US20080141037A1 - System and method for automatic password reset - Google Patents
System and method for automatic password reset Download PDFInfo
- Publication number
- US20080141037A1 US20080141037A1 US11/950,755 US95075507A US2008141037A1 US 20080141037 A1 US20080141037 A1 US 20080141037A1 US 95075507 A US95075507 A US 95075507A US 2008141037 A1 US2008141037 A1 US 2008141037A1
- Authority
- US
- United States
- Prior art keywords
- password
- primary
- service
- operating system
- count
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2131—Lost password, e.g. recovery of lost or forgotten passwords
Definitions
- the present invention relates generally to computing devices.
- PC personal computer
- BIOS basic input output system
- HDD hard disk drive
- operating system passwords such as Windows7 passwords
- application passwords such as the IBM Global Dialer, Lotus Notes or other protected data or applications.
- the present invention recognizes particular drawbacks to current password reset methods, including the fact that remote mechanisms for setting passwords may require unique system and user authentication mechanisms that are independent from the password being reset. Moreover, as understood herein current BIOS passwords can only be reset locally from the keyboard after supplying either the password being reset or the corresponding master password for the function. Still further, without a valid Windows access password, a user has no guaranteed mechanism of resetting the Windows password. Simply allowing a user to reset his or her own password by giving the user an administrators ID (password plainly compromises the integrity of the system.
- a computer system includes a CPU, a primary O.S. executable by the CPU, a HDD storing a copy of the primary O.S., and a memory accessible by the CPU and storing a basic input output system (BIOS).
- the system also includes a secondary O.S.
- the secondary O.S. can generate a password reset signal based on a number of unsuccessful log on attempts to any of the BIOS, HDD, and primary O.S. (as well as to primary O.S. applications), and/or the secondary O.S. can, based on a reset signal, automatically generate an intermediate password useful for accessing a component associated with the password to be reset.
- the reset signal is generated by the secondary O.S. based on a count of failed logon attempts generated by the primary O.S.
- the reset signal is generated by a human user.
- the preferred intermediate password is sent to a user, which sends back verification of receipt.
- the password is then protected by digitally signing and encrypting the password prior to making the password available to the primary O.S.
- the secondary O.S. makes the intermediate password available to the primary O.S., and the primary O.S. can determine when an intermediate password is available upon start up of the primary O.S. and if so, reset the password to be the intermediate password.
- the primary O.S. contains system BIOS and conventional O.S.
- a computer system undertakes logic that includes maintaining a count of a number of failed log on attempts, and making the count available to a secondary computer operating system (O.S.) that is a different O.S. than a primary O.S. used by a computer associated with the log on attempts.
- the logic also includes, based on the relationship of the count with a policy-based threshold, selectively generating a password reset signal.
- a computer system undertakes logic for resetting an operating password associated with a primary operating system (O.S.), a hard disk drive (HDD), or a basic input output system (BIOS).
- the logic includes automatically generating an intermediate password using a secondary operating system, and providing the intermediate password to a primary operating system to reset the operating password.
- FIG. 1 is a block diagram of the present architecture
- FIG. 2 is a flow chart of the lost password sensor mechanism logic
- FIG. 3 is a flow chart of the password reset effector logic.
- a computing system is shown, generally designated 10 , that includes a user computer 12 .
- the computer 12 can be any suitable computer, e.g., a personal computer or larger, a laptop computer, a notebook computer or smaller, etc.
- the preferred non-limiting computer 12 includes a housing 14 in which is mounted at least one main central processing unit (CPU) 16 that can communicate with a solid state memory 18 in the housing 14 .
- the memory 18 can contain basic input/output system (BIOS) instructions useful for booting the computer 12 at start up.
- BIOS basic input/output system
- other storage can be provided, e.g., a hard disk drive (HDD) 20 that can hold a copy of a primary operating system, such as Windows7, for the computer 12 to load into memory 18 upon-start up in accordance with operating system principles known in the art.
- HDD hard disk drive
- an alternate storage medium 22 can be accessible by the CPU 16 .
- the alternate storage medium 22 may be inside or external to the housing 14 , and in the preferred embodiment the alternate storage medium 22 stores a secondary operating system such as, e.g., IBM's Client Rescue and Recovery system, for purposes to be shortly disclosed.
- the alternate storage medium 22 may be, e.g., a compact disk or digital video disk (CD/DVD), a universal serial bus (USB) memory key, a USB-connected external HDD, an “Ultrabay” HDD, a microdrive, and a PXE network boot.
- Various communication modules 24 such as wireless communication modules may also be provided.
- Password encompasses any computer access credential, including a password proper as well as any combination of password, keys, certificates or any other credential, especially those that are electronically transferable and used to authenticate a user's or system's access to local or remote resources, e.g., including a password for VPN access.
- the present invention contemplates two potentially independent components, namely, a password reset sensor mechanism ( FIG. 2 ) for determining when a situation requiring a password reset is present with little or no intervention from the user, and a password reset effector ( FIG. 3 ) for resetting the password.
- a password reset sensor mechanism FIG. 2
- a password reset effector FIG. 3
- the logic of the sensor mechanism may be seen.
- the number of failed log-on attempts is counted.
- the logic may be executed in Windows with system credentials so that it is active even when no user is logged in.
- the logic may access the Windows Graphical Identification and Authentication (GINA) to keep a record of the number of failed attempts to log onto Windows.
- GINA Windows Graphical Identification and Authentication
- the count of failed log on attempts is stored outside the primary O.S. file system.
