Vault password controller for remote resource access authentication

A computer-implemented method for authenticating a request to access a remote resource includes identifying a request from a first device to access a resource located on a second device. The computer-implemented method further includes retrieving one or more encrypted passwords for authenticating access to the resource from a partition of a vault located on the first device. The computer-implemented method further includes comparing the one or more encrypted passwords retrieved from the partition of the vault located on the first device to one or more designated passwords stored on the second device. The computer-implemented method further includes granting the first device access to the resource located on the second device based, at least in part, on the one or more encrypted passwords retrieved from the partition of the vault located on the first device matching the one or more designated passwords stored on the second device.

BACKGROUND

The present invention relates generally to the field of authentication management, and more particularly to authentication management using password vaults.

Authentication is the process of verifying the identity of a person or device. A common example of an authentication method is entering an email address and password to log into an email account. Entering the correct login information lets the mail server know who you are and that it is actually you that is accessing the server. While a username/password combination is a common way to authenticate ones identify, may other types of authentication exist. For example, you may use a four or six digit passcode to unlock your phone.

While authentication helps to keep personal information private, it is not foolproof. For example, if someone knows your email address, he or she can gain access to your account by simply guessing your password. This is why is it is important to use uncommon, hard-to-guess passwords, that contain a mixture of uppercase and lowercase letters, numbers, and special characters. In order to provide an extra layer of security, the use of multi-factor authentication (i.e., two-factor authentication) can be used. Two-factor authentication typically requires a correct login password plus another form of verification. For example, if you enable two-factor authentication for access to your online bank account, you may be required to enter a temporary code sent to your mobile device or email account to complete the login process. This ensures that only you (or someone with access to your mobile device or email account) can access your bank account, even after entering the correct login information.

A password vault or password manager is a software program that allows users to store, generate, and manage their passwords for multiple applications, online services, and resources in a secure location. A password manager assists in generating and retrieving complex passwords, storing such passwords in an encrypted database or calculating them on demand. Depending on the type of password manager used, the encrypted password vault for storing passwords is either stored locally on a user's device or stored remotely through an online file-hosting service. Typically, users can access the password vault via a single username and password. For example, a user may only be required to generate and remember a “master” password to unlock the password vault. Upon successfully unlocking the password vault, the user is provided with the password for a device, application, service, or resource that the user is trying to access.

SUMMARY

According to one embodiment of the present invention, a computer-implemented method for authenticating a request to access a remote resource is disclosed. The computer-implemented method includes identifying a request from a first device to access a resource located on a second device. The computer-implemented method further includes retrieving one or more encrypted passwords for authenticating access to the resource from a partition of a vault located on the first device. The computer-implemented method further includes comparing the one or more encrypted passwords retrieved from the partition of the vault located on the first device to one or more designated passwords stored on the second device. The computer-implemented method further includes granting the first device access to the resource located on the second device based, at least in part, on the one or more encrypted passwords retrieved from the partition of the vault located on the first device matching the one or more designated passwords stored on the second device.

According to another embodiment of the present invention, a computer program for authenticating a request to access a remote resource is disclosed. The computer program product includes one or more computer readable storage media, and program instructions stored on the one or more computer readable storage media. The program instructions include instructions to identify a request from a first device to access a resource located on a second device. The program instructions further includes instructions to retrieve one or more encrypted passwords for authenticating access to the resource from a partition of a vault located on the first device. The program instructions further include instructions to compare the one or more encrypted passwords retrieved from the partition of the vault located on the first device to one or more designated passwords stored on the second device. The program instructions further include instructions to

grant the first device access to the resource located on the second device based, at least in part, on the one or more encrypted passwords retrieved from the partition of the vault located on the first device matching the one or more designated passwords stored on the second device.

According to another embodiment of the present invention, a computer system for authenticating a request to access a remote resource is disclosed. The computer system includes one or more computer processors, one or more computer readable storage media, and program instructions stored on the one or more computer readable storage media for execution by the one or more computer processors. The program instructions include instructions to identify a request from a first device to access a resource located on a second device. The program instructions further includes instructions to retrieve one or more encrypted passwords for authenticating access to the resource from a partition of a vault located on the first device. The program instructions further include instructions to compare the one or more encrypted passwords retrieved from the partition of the vault located on the first device to one or more designated passwords stored on the second device. The program instructions further include instructions to grant the first device access to the resource located on the second device based, at least in part, on the one or more encrypted passwords retrieved from the partition of the vault located on the first device matching the one or more designated passwords stored on the second device.

