuming, expensive and may create an opportunity to compromise the user account using social engineering.

With the exception of highly secure sites, most web sites and user portals do not require a time based password change, thereby reducing the site's and the user's security to avoid the expense of the surge of help desk calls. In systems that require periodic changing of passwords, the expired passwords, or rather the hashed value representation, are typically kept and used by the system password routines to enforce no early re-use of a previously used password. The passwords, however, are often etched into the memory of a user since the user has typed the passwords many hundreds of times to access the desired systems. A way is required to exploit the memory of the previously used password.

SUMMARY OF THE INVENTION

Illustrative embodiments provide a computer implemented method, an apparatus in the form of a data processing system, and a computer program product for previous password based authentication. In one embodiment, the computer implemented method comprises obtaining a combination of an identifier and a password and determining whether the password is current and correct. Responsive to determining the password is other than current and correct, prompting for an old password. The computer implemented method determines whether the old password matches a previous password and responsive to the old password matching a previous password, creating a password match. Responsive to the password match permitting access to a resource.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

Illustrative embodiments provide a capability for a user on client110to reset a previously forgotten password. Once reset, the user is allowed access to a resource such as the system having server106through network102. The reset process is capable of being performed by the user using previously used passwords, without additional administrative assistance.

Memory206, in these examples, may be, for example, a random access memory or any other suitable volatile or non-volatile storage device. Persistent storage208may take various forms depending on the particular implementation. For example, persistent storage208may contain one or more components or devices. For example, persistent storage208may be a hard drive, a flash memory, a rewritable optical disk, a rewritable magnetic tape, or some combination of the above. The media used by persistent storage208also may be removable. For example, a removable hard drive may be used for persistent storage208.

As one example, a storage device in data processing system200is any hardware apparatus that may store data. Memory206, persistent storage208, and computer readable media218are examples of storage devices in a tangible form.

Illustrative embodiments provide a capability to a user on client110ofFIG. 1, having forgotten a recently changed password needed to access a resource, such as server106to proceed to reset the forgotten password using a previous password or combination of previously used passwords for validation. Client110may send a request to password services on server104through network102to verify the previously used password. Once verified, the user may reset the forgotten password to a new password and access server106.

With reference now toFIG. 3, a block diagram of a portion of components of a previous password based authentication process in accordance with illustrative embodiments is shown. Components of a previous password based authentication process are shown within memory206of system200ofFIG. 2. Other components as typically used within a data processing system, such as those previously described inFIG. 2are not further described. Password authentication makes use of a number of system modules or components of system security configuration300. Within system security configuration300exists security modules related to passwords, comprising authentication processor302, password database304, password generator306, password checker308, and password policies310.

Authentication processor302provides a set of services used by the system and system users to validate usage of or access to system controlled resources. A set is considered to be one or more items. For example, a set of services comprises one or more services, wherein the services are items of the set. The processor may be able to process data from various forms of input including badge readers, keyboards, and biometric sources. Password database304contains stored versions of object passwords, where an object may include a person or a file or other system managed resource. A password database may store current and previous passwords in a suitable form for comparison with entered passwords used during an authentication session.

Password generator306is a set of services required to receive input in various accepted forms for the purpose of creating a new password associated with an object. This generator may be able to create passwords in a variety of forms to suit the needs of the systems on which the service is provided. For example, the service may create a short eight character user identifier based password, and it may also be capable of creating a larger password for a file.

Password checker308provides a service that may be used by the authentication processor to compare an input from a user against a stored value of a current password. This is a typical process in many systems where a user is prompted to provide an identifier and a password before being allowed to access a system.

Password policies310contain a set of rules that define the extent to which a password must be created and managed. For example, the password form criteria listing the acceptable characters and combination of characters, as well as the duration of a password may be contained and managed within. The policies may also invoke other services of authentication processor302to inform users of the impending expiration of passwords.