- the count could be stored in a separate file allocation table (FAT) partition that can be read by the secondary O.S., such as IBM's Client Rescue and Recovery system.
- FAT file allocation table
- the user must change (e.g., by boot, hypervisor swap, or hibernation swap) to the secondary O.S., which upon starting up executes the decision at diamond 30 , namely, determining whether the count is great enough to trigger generation of a lost password signal at block 32 .
- the functional comparison logic is controlled by policy including enablement and conditions of comparison. If desired, the lost password signal can indicate a certainty level regarding whether the password-truly is lost, depending on the magnitude of the number of failed log on attempts.
- BIOS system password In the context or a BIOS system password, the above logic is essentially followed, with the following caveats. It is possible to allow a version of the secondary O.S. to run even if the BIOS system password, the primary O.S. password, or both are required but unavailable. In the same fashion as mentioned above for the primary O.S. password, a failed BIOS system password count is maintained externally by the secondary O.S., which executes the logic above based on the failed BIOS log on count.
- the secondary O.S. is booted from another medium other than the local HDD, i.e., from the alternate medium 22 , and then the logic above is executed based on a count of failed HDD log on attempts that is maintained externally by the secondary O.S.
- a limited version of the secondary O.S. can be stored on and can boot and run from the HDD 20 without the HDD password, but because this would require a significant change to current HDDs, it is not preferred.
- the principles above may also be invoked to sense a lost application password.
- FIG. 3 shows generic logic that can be implemented in the secondary O.S. by the effector mechanism to remedy (as by resetting) a lost password.
- FIG. 3 shows generic logic that can be implemented in the secondary O.S. by the effector mechanism to remedy (as by resetting) a lost password.
- the lost password signal from the sensor mechanism can be received, or a user-generated (manual) reset request can be received.
- the user is authenticated.
- the nature of the authentication required is determined by policy. In some systems, for instance, users may be prohibited from resetting passwords altogether. On the other hand, in some systems select groups of users may be required to use some form of hardware token as part of the authentication, while for other users, a simple Internet password may be sufficient to authenticate the user. In the context of resetting BIOS or HDD passwords, it may be preferred that strong user and system authentication and hardware support be used, e.g., strong authentication that is tied to a hardware token.
- an intermediate password is automatically generated and provided to the user.
- the user verifies receipt, such as by the mechanism of entering the new password twice correctly in succession.
- the secondary O.S. signs and protects (as by encryption using public key/private key principles known in the art) the new password preferably with the strongest security mechanism available on the computer 12 , e.g., software, an external hardware token, or embedded security. If the computer 12 has only software security to protect the primary O.S. password, for example, then protecting an intermediate version of the new password by a comparable security mechanism is appropriate Likewise, for a computer 12 that uses an embedded security chip such as a trusted platform module (TPM), the same hardware can be used by the secondary O.S. to protect the new O.S. password.
- TPM trusted platform module
- the encrypted and signed intermediate password is written by the secondary O.S. to a location that can be accessed by the primary O.S. Proceeding to block 46 , a primary O.S. Service that preferably runs with system administrator credentials at the start of the user's primary operating system monitors the presence of data indicating whether a new intermediate password exists and should be applied. If so, the signature is verified, and if it is valid, the password is decrypted and the primary O.S. password is reset by the service to the new intermediate password, which can then be used by the user to log on to or otherwise access the primary O.S. While effective for resetting a user O.S. password, the above logic preferably is not used to set the primary administrator's password, which is typically not used by end users in a managed large enterprise in any case.
- the secondary O.S. need not know the primary administrators O.S. password. Instead, the exchange of the new intermediate password is accomplished using existing public key technology.
- the Admin password for Windows or the Master password for the BIOS controlled Power On password or Hard Disk Drive password can be protected.
- Information can be passed to the system from a secure external network authenticated source, to allow the alternate O.S. to control a sequence in which it walks the user through the steps for resetting the corresponding user password without revealing the master or admin password in any case.
- the logic of FIG. 3 can be used to allow the reset of either the user level BIOS/HDD password or the master password that is intended for the entire information technology (IT) organization.
- the logic can allow the user level password to be reset by giving the secondary O.S. access to the master password.
- the user level password the user receives and validates his or her reception of the new password as described, but in the case of resetting a master password, the intermediate master password can be directly transferred to the system's BIOS without user intervention.
- the logic of FIG. 3 can also be used to reset a primary O.S. application password, such as might be required for individual applications such as Lotus Notes which provide an external mechanism for securely resetting the user password, namely, the users ID file.
- the application can use a more comprehensive and simpler approach using a password banking technology.
- the credentials can be protected locally, by software or embedded security, or remotely and applied after any required authentication as required by the particular local policy.
- the credentials to the bank itself have been lost, but the credentials for the individual applications are still protected in the bank. If the entire bank is lost or damaged for some reason, then either a remotely stored version of the bank must first be restored, or the situation reverts to the individual application case.
- the logic of FIG. 3 can be used where the secondary O.S. authenticates and validates a new randomly generated password then passes the information through a primary O.S. service to either the individual application or the password bank as appropriate.
- the present invention functions for a broad spectrum of platforms with differing levels of security by providing a level of security for the password reset process which is consistent with that elsewhere in the system.
- the sensor mechanisms transparently detect the lost password situations, thus removing some or all of the burden on the user.
- the effector mechanism can reset a password when the computer 12 is in a disconnected mode if desired by policy.
- the password can be reset by a remotely controlled but still automated mechanism.
- system manager/administrator have as much or as little control over the reset process as desired through policy, which can differ from sub-group to sub-group within an information technology (IT)-managed organization.