DETAILED DESCRIPTION

Embodiments of the present invention are generally related to the field of authentication management, and more particularly to authentication management using password vaults.

Password vaults offer numerous advantages with respect to authentication management. Password vaults enable users to store longer, more secure passwords without the burden of having to remember each password and the particular password associated with an account. For example, an organization may require stricter password requirements, in which employees are required to have separate passwords for access to different resources, frequently change their passwords, use random characters, and increase the length of their passwords. Since these more complex passwords are harder to remember, all of the passwords can be stored in an encrypted, centralized password vault. Password managers can also be used as a defense against phishing by incorporating an automated login script that first compares the current site's URL to the stored site's URL. If the two do not match, then the password manager does not automatically fill in the login fields. This is intended as a safeguard against visual imitations and look-alike websites. Similarly, password managers can also protect against keystroke logging malware (i.e., keyloggers). For example, when using a multi-factor authentication password manager that automatically fills in login fields, the user does not have to type any user names or passwords that a keylogger may pick up.

However, embodiments of the present invention recognize that password vaults can also introduce numerous disadvantages. Some password managers use a user-selected master password or passphrase to form the key used to encrypt the passwords contained in the password vault. However, the security of this approach depends on the strength of the chosen password. Even if the password is fairly secure, the password may still be discoverable based on password spraying or brute-force attacks. Similarly, even a very secure password may still be discoverable if a user happens to also store the master password or passphrase locally where a malicious program or individual can read it. Since it is likely that a password vault contains a number of different passwords used to access various applications, user accounts, and secure resources, a compromised master password renders all of the protected passwords stored in the password vault vulnerable. Once a hacker obtains the master password, it is easy for them to remotely access a user's accounts.

Embodiments of the present invention improve upon the foregoing deficiencies of current password vaults by providing an adaptable, policy driven mechanism for authenticating a user or device via a novel password vault. In an embodiment, a separate vault is created and stored locally on each device, such as a smartphone, tablet, or laptop, that a user may use to access a resource. Each vault is divided into a plurality of partitions, in which each partition is associated with a particular resource host. Unlike current vaults in which user generated passwords are stored, the passwords stored in the respective partitions of the vault in accordance with embodiments of the present invention are encrypted and controlled by the resource hosts.

In an embodiment, a user initiates an authentication request by opening the password vault with their master PIN, password, or passphrase. Upon successfully opening the password vault, selection of a particular account associated with a resource host results in the resource host being prompted to initiate an authentication request for the user. Initiating the authentication request by the resource host includes selecting one or more passwords from a partition of the vault associated with the selected account based on a vault policy. In various embodiments, the vault policy is owned and controlled by the resource host and provides for which encrypted passwords should be selected from a vault partition in order to authenticate the user. The one or more encrypted passwords selected from a vault partition along with the user identification (ID) of the account stored in the vault is used to authenticate the user by comparing the selected encrypted passwords to a list of passwords authorized by the resource host. Upon successful authentication of the user, the user is granted access to the resource.

Accordingly, embodiments of the present invention may include one or more of the following features, characteristics, and/or advantages: (i) a hacker would need access to the vault in order to steal a password, which provides an extra layer of protection; (ii) a system in which account User IDs and passwords are controlled by the resource host and not the user; (iii) the use of long, secure passwords or a combination of secure passwords (of unlimited length) without having to remember or manually type any passwords that a keylogger may detect; (iv) authentication of user accounts in which the user does not know any of the passwords contained in the vault and thus, cannot accidently divulge passwords or inadvertently store unprotected passwords locally on their device; (v) an ability of the resource host to frequently and randomly change or disable the passwords stored in the vault to increase security without requiring any action on the part of the user; (vi) access to remote user accounts using passwords that are unique to the device that is used to access the account; (vii) a dynamic vault policy that allows for a different password or combination of passwords stored in the vault to be used for authenticating a user each time an authentication request is initiated; and (viii) a user generated vault PIN for use by a resource host to allow the resource host access to a partition in order to change, update, render inactive, or modify passwords and vault policies stored in a vault partition.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting. Notwithstanding, several definitions that apply throughout this document now will be presented.