With reference toFIG. 4, a block diagram of identifier and password combinations in accordance with illustrative embodiments is shown. In a first block, block400, an identifier402is shown in conjunction with a password404. Identifier402is typically a user ID, but may also be a resource name, such as a file or perhaps a device, such as a badge reader for a locked room. Password404is typically a user provided access code, but the password may also be provided by an application or service to verify permission to use a resource. Password404is a currently used, active password. Block400may also be representative of a portion of a user interface prompting a user to provide the user identifier and password for authentication purposes.

In second block406, another combination of identifier408with old password_1410, old password_2412and old password_n414is shown. The information content of block406differs from that of block400in that now there are more passwords and these are old, previously used passwords associated with the identifier. The number of old passwords required may be set by the password policies of the system.

When used as a portion of a user interface for user authentication, block406represents the input expected from a user before the user is allowed to proceed in a similar manner to that of block400.

With reference toFIG. 5, a flowchart of a previous password based authentication process in accordance with illustrative embodiments is shown. Previous password authentication process500is an example of a process of authentication processor302ofFIG. 3. Process500begins at start (step502) and prompts a user for an identifier and password combination (step504). An identifier and password combination is received in response to the prompt (step506). A determination is made as to whether the identifier just received is locked, preventing any access (step508). In addition to receiving in response to a prompt, the identifier and password combination may be obtained from other sources. Additional sources include reading from a file containing the identifier and passwords, a command line style of input or a script source providing programmatic input.

If the identifier in step508is locked, a “yes” is returned and process500terminates thereafter (step514). If a “no” was returned in step508, the identifier is usable and the password is checked to determine whether the password is current and correct by validating against the current password stored in the password database (step510). If the result of step510is “yes,” a welcome message is returned to the requesting user and process500terminates thereafter (step514). A “current” password is the active or recently changed password that is presently in effect, as opposed to an old or previous password that has been superseded by the “current” password. The “correct” term means the password has met installation standards and has been verified against the stored version of the password.

If a “no” result is obtained in step510, the password provided is old or incorrect and a prompt is issued for an old password (step516). The old password is obtained (step518) and a comparison is performed to determine if the old passwords match (step520). A password match occurs when the input password compares equal to the stored password. Depending upon the password policies, one or more old passwords may be required to satisfy the prompt for old passwords of step516. In the case of multiple old passwords, each provided old password is compared to a stored old password to determine a match. All passwords must match in accordance with the password policies. For example, if required to provide three old passwords A, B and C, then the provided old passwords would be compared to the stored old passwords of stored_A, stored_B and stored_C.

If the old passwords provided in step518match, a “yes” result is obtained from step520. If the passwords do not match, a “no” results in step520and a determination is made as to whether a maximum number of tries or attempts to access has been attained. If the maximum tries permitted has been attained, a “yes” results and a notification is provided to a requesting user (step526) and to a system administrator (step528) with process500terminating thereafter (step514).

If the maximum tries, or attempts, has not been attained, process500returns to start (step502) to begin the process again. If however a password match was obtained in step520, the requesting user has been authenticated using the old passwords and is allowed to create a new password in a self service manner (step522). In this case, the user has been checked and allowed access to a resource, such as the system, but is typically routed to a password create and update process before going on to perform other work. The user has thus obtained desired access to a resource and a help desk call has been avoided. The resource to which access has been granted may typically initially be a system. The system may then require the updating of the old password to a new password, as in the usual password update routine. Access may also be granted to other resources, such as a user specific password vault or files as may be useful to re-establish the user on a system.

Thus, the illustrative embodiments provide an opportunity for a user having forgotten a recently changed password to use one or more old previously used passwords to gain access to the desired system. The user is thus enabled to perform a password reset in a different manner, while still subject to security authentication, but avoiding the use of more costly help desk resources.

In an illustrative embodiment, a computer implemented method for previous password based authentication, is provided. The computer implemented method obtains a combination of an identifier and a password and determines whether the password is current and correct. Responsive to determining the password is other than current and correct, the computer implemented method prompts for an old password and determines whether the old password matches a previous password. Responsive to the old password matching a previous password, the computer implemented method creates a password match. Responsive to the password match, the computer implemented method permits access to a resource. The desired resource may be a data processing system, a program, a file, a device such as a printer or other form of access controlled resource.