- IT information technology
Abstract
The loss of a computer's primary O.S. password, BIOS password, or HDD password (or even an application password) is sensed by a secondary O.S. based on a number of failed log on attempts to the affected component. The password can be reset by having the secondary O.S. generate an intermediate password automatically, verify user authorization, and then make the intermediate password available to, e.g., the primary O.S., so that the affected component can be accessed and its password reset without help desk personnel intervention.
Description
- The present invention relates generally to computing devices.
- When a computer password is lost or forgotten, whether for hardware or software, it must be reset, requiring the intervention of a system manager or administrator or other so-called “help desk” personnel. Resetting passwords consumes considerable manager/administrator time. Passwords that might be forgotten or lost include personal computer (PC) basic input output system (BIOS) passwords, hard disk drive (HDD) access passwords, operating system passwords such as Windows7 passwords, and application passwords such as the IBM Global Dialer, Lotus Notes or other protected data or applications.
- Securely resetting a password is currently undertaken by the help desk after receiving a user help desk call or trouble ticket report of a lost or forgotten password and then generating a random temporary password. The temporary password is sent to the user by e-mail (unless the e-mail password is involved), or voice mail, or the postal service. Thus, much of the password reset process requires the costly attention and time of help desk personnel.
- In addition to the above problems, the present invention recognizes particular drawbacks to current password reset methods, including the fact that remote mechanisms for setting passwords may require unique system and user authentication mechanisms that are independent from the password being reset. Moreover, as understood herein current BIOS passwords can only be reset locally from the keyboard after supplying either the password being reset or the corresponding master password for the function. Still further, without a valid Windows access password, a user has no guaranteed mechanism of resetting the Windows password. Simply allowing a user to reset his or her own password by giving the user an administrators ID (password plainly compromises the integrity of the system. Also, some enterprises maintain a central record of the set of user passwords in an enterprise to facilitate resetting a lost password, but this means that the user cannot modify passwords when disconnected as may be required during travel since the central location might not contain the most recent local password values. With these drawbacks in mind, the present invention has been provided.
- A computer system includes a CPU, a primary O.S. executable by the CPU, a HDD storing a copy of the primary O.S., and a memory accessible by the CPU and storing a basic input output system (BIOS). The system also includes a secondary O.S. In accordance with the present invention, the secondary O.S. can generate a password reset signal based on a number of unsuccessful log on attempts to any of the BIOS, HDD, and primary O.S. (as well as to primary O.S. applications), and/or the secondary O.S. can, based on a reset signal, automatically generate an intermediate password useful for accessing a component associated with the password to be reset.
- In a preferred embodiment, the reset signal is generated by the secondary O.S. based on a count of failed logon attempts generated by the primary O.S. Alternatively, the reset signal is generated by a human user. The preferred intermediate password is sent to a user, which sends back verification of receipt. The password is then protected by digitally signing and encrypting the password prior to making the password available to the primary O.S. Desirably, the secondary O.S. makes the intermediate password available to the primary O.S., and the primary O.S. can determine when an intermediate password is available upon start up of the primary O.S. and if so, reset the password to be the intermediate password. The primary O.S. contains system BIOS and conventional O.S.
- In another aspect, a computer system undertakes logic that includes maintaining a count of a number of failed log on attempts, and making the count available to a secondary computer operating system (O.S.) that is a different O.S. than a primary O.S. used by a computer associated with the log on attempts. The logic also includes, based on the relationship of the count with a policy-based threshold, selectively generating a password reset signal.
- In still another aspect, a computer system undertakes logic for resetting an operating password associated with a primary operating system (O.S.), a hard disk drive (HDD), or a basic input output system (BIOS). The logic includes automatically generating an intermediate password using a secondary operating system, and providing the intermediate password to a primary operating system to reset the operating password.
- The details of the present inventions both as to its structure and operation, can best be understood in reference to the accompanying drawings, in which like reference numerals refer to like parts, and in which:
-
FIG. 1 is a block diagram of the present architecture; -
FIG. 2 is a flow chart of the lost password sensor mechanism logic; and -
FIG. 3 is a flow chart of the password reset effector logic. - Referring initially to
FIG. 1 , a computing system is shown, generally designated 10, that includes auser computer 12. Thecomputer 12 can be any suitable computer, e.g., a personal computer or larger, a laptop computer, a notebook computer or smaller, etc. - As shown in
FIG. 1 , the preferrednon-limiting computer 12 includes ahousing 14 in which is mounted at least one main central processing unit (CPU) 16 that can communicate with asolid state memory 18 in thehousing 14. Thememory 18 can contain basic input/output system (BIOS) instructions useful for booting thecomputer 12 at start up. Additionally, other storage can be provided, e.g., a hard disk drive (HDD) 20 that can hold a copy of a primary operating system, such as Windows7, for thecomputer 12 to load intomemory 18 upon-start up in accordance with operating system principles known in the art. - Additionally, an
alternate storage medium 22 can be accessible by theCPU 16. Thealternate storage medium 22 may be inside or external to thehousing 14, and in the preferred embodiment thealternate storage medium 22 stores a secondary operating system such as, e.g., IBM's Client Rescue and Recovery system, for purposes to be shortly disclosed. Thealternate storage medium 22 may be, e.g., a compact disk or digital video disk (CD/DVD), a universal serial bus (USB) memory key, a USB-connected external HDD, an “Ultrabay” HDD, a microdrive, and a PXE network boot.Various communication modules 24 such as wireless communication modules may also be provided. - As used herein, the word “Password” encompasses any computer access credential, including a password proper as well as any combination of password, keys, certificates or any other credential, especially those that are electronically transferable and used to authenticate a user's or system's access to local or remote resources, e.g., including a password for VPN access.