As defined herein, the singular forms “a,” “an,” and “the” include the plural forms as well, unless the context clearly indicates otherwise.

As defined herein, “another” means at least a second or more.

As defined herein, “automatically” and “dynamically” mean without user intervention.

As defined herein, “if” means “in response to” or “responsive to,” depending upon the context. Thus, the phrase “if it is determined” may be construed to mean “in response to determining” or “responsive to determining” depending on the context. Likewise, the phrase “if [a stated condition or event] is detected” may be construed to mean “upon detecting [the stated condition or event]” or “in response to detecting [the stated condition or event]” or “responsive to detecting [the stated condition or event]” depending on the context.

As defined herein, “one embodiment,” “an embodiment,” “in one or more embodiments,” “in particular embodiments,” or similar language mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment described within this disclosure. Thus, appearances of the aforementioned phrases and/or similar language throughout this disclosure may, but do not necessarily, all refer to the same embodiment.

As defined herein, the phrases “in response to” and “responsive to” mean responding or reacting readily to an action or event. Thus, if a second action is performed “in response to” or “responsive to” a first action, there is a causal relationship between an occurrence of the first action and an occurrence of the second action. The phrases “in response to” and “responsive to” indicate the causal relationship.

As defined herein, “user” and “individual” each refer to a human being.

As defined herein, a “resource” means any physical or virtual hardware, software, computer data, or information that can be accessed by an individual or device, such as client device110.

As defined herein, a “resource host” means any physical or virtual computer connected to a computer network that offers access to resources to other individuals or devices connected to the computer network.

Referring now to various embodiments of the invention in more detail,FIG.1is a functional block diagram of a network computing environment, generally designated100, suitable for operation of a vault manager program101in accordance with at least one embodiment of the invention.FIG.1provides only an illustration of one implementation and does not imply any limitations with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made by those skilled in the art without departing from the scope of the invention as recited by the claims.

Network computing environment100includes client device110, host device120, and password vault130interconnected over network140. In various embodiments of the present invention, network140can be a telecommunications network, a local area network (LAN), a wide area network (WAN), such as the Internet, or a combination of the three, and can include wired, wireless, or fiber optic connections. Network140may include one or more wired and/or wireless networks that are capable of receiving and transmitting data, voice, and/or video signals, including multimedia signals that include voice, data, and video information. In general, network140may be any combination of connections and protocols that will support communications between client device110, host device120, password vault130, and other computing devices (not shown) within network computing environment100.

Client device110can represent a computing device of an end user, such as a mobile device, laptop computer, a tablet computer, a netbook computer, a personal computer, a desktop computer, a personal digital assistant (PDA), a smart phone, a wearable device (e.g., smart glasses, smart watches, e-textiles, AR headsets, etc.), or any programmable computer systems known in the art. In general, client device110can represent any programmable electronic device or combination of programmable electronic devices capable of executing machine readable program instructions and communicating with host device120, password vault130, and other devices (not depicted) via a network, such as network140. Client device110may include components, as depicted and described in further detail with respect to computing device500ofFIG.5, in accordance with embodiments of the present invention.

Client device110includes user interface112and application114. User interface112is a program that provides an interface between a user of an end user device, such as client device110, and a plurality of applications that reside on the device (e.g., application114). A user interface, such as user interface112, refers to the information (such as graphic, text, and sound) that a program presents to a user, and the control sequences the user employs to control the program. A variety of types of user interfaces exist. In one embodiment, user interface112is a graphical user interface. A graphical user interface (GUI) is a type of user interface that allows users to interact with electronic devices, such as a computer keyboard and mouse, through graphical icons and visual indicators, such as secondary notation, as opposed to text-based interfaces, typed command labels, or text navigation. In computing, GUIs were introduced in reaction to the perceived steep learning curve of command-line interfaces which require commands to be typed on the keyboard. The actions in GUIs are often performed through direct manipulation of the graphical elements. In another embodiment, user interface112is a script or application programming interface (API).

Application114can be representative of one or more applications (e.g., an application suite) that operate on client device110. In an embodiment, application114can be an application that a user of client device110utilizes to gain access to one or more user accounts associated with a resource. For example, application114is a client-side application, such as a mobile banking application running on client device110that enables a user to access an online checking account. In another example, application114is a web application, such as a social media application running on a web browser that enables a user to access an online social media account. In an embodiment, application114may further include one or more components, such as add-ons or plug-ins installed on client device110. In yet another example, application114can be representative of a resource host application that is integrated or embedded within an application for managing a password vault, such as password vault130located on client device110.

