Patent Publication Number: US-10762191-B2

Title: Automated password generation and change

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
     This application is a continuation of U.S. patent application Publication Ser. No. 15/880,863, filed on Jan. 26, 2018, which is a continuation of U.S. patent application Ser. No. 14/812,945, filed on Jul. 29, 2015 (now U.S. Pat. No. 9,916,437), which claims the benefit of Provisional Application No. 62/032,390, filed on Aug. 1, 2014, all of which are hereby incorporated herein by reference. 
    
    
     BACKGROUND 
     1. Technical Field 
     This application generally relates to the field of Internet-based applications and, in particular, to automated configuration of the Internet-based applications through generation, change, and caching of application passwords. 
     2. Background Information 
     A software application that requires a person to log in to an account usually uses a username/password combination as the authentication mechanism. Therefore, people who have accounts for several different applications must remember several passwords. To make this task easier, people tend to use easy-to-remember passwords, variations of relatively strong passwords, and/or the same password for all of the applications. The result is that user/password combinations are stored in several server-side databases (from the different application providers), which increases the security exposure. If an account from one of the applications is compromised, then the attacker can use that user&#39;s credentials to compromise an account for another application. 
     As an additional problem, a user may have multiple client devices that the user uses to access the software applications, such as a laptop or desktop, a smartphone, a tablet computer, and the like. For some types of client devices in particular, it is valuable for the username and password information to be cached locally so that they may be automatically entered for the user. This is particularly useful for the user for client device types, such as smartphones, for which providing input is more cumbersome, or which tend to be used in contexts where the user is hurried and/or cannot give full attention to entering the username/password. However, when a user changes the user&#39;s username/password centrally, that change is typically not made available to the user&#39;s various client devices. Thus, users often have difficulties authenticating themselves on their various client devices after username/password changes. 
     SUMMARY 
     In one embodiment, a computer-implemented method performed by an identity management system comprises detecting that a user has changed a password of the user for a third-party application provided by a remote third-party service system; and responsive to the detection, configuring a plurality of client devices of the user to be updated with the changed password for use with the third-party application. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a high-level block diagram illustrating an environment for handling password generation and/or change in an automated manner, according to one embodiment. 
         FIG. 2  is a high-level block diagram illustrating an example of a computer for use as one or more of the entities illustrated in  FIG. 1 , according to one embodiment. 
     
    
    
     DETAILED DESCRIPTION 
     The Figures (FIGS.) and the following description describe certain embodiments by way of illustration only. One skilled in the art will readily recognize from the following description that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles described herein. Reference will now be made to several embodiments, examples of which are illustrated in the accompanying figures. It is noted that wherever practicable similar or like reference numbers may be used in the figures and may indicate similar or like functionality. 
       FIG. 1  is a high-level block diagram illustrating an environment  100  for generating and/or changing passwords in an automated manner, according to one embodiment. The environment  100  may be maintained by an enterprise (e.g., an identity management service) that provides a password service that generates passwords for use with third-party service user accounts and interacts with third-party services to change passwords on user accounts. For example, an identity management system  120  generates a password and interacts with a third-party service system  140  to modify a user account so that the user account uses the newly-generated password. Since the password generation and change is automated, it is easy to use unique, secure passwords for each user account and change these passwords periodically. As another example, the identity management system  120  can determine when a user has proactively changed the user&#39;s password and ensure that the various client devices  130  of the user are configured to include the new password. 
     As shown, the environment  100  includes a network  110 , an identity management system  120 , one or more client devices  130 , a third-party service system  140 , and a device management system  150 . While one identity management system  120 , one third-party service system  140 , and one device management system  150  are shown in the embodiment depicted in  FIG. 1  for clarity, other embodiments can have different numbers of identity management systems, clients, third-party service systems, and device management systems. Similarly, there may be any number of users, and each user may have one or more client devices  130 . 
     Subsets of the users may be employed by, or otherwise affiliated with, different companies or other organizations.  FIG. 1  illustrates a user organization  160  that conceptually contains the illustrated client devices  130 —that is, the illustrated client devices  130  are those registered to the organization  160  and in the control of the users that belong to the organization  160 . There may be any number of organizations  160 , each having an associated set of client devices  130  and their corresponding users. 
     The network  110  represents the communication pathway between the identity management system  120 , the client device  130 , the third-party service system  140 , and the device management system  150 . In one embodiment, the network  110  uses standard wireless and wired communications technologies and protocols and can include the Internet and associated protocols. In another embodiment, the entities on the network  110  can use custom and/or dedicated data communications technologies. 