- As discussed further below in reference to
FIGS. 2 and 3 , the present invention contemplates two potentially independent components, namely, a password reset sensor mechanism (FIG. 2 ) for determining when a situation requiring a password reset is present with little or no intervention from the user, and a password reset effector (FIG. 3 ) for resetting the password. - Now referring to
FIG. 2 , the logic of the sensor mechanism may be seen. Commencing atblock 26, the number of failed log-on attempts is counted. In the case of a lost primary O.S. (e.g., Windows) password, the logic may be executed in Windows with system credentials so that it is active even when no user is logged in. The logic may access the Windows Graphical Identification and Authentication (GINA) to keep a record of the number of failed attempts to log onto Windows. When a successful logon occurs, the count of failed logon attempts is reset. - At
block 28 the count of failed log on attempts is stored outside the primary O.S. file system. For instance, the count could be stored in a separate file allocation table (FAT) partition that can be read by the secondary O.S., such as IBM's Client Rescue and Recovery system. Because the user cannot gain local access into Windows due to the lost password, the user must change (e.g., by boot, hypervisor swap, or hibernation swap) to the secondary O.S., which upon starting up executes the decision atdiamond 30, namely, determining whether the count is great enough to trigger generation of a lost password signal atblock 32. The functional comparison logic is controlled by policy including enablement and conditions of comparison. If desired, the lost password signal can indicate a certainty level regarding whether the password-truly is lost, depending on the magnitude of the number of failed log on attempts. - In the context or a BIOS system password, the above logic is essentially followed, with the following caveats. It is possible to allow a version of the secondary O.S. to run even if the BIOS system password, the primary O.S. password, or both are required but unavailable. In the same fashion as mentioned above for the primary O.S. password, a failed BIOS system password count is maintained externally by the secondary O.S., which executes the logic above based on the failed BIOS log on count.
- In the context of a lost password for the HDD 20, the secondary O.S. is booted from another medium other than the local HDD, i.e., from the
alternate medium 22, and then the logic above is executed based on a count of failed HDD log on attempts that is maintained externally by the secondary O.S. Alternatively, instead of using thealternate medium 22, a limited version of the secondary O.S. can be stored on and can boot and run from the HDD 20 without the HDD password, but because this would require a significant change to current HDDs, it is not preferred. The principles above may also be invoked to sense a lost application password. -
FIG. 3 shows generic logic that can be implemented in the secondary O.S. by the effector mechanism to remedy (as by resetting) a lost password. To exemplify the logic, it will first be assumed that a primary O.S. password has been lost, requiring a password reset. - Commencing at
block 34, the lost password signal from the sensor mechanism can be received, or a user-generated (manual) reset request can be received. Atblock 36, the user is authenticated. The nature of the authentication required is determined by policy. In some systems, for instance, users may be prohibited from resetting passwords altogether. On the other hand, in some systems select groups of users may be required to use some form of hardware token as part of the authentication, while for other users, a simple Internet password may be sufficient to authenticate the user. In the context of resetting BIOS or HDD passwords, it may be preferred that strong user and system authentication and hardware support be used, e.g., strong authentication that is tied to a hardware token. - Proceeding to block 38 assuming successful authentication at
block 36, an intermediate password is automatically generated and provided to the user. At block 40, the user verifies receipt, such as by the mechanism of entering the new password twice correctly in succession. - Once it has been verified that the user has received the new randomly generated password, at
block 42 the secondary O.S. signs and protects (as by encryption using public key/private key principles known in the art) the new password preferably with the strongest security mechanism available on thecomputer 12, e.g., software, an external hardware token, or embedded security. If thecomputer 12 has only software security to protect the primary O.S. password, for example, then protecting an intermediate version of the new password by a comparable security mechanism is appropriate Likewise, for acomputer 12 that uses an embedded security chip such as a trusted platform module (TPM), the same hardware can be used by the secondary O.S. to protect the new O.S. password. - Proceeding to block 44, the encrypted and signed intermediate password is written by the secondary O.S. to a location that can be accessed by the primary O.S. Proceeding to block 46, a primary O.S. Service that preferably runs with system administrator credentials at the start of the user's primary operating system monitors the presence of data indicating whether a new intermediate password exists and should be applied. If so, the signature is verified, and if it is valid, the password is decrypted and the primary O.S. password is reset by the service to the new intermediate password, which can then be used by the user to log on to or otherwise access the primary O.S. While effective for resetting a user O.S. password, the above logic preferably is not used to set the primary administrator's password, which is typically not used by end users in a managed large enterprise in any case.
- With this logic, the secondary O.S. need not know the primary administrators O.S. password. Instead, the exchange of the new intermediate password is accomplished using existing public key technology.
- Alternatively, the Admin password for Windows or the Master password for the BIOS controlled Power On password or Hard Disk Drive password can be protected. Information can be passed to the system from a secure external network authenticated source, to allow the alternate O.S. to control a sequence in which it walks the user through the steps for resetting the corresponding user password without revealing the master or admin password in any case.