Host device120is configured to provide resources to various computing devices, such as client device110. For example, host device120may host various resources, such as web content, data storage, applications, and services that are accessed and utilized by a user of client device110. In various embodiments, host device120is a computing device that can be a standalone device, a management server, a web server, an application server, a mobile device, or any other electronic device or computing system capable of receiving, sending, and processing data. In an embodiment, host device120represents a server computing system utilizing multiple computers as a server system, such as in a cloud computing environment. In an embodiment, host device120represents a computing system utilizing clustered computers and components (e.g. database server computer, application server computer, web server computer, webmail server computer, media server computer, etc.) that act as a single pool of seamless resources when accessed within network computing environment100. In general, host device120represents any programmable electronic device or combination of programmable electronic devices capable of executing machine readable program instructions and communicating with each other, as well as with client device110, password vault130, and other computing devices (not shown) within network computing environment100via a network, such as network140.

Host device120may include components as depicted and described in detail with respect to cloud computing node10, as described in reference toFIG.6, in accordance with at least one embodiment of the present invention. Host device120may include components, as depicted and described in detail with respect to computing device500ofFIG.5, in accordance with at least one embodiment of the present invention.

In various embodiments, host device120hosts resources, such as resource124and resource128associated with resource hosts122and126, respectively. In an embodiment, a user or device, such as client device110, requests access to a resource located on host device120. For example, a resource may be computer hardware installed on host device120. In another example, a resource may be computer software (e.g., an application) installed and running on host device120. In yet another example, a resource may be computer data stored in a physical storage area of host device120. In an embodiment, resource host122and resource host124are application service providers and resource124and resource128are applications installed and running on host device120.

In an embodiment, a resource host stores passwords for accessing a resource located on a computing device or system associated with the resource host. In an embodiment, a resource host stores one or more passwords for accessing a resource on the same computing device in which the resource is located. For example, resource host122stores passwords for accessing resource124on host device120. In an alternative embodiment, a resource host stores one or more passwords for accessing a resource on a different computing device than the computing device in which the resource is located. For example, resource host126stores passwords for accessing resource128on a different host device (not depicted) other than host device120. In an embodiment, a resource host may store a single password, multiple passwords, and/or a combination of multiple passwords. In an embodiment, a resource host may further store the respective times and dates at which the passwords were stored.

In various embodiments, password vault130is a secure data repository for persistently storing encrypted passwords generated by resource for authenticating user access to a user account associated with a resource. Password vault130may be implemented using any volatile or non-volatile storage media known in the art for storing data. For example, password vault130may be implemented with a tape library, optical library, one or more independent hard disk drives, multiple hard disk drives in a redundant array of independent disks (RAID), solid-state drives (SSD), random-access memory (RAM), and any possible combination thereof. Similarly, password vault130may be implemented with any suitable storage architecture known in the art, such as a relational database, an object-oriented database, or one or more tables.

In an embodiment, a separate and distinct password vault130is associated with and stored locally on each client device110owned by a particular individual. For example, if a user owns a smartphone, a tablet, and a laptop, a separate password vault is locally located on each of these devices. In an embodiment, a user or device is granted access to password vault130by entering their User ID/Device ID and matching password or PIN. In an embodiment, a different User ID/Device ID and matching password or PIN is used to access each vault located on a respective client device110associated with a user. In an embodiment, the same User ID/Device ID and matching password or PIN is used to access any vault located on any client device110associated with a user.

In an embodiment, password vault130is divided into data partitions, wherein each respective data partition is associated with a particular resource host. For example, resource host122and resource host126may be associated with resource host partition132and resource host partition134, respectively. In an embodiment, a user accesses a resource associated with a resource host by selecting a particular user account listed under a partition of password vault130associated with the resource host. For example, a corresponding URL to an email account associated with resource host122is connected to a user account listed under resource host partition132of password vault130.

In an embodiment, passwords that are maintained in resource host partitions of password vault130are unique to the particular device in which password vault130is located. For example, assume that a first password vault is located on a smartphone of a user and a second password vault is located on a laptop of the user. The first password vault may include Partition A associated with Resource Host1and the second password vault may include Partition B, which is also associated with Resource Host1. Although a user may request access to the same application (e.g., Application X) provided by Resource Host1via their smartphone or laptop, the passwords stored in Partition A that Resource Host1may use to authenticate a user attempting to access Application X from their smartphone are different than the passwords stored in Partition B that Resource Host1may use to authenticate the same user attempting to access Application X from their laptop.