     A client device  130  is a computer (or set of computers) that enables a user to access various third-party services. The client device  130  can be, for example, a desktop computer, a laptop computer, a tablet computer, a smart phone, or the like. The client device  130  includes one or more application modules  135 . A particular application module  135  enables the client device  130  to access third-party services provided by a particular third-party service system  140 . For example, an application module  135  interacts with a third-party service system  140  to log in to a user account of the third-party service system (e.g., using a username/password combination). After logging in, the application module  135  interacts with the third-party service system  140  to access various services. 
     In one embodiment, the application module  135  is a native application that executes on an operating system of the client device  130 . In another embodiment, the application module  135  is a plugin for a web browser of the client device  130 . In yet another embodiment, the application module  135  is a link to a webpage provided by the third-party service system  140 . 
     The identity management system  120  is a computer (or set of computers) that provides identity management services. Identity management services include, for example, managing user accounts at various third-party services. For example, the identity management system  120  creates user accounts at various third-party services, configures the accounts with usernames and passwords, and can modify, deactivate, and delete the accounts if necessary. 
     In one embodiment, the identity management system  120  also provides single sign-on (SSO) services. For example, a user authenticates himself to the identity management system  120  by logging in to the identity management system using the client device  130 . The identity management system  120  then provides the client device  130  with a single portal from which the user can access various third-party service user accounts without entering any additional authentication information (e.g., a username/password combination). For example, the user uses the portal to specify a particular third-party service, and the client device  130  notifies the identity management system  120  accordingly. The identity management system  120  then accesses the appropriate authentication information (stored within the identity management system) and uses it to log in to the user&#39;s account at the specified third-party service system  140 . 
     The identity management system  120  includes a password module  125 . The password module  125  generates passwords for use with user accounts at various third-party services. The password module  125  also interacts with third-party services to change passwords on user accounts. For example, the password module  125  generates a password and interacts with a third-party service system  140  to modify a user account so that the user account uses the newly-generated password. In the case of a manual password change performed by a user, the password module  125  detects the password change and configures the various client devices  130  with the new password, as described in more detail below. 
     In one embodiment, the password module  125  interacts with the third-party service system  140  via an application programming interface (API) provided by the third-party service system. In another embodiment, the password module  125  interacts with the third-party service system  140  via a configurable web script that includes information regarding how to access the third-party service system. In one embodiment, the script uses machine learning techniques or explicit definitions to cause the third-party service system  140  to change a password. The machine learning techniques are, for example, related to heuristics that are used to identify webpages that request login information (e.g., a username/password combination). In one embodiment, the script conforms to the Extensible Markup Language (XML) standard. In another embodiment, a particular script is stored in association with a reference to a particular third-party service system  140 . In yet another embodiment, the script is generated automatically. 
     In one embodiment, the password module  125  stores the newly-generated password. The stored password can be used, for example, for single sign-on purposes or recovered if forgotten. The password is stored encrypted with a customer-level key (an enterprise customer of the identity management system  120 ), encrypted with a user-level key, or unencrypted. Note that an encrypted password need not be decrypted unless and until the password needs to be changed (or provided for login purposes). If the password is stored encrypted with a user-level key, then the password can be decrypted by only the client device  130 . Since decryption does not occur at the identity management system  120 , the identity management system does not have access to the password in its decrypted state. As a result, the identity management system  120  cannot recover the password. In one embodiment, a user-level key is generated based on a cryptographic function applied to a user&#39;s identity management system password. 
     If a third-party service account has been assigned a new password, then the application module  135  must be configured with the new password in order to continue to access the third-party services. In one embodiment, the password module  125  sends the newly-generated password to the user in some way (e.g., by text message or email). In that embodiment, the user enters the password into the application module  135  for use during future logins. 
     Recall that the password module  125  generates passwords for use with user accounts at various third-party services. In one embodiment, the password module  125  generates unique, secure, and random passwords that satisfy corresponding customizable rules for complexity. A set of complexity rules corresponds to one of the various third-party services and specifies properties of a password required by that third-party service, such as minimum password length, or minimum numbers of characters of a certain class (e.g., numbers, symbols, or uppercase letters). These complexity rules can be predefined and stored in association with references to particular third-party service systems  140 , so that different third-party service systems can have different password generation rules. 
     Passwords can be generated on a per-application basis (i.e., a user has one password for the application, regardless of the device on which the application is installed) or on a per-client basis (i.e., for a given application that supports per-client passwords, a user has a different password for the application on each client device from which the user uses the application). Per-client passwords are more secure since, if a client device  130  is compromised, only that client&#39;s password is compromised. However, the authentication of a per-client password requires that the identity management system  120  be the configured identity provider for the application module  135 . In one embodiment, information is encoded on client devices  130  that enables per-client passwords to have different authorization levels. 