- In the context of resetting a lost BIOS or HDD password, the above logic may be invoked with the following caveats. The logic of
FIG. 3 can be used to allow the reset of either the user level BIOS/HDD password or the master password that is intended for the entire information technology (IT) organization. Optionally the logic can allow the user level password to be reset by giving the secondary O.S. access to the master password. In the case of the user level password, the user receives and validates his or her reception of the new password as described, but in the case of resetting a master password, the intermediate master password can be directly transferred to the system's BIOS without user intervention. - The logic of
FIG. 3 can also be used to reset a primary O.S. application password, such as might be required for individual applications such as Lotus Notes which provide an external mechanism for securely resetting the user password, namely, the users ID file. Or, the application can use a more comprehensive and simpler approach using a password banking technology. In either approach the credentials can be protected locally, by software or embedded security, or remotely and applied after any required authentication as required by the particular local policy. In the typical case of losing the password to a bank, the credentials to the bank itself have been lost, but the credentials for the individual applications are still protected in the bank. If the entire bank is lost or damaged for some reason, then either a remotely stored version of the bank must first be restored, or the situation reverts to the individual application case. The logic ofFIG. 3 can be used where the secondary O.S. authenticates and validates a new randomly generated password then passes the information through a primary O.S. service to either the individual application or the password bank as appropriate. - With the above in mind, it may now be appreciated that the present invention functions for a broad spectrum of platforms with differing levels of security by providing a level of security for the password reset process which is consistent with that elsewhere in the system. Also, the sensor mechanisms transparently detect the lost password situations, thus removing some or all of the burden on the user. Moreover, the effector mechanism can reset a password when the
computer 12 is in a disconnected mode if desired by policy. Furthermore, the password can be reset by a remotely controlled but still automated mechanism. And, system manager/administrator have as much or as little control over the reset process as desired through policy, which can differ from sub-group to sub-group within an information technology (IT)-managed organization. - While the particular SYSTEM AND METHOD FOR AUTOMATIC PASSWORD RESET as herein shown and described in detail is fully capable of attaining the above-described objects of the invention, it is to be understood that it is the presently preferred embodiment of the present invention and is thus representative of the subject matter which is broadly contemplated by the present invention, that the scope of the present invention fully encompasses other embodiments which may become obvious to those skilled in the art, and that the scope of the present invention is accordingly to be limited by nothing other than the appended claims, in which reference to an element in the singular is not intended to mean “one and only one” unless explicitly so stated, but rather “one or more”. It is not necessary for a device or method to address each and every problem sought to be solved by the present invention, for it to be encompassed by the present claims. Furthermore, no clement, component, or method step in the present disclosure is intended to be dedicated to the public regardless of whether the element, component, or method step is explicitly recited in the claims. Absent express definitions herein, claim terms are to be given all ordinary and accustomed meanings that are not irreconcilable with the present specification and file history.
Claims (14)
1-8. (canceled)
9. A service comprising:
maintaining a count of a number of failed log on attempts;
making the count available to a secondary computer operating system (O.S.), the secondary O.S. being a different O.S. than a primary O.S. used by a computer associated with the log on attempts; and
based at least in part on the relationship of the count with a threshold, using the secondary O.S., selectively generating a password reset signal.
10. (canceled)
11. The service of Claim 9, further comprising resetting the count upon the occurrence of a successful logon attempt.
12. A system comprising:
a computer readable medium bearing;
means for maintaining a count of a number of failed log on attempts;
means for making the count available to a secondary computer operating system (O.S.), the secondary O.S. being a different O.S. than a primary O.S. used by a computer associated with the log on attempts; and
means for, executable by the secondary O.S. and based at least in part on the relationship of the count with a threshold, selectively generating a pas-word reset signal.
13. A service comprising:
automatically generating an intermediate password using a secondary operating system; and
using the secondary operating system, providing the intermediate password to a primary operating system to reset an operating password associated with at least one of: a primary operating system (O.S.), a hard disk drive (HDD), and a basic input output system (BIOS).
14. The service of claim 13 , wherein the act of automatically generating is undertaken in response to a user-generated reset signal.
15. The service of claim 13 , wherein the act of automatically generating is undertaken in response to an automatically generated reset signal generated at least in part based on a number of failed log on attempts.
16. The service of claim 13 , wherein the BIOS is associated with at least one BIOS password, the BIOS password establishing the operating password.
17. The service of claim 13 , wherein the primary O.S. is associated with at least one primary O.S. password, the primary O.S. password establishing the operating password.
18. The service of claim 13 , wherein the HDD is associated with at least one HDD password, the HDD password establishing the operating password.
19. The service of claim 13 , wherein the secondary O.S. sends the intermediate password to a user and receives back verification of receipt, and then protects the password prior to making the password available to the primary O.S.
20. The service of claim 13 , wherein the secondary O.S. makes the intermediate password available to the primary O.S., and wherein the primary O.S. determines when an intermediate password is available upon start up of the primary O.S., and if so, resets at least one password to be the intermediate password.