As further depicted inFIG.1, password vault130includes resource host partition132and resource host partition134. Each of resource host partitions132and134include encrypted passwords generated by resource host122and resource host126, respectively, for authenticating access to resource124and128, respectively, via client device110. It should be appreciated that any encrypted passwords stored in a resource host partition of password vault130are only accessible by the respective resource host who generated the passwords since the encryption key for decrypting the passwords stored in password vault130is not known by the owner of a device in which the password vault is located on.

In an embodiment, management of the passwords generated and stored in a resource host partition are controlled by the resource host associated with the partition. In an embodiment, a user of client device110generates a vault partition PIN for each partition of vault130that is used by the respective service provider associated with the partition to gain access to the partition. For example, a user may generate the vault partition PIN123456for use by resource host122to access resource host partition132. In another example, a user may generate the vault partition PIN654321for use by resource host126to access resource host partition134. In an embodiment, the vault partition PIN is only valid after a user request to access password vault130via client device110is authenticated. In an embodiment, the vault partition PIN is only valid after a user initiates an authentication request to access a resource based on a selection of a user account listed under a particular resource host partition of password vault130. In an embodiment, the vault partition PIN is only valid for a predetermined period of time after a user initiates a request to access a resource associated with a resource host. It should be appreciated that since the passwords are generated and encrypted by the service providers, the user does not know what the passwords are, and thus cannot accidently divulge them. It should further be appreciated that since the resource hosts are in control of the passwords, the resource hosts can randomly generate passwords, as well as dynamically change or disable passwords stored in password vault130to increase security.

In an embodiment, each password vault and each resource host partition of a password vault is assigned a unique serial number that is associated with or tied to the MAC address of the device in which the password vault is located on. In an embodiment, access to a resource host partition of a password vault associated with a resource host is granted based on the resource host successfully presenting the following access credentials: (i) the serial number of the password vault, (ii) the serial number of the resource host partition of the password vault, (iii) the user assigned vault partition PIN, and (iv) the user ID of the user account in which the user is requesting access to. Accordingly, an initial user registration with each resource host may be required in order to provide the resource host with the necessary information required to access their respective resource host partition.

Network computing environment100further includes vault manager program101. In various embodiments of the present invention, vault manager program101facilitates the storage, retrieval, and authentication of passwords stored in password vault130. In an embodiment, vault manager program101controls access to password vault130by verifying an identity of a user or device requesting access to password vault130. For example, vault manager program101authorizes access to password vault130based on authenticating a required username and password combination. Similarly, vault manager program101denies access to password vault130based on a failed authentication attempt using an incorrect username and password combination.

In an embodiment, a temporary communication channel is established between a resource host partition of a password vault located on a first device and a host device associated with the resource host partition in response to identifying a request from the first device to access a resource located on the second device. For example, a temporary communication channel is established between host partition134of password vault130and host device120in response to identifying a request from client device110to access a resource associated with resource host126located on host device120.

In an embodiment, the temporary communication channel is maintained for a predetermined period of time. In an embodiment, the temporary communication channel is maintained for the duration of time in which the user or device has access to the resource. In an embodiment, a resource host may update the password(s) stored in a resource host partition of a password vault associated with the resource host while the communication channel is open. For example, resource host122can update passwords stored in resource host partition132of password vault130located on client device110during an active communication channel. In an embodiment, while the temporary communication channel is established between a resource host and password vault130, the resource host can temporarily disable their respective resource host partition in order to prevent any further authentication requests from being made to the same resource in which a user of client device110is actively accessing.

In an embodiment, encrypted passwords stored in a resource host partition of a password vault can only be updated while a temporary communication channel is open between a resource host partition of a password vault and a computing device of the resource host associated with the resource host partition. For example, during a temporary communication channel established between resource host122and host partition132of password vault130, vault manager program101stores one or more encrypted passwords in resource host partition132based on receiving one or more write operations from resource host122via the temporary communication channel. In an embodiment, encrypted passwords stored in a resource host partition of a password vault can only be deleted while a temporary communication channel is open between a resource host partition of a password vault and a computing device of the resource host associated with the resource host partition. For example, during a temporary communication channel established between resource host126and resource host partition134of password vault130, vault manager program101deletes one or more encrypted passwords from resource host partition134based on receiving one or more delete operations from resource host126via the temporary communication channel.