     The identity management system  120  executes the password module  125  (to generate a new password and interact with a third-party service system  140  to use the newly-generated password for a user account) based on occurrence of a trigger event. In one embodiment, possible trigger events include: a user logging in to the identity management system  120 , a user changing his password for the identity management system  120 , a user requesting that a password be changed, an administrator requesting that a password be changed, a third-party service account being created, or a time period expiring (so that trigger events would occur periodically). If account passwords are not changed periodically, then an attacker has a large time window to obtain and use credentials without detection. If account passwords are changed periodically, then an administrator can control the length of time that a password is valid, thereby greatly reducing the attack surface. Note that after a trigger event occurs, the identity management system  120  can execute the password module  125  immediately or after a configurable delay. 
     Recall that, in one embodiment, the identity management system  120  provides single sign-on services. For example, the identity management system  120  uses stored authentication information to log in to a user&#39;s account at a third-party service system  140 . In one embodiment, after the identity management system  120  logs in a particular number of times, then this constitutes a trigger event, so the identity management system executes the password module  125 . If the particular number of times is one, then the password that is used to log in to the third-party service system  140  is effectively a one-time password, since it is destroyed or invalidated after one use. 
     In the case of such one-time passwords, in particular, the identity management system  120  can take additional steps to thwart and detect phishing (e.g., when a user requests and obtains his authentication information for an application from the identity management system  120 , and then inadvertently allows a phisher to obtain it). First, since the identity management system  120  changes the authentication information for a given third-party service  140  at each single sign-on of the user, authentication information (e.g., password) captured by the phisher for a particular third party service will only be usable by the phisher until the next sign-on by the legitimate user, at which time the authentication information will be changed, and thus the phished authentication information will become useless. If the phisher chooses to use the phished authentication information for the third-party service  140  and then changes the password via the user interface of the service  140 , the identity management system  120  will detect that its subsequent attempt to authenticate the legitimate user failed, and in consequence notify the user or an administrator of the suspicious activity, allowing them to reset the authentication information and lock the phisher out. 
     The third-party service system  140  is a computer (or set of computers) that provides various third-party services. A third-party service is, for example, a cloud-based application service, a web-based application service, a network-based application service, an on-premises application, an enterprise application, a consumer application, or a custom-built internal application. The third-party service system  140  maintains user accounts that are logged into in order to access the third-party services. Authentication information for these user accounts (e.g., username/password combinations) is stored in a password repository  145  of the third-party service system  140 . The third-party service system  140  provides an API that can be used by external systems to interact with the third-party service system. For example, the identity management system  120  can use a third-party service system API to log in to a user account of the third-party service system  140 . As another example, the identity management system  120  can use a third-party service system API to cause the third-party service system  140  to change the password of a user account (e.g., by modifying information stored in the password repository  145 ). 
     The device management system  150 , which is optional, is a computer (or set of computers) that provides services for managing client devices  130 . Device management services include, for example, securely transporting information to client devices  130  and/or configuring client devices. For example, the device management system  150  can configure an application module  135  of a client device  130 . If a third-party service account has been assigned a new password, then the application module  135  must be configured with the new password in order for the user to continue to access the third-party services via automatic use of the application module  135 . If the device management system  150  performs this configuration (e.g., after being requested to do so by the identity management system  120 ), then the password change is invisible to the user. In particular, the user does not need to configure the application module  135  manually, such as by entering the password. 
     The device management system  150  provides an API that can be used by external systems to interact with the device management system. For example, the identity management system  120  can use a device management system API to cause the device management system  150  to configure an application module  135  of a client device  130  with particular authentication information (e.g., a username/password combination). 
     In one embodiment, the device management system  150  has mobile device management (MDM) capabilities. For example, the device management system  150  uses a device management transport protocol to securely transport information to a client device  130 . This embodiment is useful when the client device  130  is a mobile device. Examples of device management systems  150  include the Mobilelron platform from Mobilelron, Inc., MaaS360 from Fiberlink Communications Corp., and AirWatch from AirWatch, LLC. In some embodiments, the identity management system  120  obliges the client devices  130  to authorize MDM, or automatically configures the clients to use MDM, in order to for a particular client device  130  to use the services of the identity management system. In some embodiments, the identity management system  120  configures users to use per-client passwords, generating different passwords for each client device of a particular user, and using MDM to store each per-client passwords locally on the client device  130  to which the per-client password corresponds. 