21. A computer system for resetting an operating password associated with at least one of a primary operating system (O.S.), a hard disk drive (HDD), and a basic input output system (BIOS), comprising
a computer readable medium bearing:
means for automatically generating an intermediate password using a secondary operating system; and
means for providing the intermediate password to a primary operating system using the secondary operating system to reset the operating password.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US11/950,755 US20080141037A1 (en) | 2003-12-23 | 2007-12-05 | System and method for automatic password reset |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/744,440 US7383575B2 (en) | 2003-12-23 | 2003-12-23 | System and method for automatic password reset |
US11/950,755 US20080141037A1 (en) | 2003-12-23 | 2007-12-05 | System and method for automatic password reset |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/744,440 Continuation US7383575B2 (en) | 2003-12-23 | 2003-12-23 | System and method for automatic password reset |
Publications (1)
Publication Number | Publication Date |
---|---|
US20080141037A1 true US20080141037A1 (en) | 2008-06-12 |
Family
ID=34678856
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/744,440 Active 2025-11-07 US7383575B2 (en) | 2003-12-23 | 2003-12-23 | System and method for automatic password reset |
US11/950,755 Abandoned US20080141037A1 (en) | 2003-12-23 | 2007-12-05 | System and method for automatic password reset |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/744,440 Active 2025-11-07 US7383575B2 (en) | 2003-12-23 | 2003-12-23 | System and method for automatic password reset |
Country Status (1)
Country | Link |
---|---|
US (2) | US7383575B2 (en) |
Cited By (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20090006857A1 (en) * | 2007-06-29 | 2009-01-01 | Anton Cheng | Method and apparatus for starting up a computing system |
US20090178126A1 (en) * | 2008-01-03 | 2009-07-09 | Sterling Du | Systems and methods for providing user-friendly computer services |
US8819769B1 (en) | 2012-03-30 | 2014-08-26 | Emc Corporation | Managing user access with mobile device posture |
US8875263B1 (en) * | 2012-03-29 | 2014-10-28 | Emc Corporation | Controlling a soft token running within an electronic apparatus |
US20150095631A1 (en) * | 2013-09-30 | 2015-04-02 | Dell Products L.P. | Systems and methods for binding a removable cryptoprocessor to an information handling system |
US9660982B2 (en) * | 2012-02-01 | 2017-05-23 | Amazon Technologies, Inc. | Reset and recovery of managed security credentials |
US9767262B1 (en) | 2011-07-29 | 2017-09-19 | Amazon Technologies, Inc. | Managing security credentials |
US10362019B2 (en) | 2011-07-29 | 2019-07-23 | Amazon Technologies, Inc. | Managing security credentials |
US10475018B1 (en) | 2013-11-29 | 2019-11-12 | Amazon Technologies, Inc. | Updating account data for multiple account providers |
US10505914B2 (en) | 2012-02-01 | 2019-12-10 | Amazon Technologies, Inc. | Sharing account information among multiple users |
US11082422B2 (en) | 2009-08-12 | 2021-08-03 | Amazon Technologies, Inc. | Authentication manager |
US20220129900A1 (en) * | 2020-10-27 | 2022-04-28 | Payfone, Inc. | Transaction authentication, authorization, and/or auditing utilizing subscriber-specific behaviors |
US11423138B2 (en) * | 2018-11-14 | 2022-08-23 | Hewlett-Packard Development Company, L.P. | Firmware access based on temporary passwords |
US11444936B2 (en) | 2011-07-29 | 2022-09-13 | Amazon Technologies, Inc. | Managing security credentials |
US11671819B2 (en) | 2019-02-12 | 2023-06-06 | Prove Identity, Inc. | Systems and methods for porting communication devices |
Families Citing this family (33)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20050175201A1 (en) * | 2004-02-06 | 2005-08-11 | Herman Barry S. | Secure key reset using encryption |
US9589117B2 (en) | 2004-02-17 | 2017-03-07 | Hewlett-Packard Development Company, L.P. | Computer security system and method |
JP4550526B2 (en) * | 2004-08-27 | 2010-09-22 | レノボ シンガポール プライヴェート リミテッド | Information processing system, information processing apparatus, registration server, control program, and control method |
US7401212B2 (en) * | 2004-11-01 | 2008-07-15 | Microsoft Corporation | Self-contained computer servicing device |
US8078881B1 (en) * | 2004-11-12 | 2011-12-13 | Liu Gary G | Password resetting method |
US7809950B2 (en) * | 2005-03-02 | 2010-10-05 | Dell Products L.P. | System and method for access to a password protected information handling system |
US7624279B2 (en) * | 2005-06-29 | 2009-11-24 | Lenovo Singapore Pte. Ltd. | System and method for secure O.S. boot from password-protected HDD |
EP1755075A1 (en) * | 2005-08-04 | 2007-02-21 | Sap Ag | Method and system for secured execution of an activity in a workflow process |
US7861287B2 (en) * | 2006-05-17 | 2010-12-28 | International Business Machines Corporation | System and method for utilizing audit information for challenge/response during a password reset process |
US8171302B2 (en) * | 2006-05-30 | 2012-05-01 | Hewlett-Packard Development Company, L.P. | Method and system for creating a pre-shared key |
US20080120423A1 (en) * | 2006-11-21 | 2008-05-22 | Hall David N | System and method of actively establishing and maintaining network communications for one or more applications |
US8239674B2 (en) * | 2006-11-21 | 2012-08-07 | Kabushiki Kaisha Toshiba | System and method of protecting files from unauthorized modification or deletion |
US20080120716A1 (en) * | 2006-11-21 | 2008-05-22 | Hall David N | System and method for enhancing security of an electronic device |
US7874011B2 (en) * | 2006-12-01 | 2011-01-18 | International Business Machines Corporation | Authenticating user identity when resetting passwords |