In an embodiment, vault manager program101initiates an authentication request with a resource host in response to detecting a user request to access a resource located on host device120. For example, vault manager program101may initiate an authentication request with resource host122based on detecting a user selection of a user account listed under resource host partition132of password vault130. In another example, vault manager program101may initiate an authentication request with resource host126in response to a user of client device110successfully logging into password vault130and opening a client-based application associated with resource host126running on client device110. In yet another example, vault manager program101may initiate an authentication request with resource host126in response to a user of client device110successfully logging into password vault130and opening a web application associated with resource host126via a web browser on client device110.

In an embodiment, initiating an authentication request with a resource host includes prompting the resource host to enter its access credentials for accessing a resource host partition of a password vault located on the device in which the request to access a resource was generated. For example, if a user, via their smartphone, requests access to resource124associated with resource host122, vault manager program101presents resource host122with a login mechanism to enter the necessary information required for resource host124to access resource host partition132of password vault130located on the user's smartphone.

In an embodiment, in response to validating the access credentials received by a resource host for accessing a resource host partition of password vault130located on client device110, vault manager program101selects one or more encrypted passwords stored in the vault partition of password vault130. In an embodiment, vault manager program101selects passwords based on a resource host password policy stored in resource host partition of password vault130. As used herein, a resource host password policy is a set of rules that dictate which password(s) or combination of passwords stored in a resource host partition of password vault130should be selected for authentication of a user or device requesting access to a resource.

In an embodiment, vault manager program101compares the one or more encrypted passwords selected from a resource host partition based on the resource host password policy to one or more passwords stored on a computing device or system associated with the resource host. In an embodiment, vault manager program101may not have access to the passwords stored on the resource host computing system. Here, vault manager program101may retrieve passwords from a resource host partition of password vault130based on the resource host password policy stored in the resource host partition and send the retrieved passwords to the resource host for comparison. Based on the retrieved password(s) or password combination matching the password(s) stored on the resource hosts system and/or the retrieved password(s) matching the password(s) expected by the resource host, vault manager program101receives confirmation of the selected password(s) from the resource host.

In an embodiment, vault manager program101grants the user or device access to the resource in response to the one or more encrypted passwords selected from the resource host partition matching the one or more passwords stored locally on a computing device associated with the resource host. In an alternative embodiment, vault manager program101grants the user or device access to the resource in response to the one or more encrypted passwords selected form the resource host partition matching one or more designated passwords stored locally on a computing device associated with the resource host. For example, resource host126may have five passwords that are stored in resource host partition134of password vault130located on John's laptop and in a storage area located on host device120. In this example, resource host126has designated Password1and Password3as the expected passwords that should be received from vault manager program101when John requests access to his work email account via his laptop. Accordingly, if vault password manager101sends Password1and Password3to resource host126, vault password manager101grants John access to his work email account on his laptop in response to resource host126validating the passwords sent by password vault manager101.

In another example, resource host122may have five passwords that are stored in resource host partition132of password vault130located on John's mobile device and in a storage area located on host device120. In this example, resource host122has designated a concatenation of Password2and Password4as the expected password that should be received from vault manager program101when John requests access to his work email account via his mobile device. Accordingly, if vault password manager101sends Password2and Password4as a single text string to resource host122, vault password manager101grants John access to his work email account on his mobile device in response to resource host122validating the concatenated password sent by password vault manager101.

FIG.2is an exemplary block diagram depicting a password vault200located on a computing device, such as client device110(depicted inFIG.1), in accordance with at least one embodiment of the present invention.FIG.2provides only an illustration of one implementation and does not imply any limitations with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made by those skilled in the art without departing from the scope of the invention as recited by the claims.