     In one embodiment, the environment  100  operates as follows: A trigger event occurs. Responsive to the trigger event, the password module  125  of the identity management system  120  generates a new password. The password module  125  interacts with the third-party service system  140 . Responsive to the interaction, the third-party service system  140  modifies the password repository  145  so that a user account uses the newly-generated password. Optionally, the password module  125  interacts with the device management system  150 . Responsive to the interaction, the device management system  150  configures the application module  135  of the client device  130  to use the newly-generated password. Optionally, the password module  125  sends the newly-generated password to the user in some way (e.g., by text message or email). 
     In one embodiment, the identity management system  120  additionally includes a change discovery module  127  that handles password synchronization across client devices  130  in response of a password change manually initiated by a user, as opposed to an automatic password generation initiated by the identity management system  120 . 
     The change discovery module  127  may discover a user password change in different ways. In one embodiment, the change discovery module  127  detects user password changes made by the user within a user interface of the identity management system  120  itself. For example, the identity management system  120  may provide a web-based user interface to the user, listing all of the user&#39;s accounts on the third-party service systems  140 , along with a password change user interface (e.g., a password text field) for each; upon submission of a user password change for one of the third-party service systems  140  using this user interface, the change discovery module  127  notes the change. As another example, the change discovery module  127  may be notified by a software agent of a change to a password of an account of the user on a directory server of the user organization  160 , via protocols such as those for ActiveDirectory™, Lightweight Directory Access Protocol (LDAP), or Remote Authentication Dial-In User Service (RADIUS). In this example, the software agent executes on a server of the user organization  160 . When users of the organization  160  make changes to their passwords for the third-party service systems, the changed passwords are stored in the directory of the organization  160 . The user agent notes the changes by consulting the directory and informs the change discovery module  127  of the identity management system  127  of the new passwords. As another example, the change discovery module  127  may be notified of the password change by a browser plug-in running in a browser of the client device  130 . The browser plug-in is supplied by the organization responsible for the identity management system  120 , and has data about the web-based interfaces of the third-party service systems  140 . For example, the browser plug-in may know the URLs of the various third-party service systems for which it is designed, such as the URLs of their login/password change pages, and which fields of those pages correspond to the entry of new passwords. This data enables the browser plug-in to note when a user changes a password for the user&#39;s account on one of the third-party services and to send the new value of the password to the change discovery module  127 . 
     Once the change discovery module  127  has noted the new password for the application on the third-party service system  140 , it causes configuration of the various client devices  130  that are registered to the user on the identity management system such that the client devices store the new password for the application. The change discovery module  127  may use the device management system  150  for this purpose, as described above. 
       FIG. 2  is a high-level block diagram illustrating an example of a computer  200  for use as one or more of the entities illustrated in  FIG. 1 , according to one embodiment. Illustrated are at least one processor  202  coupled to a chipset  204 . The chipset  204  includes a memory controller hub  220  and an input/output (I/O) controller hub  222 . A memory  206  and a graphics adapter  212  are coupled to the memory controller hub  220 , and a display device  218  is coupled to the graphics adapter  212 . A storage device  208 , keyboard  210 , pointing device  214 , and network adapter  216  are coupled to the I/O controller hub  222 . Other embodiments of the computer  200  have different architectures. For example, the memory  206  is directly coupled to the processor  202  in some embodiments. 
     The storage device  208  includes one or more non-transitory computer-readable storage media such as a hard drive, compact disk read-only memory (CD-ROM), DVD, or a solid-state memory device. The memory  206  holds instructions and data used by the processor  202 . The pointing device  214  is used in combination with the keyboard  210  to input data into the computer system  200 . The graphics adapter  212  displays images and other information on the display device  218 . In some embodiments, the display device  218  includes a touch screen capability for receiving user input and selections. The network adapter  216  couples the computer system  200  to the network  110 . Some embodiments of the computer  200  have different and/or other components than those shown in  FIG. 2 . For example, the management server  120 , the firewall  140 , the agent  160 , the agent/OPA interface  170 , and/or the OPA device  180  can be formed of multiple blade servers and lack a display device, keyboard, and other components. 
     The computer  200  is adapted to execute computer program modules for providing functionality described herein. As used herein, the term “module” refers to computer program instructions and/or other logic used to provide the specified functionality. Thus, a module can be implemented in hardware, firmware, and/or software. In one embodiment, program modules formed of executable computer program instructions are stored on the storage device  208 , loaded into the memory  206 , and executed by the processor  202 . 
     The above description is included to illustrate the operation of certain embodiments and is not meant to limit the scope of the invention. The scope of the invention is to be limited only by the following claims. From the above discussion, many variations will be apparent to one skilled in the relevant art that would yet be encompassed by the spirit and scope of the invention.