US8046827B2 (en) * | 2007-06-12 | 2011-10-25 | Francisco Corella | Access control of interaction context of application |
US8474022B2 (en) * | 2007-06-15 | 2013-06-25 | Microsoft Corporation | Self-service credential management |
US20080313730A1 (en) * | 2007-06-15 | 2008-12-18 | Microsoft Corporation | Extensible authentication management |
US7882340B2 (en) | 2007-07-31 | 2011-02-01 | Hewlett-Packard Development Company, L.P. | Fingerprint reader remotely resetting system and method |
US8090955B2 (en) | 2007-10-17 | 2012-01-03 | Micron Technology, Inc. | Boot block features in synchronous serial interface NAND |
US8397077B2 (en) | 2007-12-07 | 2013-03-12 | Pistolstar, Inc. | Client side authentication redirection |
US20090276837A1 (en) * | 2008-04-30 | 2009-11-05 | Microsoft Corporation | Credential equivalency and control |
US7587767B1 (en) * | 2008-05-27 | 2009-09-08 | International Business Machines Corporation | Systems and methods of transferring computer hardware |
US8291470B2 (en) * | 2008-12-10 | 2012-10-16 | International Business Machines Corporation | Conditional supplemental password |
US8973113B1 (en) * | 2010-04-15 | 2015-03-03 | Crimson Corporation | Systems and methods for automatically resetting a password |
US8990909B2 (en) * | 2013-06-25 | 2015-03-24 | Bank Of America Corporation | Out-of-band challenge question authentication |
US9563773B2 (en) * | 2014-02-26 | 2017-02-07 | Dell Products L.P. | Systems and methods for securing BIOS variables |
US9882893B2 (en) | 2015-09-15 | 2018-01-30 | Honeywell International Inc. | System and method for secured password management for industrial devices |
US10162956B1 (en) | 2018-07-23 | 2018-12-25 | Capital One Services, Llc | System and apparatus for secure password recovery and identity verification |
US11138308B2 (en) | 2018-09-19 | 2021-10-05 | International Business Machines Corporation | System for preventing single point of failure in accessing encrypted data |
US11321443B2 (en) * | 2018-11-02 | 2022-05-03 | EMC IP Holding Company, LLC | Password resetting system and method |
US10699330B2 (en) | 2018-11-28 | 2020-06-30 | Capital One Services, Llc | System and apparatus for geo-location based data analysis |
US11616774B2 (en) * | 2019-01-17 | 2023-03-28 | Blackberry Limited | Methods and systems for detecting unauthorized access by sending a request to one or more peer contacts |
US20230222202A1 (en) * | 2020-07-16 | 2023-07-13 | Hewlett-Packard Development Company, L.P. | Bios passwords |
Citations (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5937159A (en) * | 1997-03-28 | 1999-08-10 | Data General Corporation | Secure computer system |
US20020065913A1 (en) * | 2000-11-29 | 2002-05-30 | Harrington Gregory Lee | Network password reset system |
US20020147914A1 (en) * | 2001-04-05 | 2002-10-10 | International Business Machines Corporation | System and method for voice recognition password reset |
US20030182584A1 (en) * | 2002-03-22 | 2003-09-25 | John Banes | Systems and methods for setting and resetting a password |
US6668323B1 (en) * | 1999-03-03 | 2003-12-23 | International Business Machines Corporation | Method and system for password protection of a data processing system that permit a user-selected password to be recovered |
US20040153724A1 (en) * | 2003-01-30 | 2004-08-05 | Microsoft Corporation | Operating system update and boot failure recovery |
US6868406B1 (en) * | 1999-10-18 | 2005-03-15 | Stamps.Com | Auditing method and system for an on-line value-bearing item printing system |
US6871286B1 (en) * | 1999-07-29 | 2005-03-22 | Hewlett-Packard Development Company, L.P. | Method and apparatus for resetting passwords in a computer system |
US7240219B2 (en) * | 2003-05-25 | 2007-07-03 | Sandisk Il Ltd. | Method and system for maintaining backup of portable storage devices |
Family Cites Families (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH11212922A (en) | 1998-01-22 | 1999-08-06 | Hitachi Ltd | Password management and recovery system |
US6237100B1 (en) * | 1998-12-02 | 2001-05-22 | International Business Machines Corporation | Power passwords within a data processing system for controlling a supply of system power |
AU5443400A (en) | 1999-05-25 | 2000-12-12 | Engineering Systems Solutions, Inc. | System and method for high assurance separation of internal and external networks |
US6763458B1 (en) * | 1999-09-27 | 2004-07-13 | Captaris, Inc. | System and method for installing and servicing an operating system in a computer or information appliance |
US6978385B1 (en) * | 2000-03-01 | 2005-12-20 | International Business Machines Corporation | Data processing system and method for remote recovery of a primary password |
GB2367656A (en) * | 2000-10-06 | 2002-04-10 | Hewlett Packard Co | Self-repairing operating system for computer entities |
WO2002087152A1 (en) * | 2001-04-18 | 2002-10-31 | Caveo Technology, Llc | Universal, customizable security system for computers and other devices |
US20030028813A1 (en) * | 2001-08-02 | 2003-02-06 | Dresser, Inc. | Security for standalone systems running dedicated application |
US7137026B2 (en) * | 2001-10-04 | 2006-11-14 | Nokia Corporation | Crash recovery system |
US20030093680A1 (en) * | 2001-11-13 | 2003-05-15 | International Business Machines Corporation | Methods, apparatus and computer programs performing a mutual challenge-response authentication protocol using operating system capabilities |
US20040255106A1 (en) * | 2003-06-10 | 2004-12-16 | Rothman Michael A. | Recovery of operating system configuration data by firmware of computer system |
-
2003
- 2003-12-23 US US10/744,440 patent/US7383575B2/en active Active
-
2007
- 2007-12-05 US US11/950,755 patent/US20080141037A1/en not_active Abandoned
Patent Citations (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5937159A (en) * | 1997-03-28 | 1999-08-10 | Data General Corporation | Secure computer system |
US6668323B1 (en) * | 1999-03-03 | 2003-12-23 | International Business Machines Corporation | Method and system for password protection of a data processing system that permit a user-selected password to be recovered |
US6871286B1 (en) * | 1999-07-29 | 2005-03-22 | Hewlett-Packard Development Company, L.P. | Method and apparatus for resetting passwords in a computer system |
US6868406B1 (en) * | 1999-10-18 | 2005-03-15 | Stamps.Com | Auditing method and system for an on-line value-bearing item printing system |
US20020065913A1 (en) * | 2000-11-29 | 2002-05-30 | Harrington Gregory Lee | Network password reset system |
US20020147914A1 (en) * | 2001-04-05 | 2002-10-10 | International Business Machines Corporation | System and method for voice recognition password reset |
US20030182584A1 (en) * | 2002-03-22 | 2003-09-25 | John Banes | Systems and methods for setting and resetting a password |
US20040153724A1 (en) * | 2003-01-30 | 2004-08-05 | Microsoft Corporation | Operating system update and boot failure recovery |
US7240219B2 (en) * | 2003-05-25 | 2007-07-03 | Sandisk Il Ltd. | Method and system for maintaining backup of portable storage devices |
Cited By (18)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20090006857A1 (en) * | 2007-06-29 | 2009-01-01 | Anton Cheng | Method and apparatus for starting up a computing system |
US20090178126A1 (en) * | 2008-01-03 | 2009-07-09 | Sterling Du | Systems and methods for providing user-friendly computer services |
US11082422B2 (en) | 2009-08-12 | 2021-08-03 | Amazon Technologies, Inc. | Authentication manager |
US10362019B2 (en) | 2011-07-29 | 2019-07-23 | Amazon Technologies, Inc. | Managing security credentials |
US9767262B1 (en) | 2011-07-29 | 2017-09-19 | Amazon Technologies, Inc. | Managing security credentials |
US11444936B2 (en) | 2011-07-29 | 2022-09-13 | Amazon Technologies, Inc. | Managing security credentials |
US9660982B2 (en) * | 2012-02-01 | 2017-05-23 | Amazon Technologies, Inc. | Reset and recovery of managed security credentials |
US11381550B2 (en) | 2012-02-01 | 2022-07-05 | Amazon Technologies, Inc. | Account management using a portable data store |
US10505914B2 (en) | 2012-02-01 | 2019-12-10 | Amazon Technologies, Inc. | Sharing account information among multiple users |
US8875263B1 (en) * | 2012-03-29 | 2014-10-28 | Emc Corporation | Controlling a soft token running within an electronic apparatus |
US8819769B1 (en) | 2012-03-30 | 2014-08-26 | Emc Corporation | Managing user access with mobile device posture |
US10013563B2 (en) * | 2013-09-30 | 2018-07-03 | Dell Products L.P. | Systems and methods for binding a removable cryptoprocessor to an information handling system |
US20150095631A1 (en) * | 2013-09-30 | 2015-04-02 | Dell Products L.P. | Systems and methods for binding a removable cryptoprocessor to an information handling system |
US11004054B2 (en) | 2013-11-29 | 2021-05-11 | Amazon Technologies, Inc. | Updating account data for multiple account providers |
US10475018B1 (en) | 2013-11-29 | 2019-11-12 | Amazon Technologies, Inc. | Updating account data for multiple account providers |
US11423138B2 (en) * | 2018-11-14 | 2022-08-23 | Hewlett-Packard Development Company, L.P. | Firmware access based on temporary passwords |
US11671819B2 (en) | 2019-02-12 | 2023-06-06 | Prove Identity, Inc. | Systems and methods for porting communication devices |
US20220129900A1 (en) * | 2020-10-27 | 2022-04-28 | Payfone, Inc. | Transaction authentication, authorization, and/or auditing utilizing subscriber-specific behaviors |
Also Published As
Publication number | Publication date |
---|---|
US20050138399A1 (en) | 2005-06-23 |
US7383575B2 (en) | 2008-06-03 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7383575B2 (en) | System and method for automatic password reset | |
US10909249B2 (en) | Protecting computing devices from unauthorized access | |
US5949882A (en) | Method and apparatus for allowing access to secured computer resources by utilzing a password and an external encryption algorithm | |
US8201239B2 (en) | Extensible pre-boot authentication | |
US5887131A (en) | Method for controlling access to a computer system by utilizing an external device containing a hash value representation of a user password | |
EP3125149B1 (en) | Systems and methods for securely booting a computer with a trusted processing module | |
US5960084A (en) | Secure method for enabling/disabling power to a computer system following two-piece user verification | |
US8909940B2 (en) | Extensible pre-boot authentication | |
US6400823B1 (en) | Securely generating a computer system password by utilizing an external encryption algorithm | |
US5953422A (en) | Secure two-piece user authentication in a computer network | |
US8281135B2 (en) | Enforcing use of chipset key management services for encrypted storage devices | |
JP4982825B2 (en) | Computer and shared password management methods | |
KR100806477B1 (en) | Remote access system, gateway, client device, program, and storage medium | |
US8156331B2 (en) | Information transfer | |
US20070101156A1 (en) | Methods and systems for associating an embedded security chip with a computer | |
US20080168545A1 (en) | Method for Performing Domain Logons to a Secure Computer Network | |
US20050228993A1 (en) | Method and apparatus for authenticating a user of an electronic system | |
US20050033970A1 (en) | System and method for securing access to memory modules | |
US7765407B2 (en) | Method and apparatus for providing centralized user authorization to allow secure sign-on to a computer system | |
US20220147634A1 (en) | Client authentication and data management system | |
JP4724107B2 (en) | User authentication method using removable device and computer |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- AFTER EXAMINER'S ANSWER OR BOARD OF APPEALS DECISION |