Password vault200includes vault serial number202, MAC (media access control) address of device204, resource host1partition206, and resource host2partition208. Vault serial number202is a unique serial number that is assigned to password vault200. In an embodiment, vault serial number202is linked or mapped to MAC address204of a device in which password vault200is located on. For example, vault serial number202may be ABCD123 and MAC address204of the device that password vault200is located on may be 01-2F-56-A3-89-B2. One of ordinary skill in the art will appreciate that a MAC address is a unique hardware identifier assigned to a network interface controller (NIC) of a device that uniquely identifies each device on a network. Resource host1partition206and resource host2partition208are data partitions of password vault200that are associated with particular resource hosts. In an embodiment, resource host1partition206and resource host2partition208may each include one or more passwords and a corresponding password policy for selecting and authenticating passwords to access a resource provided by a host computing device, such as host device120(depicted inFIG.1).

FIG.3is an exemplary block diagram, generally designated300, depicting resource host1partition206of password vault200(depicted inFIG.2) in accordance with at least one embodiment of the present invention.FIG.3provides only an illustration of one implementation and does not imply any limitations with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made by those skilled in the art without departing from the scope of the invention as recited by the claims.

Resource host1partition206includes partition serial number302, resource host access pin304, user resource account URL306, user resource account ID308, resource host password policy310, and passwords312, which further include PW #1312A, PW #2312B, and PW #3312C. Partition serial number302is a unique identifier that is assigned to resource host1partition206. For example, partition serial number302may be XYZ240. In an embodiment, each partition of a password vault is assigned a unique partition serial number.

Resource host access pin304is a unique pin for use by resource host1to gain access to resource host1partition206. For example, resource host access pin304may be 3457. In an embodiment, resource host access pin304is assigned and controlled by a user of the device in which resource host1partition206of password vault200is located on. In an embodiment, resource host1utilizes resource host access pin304to establish a communication channel between password vault200located on a client device and a computing device associated with a resource host. In an embodiment, after being granted access to resource host1partition206, resource host1can pull one or more password(s) stored in resource host1partition206of password vault200. In an embodiment, resource host access pin304is only valid after a user initiates an authentication request for access to a resource via password vault200. In an embodiment, resource host1can only access resource host1partition206to authenticate a user request to access a resource, update resource host password policy310, and update passwords312stored in password vault200. In an embodiment, resource host1can only update resource host password policy310and passwords312while an active user session is established between a user and a resource.

User resource account URL (uniform resource locator)306is a web address of a given resource, such as a user account. For example, user resource account URL306may be “https//www.myaccount.com,” which is a web address for a user's email account. User resource account ID308is a username by which a person is identified by a resource host. For example, user resource account ID308may be “customerabc,” which is used to identify a user's particular online bank account.

Resource host password policy310is owned and controlled by resource host1, and provides for which encrypted passwords should be selected from resource host1partition206in order to authenticate a user requesting access to a resource. Passwords312for authenticating a user request to access a resource are stored in resource host1partition206. For example, PW #1312A may be “XC87YcP345jL!?98DGgP4,” PW #2312B may be “2-89TYYyp34?1!IopW234Uo,” and PW #3312C may be “3-U89Tyuv2jfkdjskaK07rtIP.” If resource host password policy310is PW #1312A+PW #3312C, then password vault manager101would combine PW #1312A and PW #3312C to form the password “XC87YcP345jL!?98DGgP43—U89Tyuv2jfkdjskaK07rtIP” for the next authentication request by resource host1.

FIG.4is a flowchart diagram, generally designated400, depicting operational steps for authenticating access to a resource by vault manager program101in accordance with at least one embodiment of the present invention.FIG.4provides only an illustration of one implementation and does not imply any limitations with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made by those skilled in the art without departing from the scope of the invention as recited by the claims.

At step402, vault manager program101stores one or more encrypted passwords associated with a resource located on a host device in a partition of a vault located on a client device. At step404, vault manager program101identifies a request from the client device to access the resource located on the host device. At step406, in response to identifying the request from the client device to access the resource located on the host device, vault manager program101prompts the host device to enter its access credentials for accessing the partition of the vault located on the client device.

At step408, vault manager program101determines whether the access credentials entered by the host device for accessing the partition of the vault located on the client device are valid. In response to determining that the access credentials provided by the host device for accessing the partition of the vault located on the client device are valid (decision step408“YES” branch), vault manager program101proceeds to step410. In response to determining that the access credentials provided by the host device for accessing the partition of the vault located on the client device are invalid (decision step408“NO” branch), vault manager program101proceeds to step414and denies the client device access to the resource located on the host device.

At step410, in response to validating the access credentials provided by the host device for accessing the partition of the vault located on the client device, vault manager program101selects one or more encrypted passwords stored in the partition of the vault located on the client device.

At decision step412, vault manager program101determines whether the one or more encrypted passwords selected from the partition of the vault match one or more predesignated passwords stored locally on the host device. In response to determining that the one or more encrypted passwords selected from the partition of the vault match the one or more predesignated passwords stored locally on the host device (decision step412“YES” branch”), vault manager program101grants proceeds to step416and grants the client device access to the resource located on the host device. In response to determining that the one or more encrypted passwords selected from the partition of the vault do not match the one or more predesignated passwords stored locally on the host device (decision step412“NO” branch”), vault manager program101proceeds to step414and denies the client device access to the resource located on the host device.

Alternatively, at decision step412, host device120determines whether the one or more encrypted passwords selected from the partition of the vault match one or more predesignated passwords stored locally on the host device. Here, vault manager program101transmits the one or more encrypted passwords selected from the partition of the vault to the host device for comparison with the one or more predesignated passwords stored locally on the host device. In response to receiving, from the host device, a confirmation that the one or more encrypted passwords transmitted to the host device match the one or more predesignated passwords stored locally on the host resource (decision step412“YES” branch), vault manager program101proceeds to step416and grants the client device access to the resource located on the host device. In response to receiving, from the host device, a statement that the one or more encrypted passwords transmitted to the host device do not match the one or more predesignated passwords stored locally on the host resource (decision step412“NO” branch), vault manager program101proceeds to step414and denies the client device access to the resource located on the host device.

FIG.5is a block diagram depicting components of a computing device, generally designated500, suitable for executing vault manager program101in accordance with at least one embodiment of the invention. Computing device500includes one or more processor(s)504(including one or more computer processors), communications fabric502, memory506including, RAM516and cache518, persistent storage508, communications unit512, I/O interface(s)514, display522, and external device(s)520. It should be appreciated thatFIG.5provides only an illustration of one embodiment and does not imply any limitations with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made.

As depicted, computing device500operates over communications fabric502, which provides communications between computer processor(s)504, memory506, persistent storage508, communications unit512, and input/output (I/O) interface(s)514. Communications fabric502can be implemented with any architecture suitable for passing data or control information between processor(s)504(e.g., microprocessors, communications processors, and network processors), memory506, external device(s)520, and any other hardware components within a system. For example, communications fabric502can be implemented with one or more buses.

Memory506and persistent storage508are computer readable storage media. In the depicted embodiment, memory506includes random-access memory (RAM)516and cache518. In general, memory506can include any suitable volatile or non-volatile one or more computer readable storage media.

Program instructions for vault manager program101can be stored in persistent storage508, or more generally, any computer readable storage media, for execution by one or more of the respective computer processor(s)504via one or more memories of memory506. Persistent storage508can be a magnetic hard disk drive, a solid-state disk drive, a semiconductor storage device, read-only memory (ROM), electronically erasable programmable read-only memory (EEPROM), flash memory, or any other computer readable storage media that is capable of storing program instructions or digital information.

Communications unit512, in these examples, provides for communications with other data processing systems or devices. In these examples, communications unit512can include one or more network interface cards. Communications unit512may provide communications through the use of either or both physical and wireless communications links. In the context of some embodiments of the present invention, the source of the various input data may be physically remote to computing device500such that the input data may be received, and the output similarly transmitted via communications unit512.

I/O interface(s)514allows for input and output of data with other devices that may operate in conjunction with computing device500. For example, I/O interface(s)514may provide a connection to external device(s)520, which may be as a keyboard, keypad, a touch screen, or other suitable input devices. External device(s)520can also include portable computer readable storage media, for example thumb drives, portable optical or magnetic disks, and memory cards. Software and data used to practice embodiments of the present invention can be stored on such portable computer readable storage media and may be loaded onto persistent storage508via I/O interface(s)514. I/O interface(s)514also can similarly connect to display522. Display522provides a mechanism to display data to a user and may be, for example, a computer monitor.

Characteristics are as follows:

Service Models are as follows:

Deployment Models are as follows:

FIG.7is block diagram depicting a set of functional abstraction model layers provided by cloud computing environment50depicted inFIG.6in accordance with at least one embodiment of the present invention. It should be understood in advance that the components, layers, and functions shown inFIG.7are intended to be illustrative only and embodiments of the invention are not limited thereto. As depicted, the following layers and corresponding functions are provided: