Dynamic password generation

Abstract

A computer-implemented method for permitting access to electronic information, wherein the method comprises: - Receiving (610) a first password string from a user by a first computer (110) from a second computer (126) over a network (130) in response to information entered through a user interface (128) of the second computer (126) and to a rule for configuring and generating a second password string from the first password string, wherein the rule specifies a dynamic element to be inserted at a specified position in the first password string depending on a first context information from the user and wherein a value of the specified dynamic element is determined depending on a second context information from the user; - in response to the first computer (110) receiving a third password string from the user from the second computer (126) via a network (130) using information entered through the user interface (128) of the second computer (126): o Configuring and generating (612) the second password string from the first password string by the first computer (110) depending on the received rule by: ▪ Selecting the specified dynamic element depending on the first context information provided by the user; ▪ Inserting the selected dynamic element into the first password string at the specified position; and ▪ Determining the value of the selected dynamic element depending on the second contextual information provided by the user; and ▪ in response to the first computer (110) determining that the third password string matches the second password string (620), allow the first computer (110) to access the electronic information to the second computer (126).

Description

BACKGROUND

[0001] Embodiments of the invention generally relate to data security and, in particular, to automatic password generation and use.

[0002] Access to electronic data is often granted using security credentials such as passwords. Given increasing threats, maintaining password security is a challenge. A common approach to improving password security is to require users to choose passwords with minimum security requirements, such as at least eight characters, at least one number, at least one uppercase letter, and / or at least one special character. However, there are methods that can circumvent such static passwords, such as brute-force attacks, social engineering, remote access tools (RATs), keyloggers, phishing, and rainbow tables.

[0003] Document US 2003 0037262 A1 describes a method for generating a dynamic password, comprising providing a plurality of variable parameters, wherein each parameter from the plurality of variable parameters is variable according to predefined criteria; providing a plurality of predefined static parameters; and processing at least some of the plurality of variable parameters and the predefined static parameters according to an equation to generate a dynamic password, which manipulates at least some of the plurality of variable parameters and the predefined static parameters, resulting in an ordered sequence of dynamic and static parameters.

[0004] The document “PHP Manual. Section “Expressions”” by ACHOUR, M. et al., last updated: December 16, 2015. URL: https: / / web.archive.org / web / 20151216050720 / http: / / php.net / manual / en / language.expressions.php [accessed on 24.09.2020] describes the implementation of expressions in PHP.

[0005] The document “PHP Manual. Section “Arithmetic Operators”” by ACHOUR, M. et al., last updated: December 16, 2015. URL: https: / / web.archive.org / web / 20151215190135 / http: / / php.net / manual / en / language.operators.arithmetic.php [accessed on 24.09.2020] describes the implementation of arithmetic operators in PHP. SUMMARY

[0006] The invention is described by the features of the independent claims. Embodiments are specified in the dependent claims.

[0007] Embodiments of the present invention provide a method, system and computer program product for generating and verifying an authorization check of a dynamic password.

[0008] In one embodiment of the invention, a first password string is received from a user. One or more string generation rules with corresponding reference character positions of the first password string are received. The first password string, the string generation rules, and the corresponding reference character positions of the first password string are assigned to login credentials of a user.

[0009] In a further embodiment of the invention, a first password string belonging to a user is received. A first sub-password string belonging to the user is retrieved. One or more string generation rules belonging to the user, with corresponding reference character positions of the first sub-password string, are identified. Sub-password strings are generated based on the string generation rules. A second password string is generated by concatenating the first sub-password string and the generated sub-password strings based on the corresponding reference character positions of the first sub-password string. The first password string is compared with the second password string, and the user's authorization is confirmed based on a match between the first and second password strings. BRIEF DESCRIPTION OF THE DRAWINGS Fig. Figure 1 is a functional block diagram of a dynamic password system according to an embodiment of the present invention. Fig. Figure 2 is a representation of an exemplary user interface for configuring rules when generating or using dynamic passwords according to an embodiment of the present invention. Fig. Figure 3 is a representation of an exemplary user interface for generating or using a dynamic password according to an embodiment of the present invention. Fig. Figure 4 is a representation of a user interface for using a dynamic password according to an embodiment of the invention. Fig. Figure 5 is a flowchart that represents functional steps of a dynamic password program according to an embodiment of the present invention. Fig.Figure 6 is a further flowchart that represents further functional steps of a dynamic password program according to an embodiment of the present invention. Fig. Figure 7 is a block diagram of an exemplary data processing unit according to an embodiment of the invention. Fig. Figure 8 represents a cloud data processing environment according to an embodiment of the present invention. Fig. 9 presents abstraction model layers of the cloud data processing environment Fig. 8 according to an embodiment of the present invention. DETAILED DESCRIPTION

[0010] Existing password systems are limited for at least the following reasons: They are static and do not change automatically; changes require user input; passwords retain a fixed length even if they use special characters; passwords remain static for a specific period of time; computer-generated passwords are usually complex strings that are difficult to remember; and increased password complexity may require users to record passwords on a medium (for example, using pen and paper or in unencrypted electronic notes or files), which increases the likelihood of unauthorized access to the password data.Static passwords are typically stored in encrypted form, not as plaintext. However, a coordinated attack, for example using a rainbow table, could potentially crack such a password. A password policy that goes beyond stored, static passwords would provide additional protection against security breaches.

[0011] With a dynamic password, a user can add dynamic elements to a static password, for example, based on contextual information associated with the user. Using a dynamic password aims to make the static password more secure. Contextual elements that could be generated for inclusion in a dynamic password include the user's location, PIN code, and state, as well as the current time, date, month, day of the week, and so on. Instead of using a static password for authentication, the user enters a password based on predefined patterns and / or rules, which depend on the values ​​of the dynamic elements. The server process that performs password authentication uses these same patterns and rules to generate the correct password and verifies that the user password and the server password match.Thus, a password entered on one particular day can differ from a password entered by the same user for the same portal on another day. Nevertheless, the user's authorization is confirmed as long as the patterns and rules defined by the user are followed. This approach would render most current password-cracking methods ineffective, since passwords generated in this way do not necessarily have a consistent length or type, nor are they stored in a format that represents a static string.

[0012] Embodiments of the present invention disclose a computer-implemented method, computer program product, and system for dynamic password generation. A user creates a dynamic password based on an initial static password string and subsequently one or more patterns and / or one or more string generation rules, which are then stored in a password data store. Upon logging in, the user enters a password that matches the specified dynamic password. A server process, which performs a password authorization check, receives the dynamic password from the user, retrieves the stored static password from the password data store, and converts it into a final password based on the associated patterns and / or rules. If the password entered by the user and the password generated by the server match, the user's authorization is confirmed.

[0013] Fig. Figure 1 is a functional block diagram of a dynamic password system 100 according to an embodiment of the present invention. The dynamic password system 100 includes a data processing unit 110, which is shown to house a dynamic password program 112, a password data storage 120, and a client data processing unit 126, all of which are interconnected via a network 130. Fig. Figure 1 merely provides an illustration of one embodiment and implies no limitations with regard to the environments in which different embodiments may be realized. A person skilled in the art can make many modifications to the depicted environment without deviating from the scope of the invention as defined by the claims.

[0014] The data processing unit 110 represents the data processing environment or platform that hosts the dynamic password program 112. In various embodiments, the data processing unit 110 can be a laptop computer, a netbook computer, a personal computer (PC), a desktop computer, or any programmable electronic device capable of hosting the dynamic password program 112 described below and exchanging data with the client data processing unit 126 via the network 130, according to embodiments of the invention. As shown and further below with regard to Fig. As described in more detail in section 7, the data processing unit 110 can include internal and external hardware components. In other embodiments, the data processing unit 110 can be implemented in a cloud data processing environment, as described below with regard to the Fig. 8 and Fig. 9 is described.

[0015] According to one embodiment of the present invention, the password data store 120 represents a storage of data associated with user passwords. For example, the password data store 120 can contain a database of dynamic password patterns and rules that are associated with specific users. The password data store 120 can, for example, be located on computer-readable storage media 908 ( Fig. 7).

[0016] In one exemplary embodiment, the client data processing unit 126 represents a source of user password data and associated commands received via the data processing unit 110. The client data processing unit 126 may include a graphical user interface (GUI) 128 with which a user can generate and use a dynamic password. In various embodiments, the GUI 128 may, for example, be a web browser that receives web pages transmitted via the data processing unit 110, or a dedicated application that serves as an interface to the dynamic password program 112 on the data processing unit 110. In other embodiments, the client data processing unit 126 may represent another unit that serves as an interface to the data processing unit 110 and is necessary to use password authorization validation.

[0017] In various embodiments of the invention, a client data processing unit 126 can be, for example, a laptop computer, a tablet computer, a netbook computer, a personal computer (PC), a desktop computer, a personal digital assistant (PDA), or a smartphone. In general, a client data processing unit 126 can be any programmable electronic device capable of exchanging data with the data processing unit 110 over the network 130 and supporting functionality as required by one or more embodiments of the invention. As shown and further below with regard to Fig. As described in more detail in section 7, a client data processing unit can include 126 internal and external hardware components.

[0018] For example, the network 130 can be a local area network (LAN), a telecommunications network, a wide area network (WAN) such as the Internet, a virtual local area network (VLAN), or any combination thereof, which may include wired, wireless, or optical connections. In general, the network 130 can be any combination of connections and protocols that, according to embodiments of the present invention, supports data transmissions between the data processing unit 110, the password data storage 120, the client data processing unit 126, and the function of the dynamic password program 112 in the dynamic password system 100.

[0019] In one embodiment of the invention, the data processing unit 110 includes the dynamic password program 112. The dynamic password program 112 can further include a password generation unit 114, a pattern / rule module 116 and an authorization check module 118.

[0020] The dynamic password program 112 generally serves to receive information associated with a user's login credentials, such as a static password string and one or more patterns and / or one or more string generation rules, which it stores in the password data store 120. When a user then enters a password as part of a login procedure, the dynamic password program 112 retrieves the static password string, patterns, and rules associated with the user and uses them to generate a second password. If the password entered by the user and the generated second password match, the user can be granted access to the user's account.

[0021] As described below, the password generation unit 114 according to an embodiment of the present invention serves to generate a dynamic password from a static password string according to predefined patterns and / or string generation rules belonging to a user.

[0022] As described below, the pattern / rule module 116, according to one embodiment of the present invention, enables a user to define patterns and / or rules that are used with a dynamic password. The pattern / rule module 116 can store the patterns and / or rules in the password data store 120 and assign them to the user.

[0023] In one embodiment of the invention, a user defines patterns and / or rules for a dynamic password via the pattern / rule module 116 by using a GUI designed for this purpose, such as the one described in the Fig. 2 and Fig.The GUIs shown in Figure 3 are used. In another embodiment, the pattern / rule module 116 can provide the user with one or more patterns to be used when entering a password. For example, a user can log on to the data processing unit 110 via the client data processing device 126 and enable dynamic password generation via a user setting. Once the setting is enabled, the user calls the pattern / rule module 116 to define the patterns and / or rules to be used with the dynamic password.

[0024] A pattern is a predefined data element associated with a user, such as context data, that is to be inserted at a specified position in a static password string. The specified position is called a reference character position. A pattern is a simple example of a string generation rule, as described in more detail below. For example, a user can define a pattern using the rule "sher{TIME}lock", which specifies that the current time value (at login) should be inserted into the name "sherlock" at the character position where the expression {TIME} appears in the dynamic password. Alternatively, the user can select a specific, constant string value to be used in the defined pattern.

[0025] Table 1 contains additional example password patterns that can be defined by the user: TABLE 1 EXAMPLE PASSWORD PATTERN PATTERN PASSWORD REMARK she{DAY}lock sherMONDAYlock User logs in on Monday sher{GRIDB}lock sher87lock Bank provides UserGrid card (see below) sher{PINCODE}lock sher560071lock User enters a PIN sherlock{STATE}{PINCODE} sherlockVERMONT560071 User enters state and PIN

[0026] In the examples above, the length, type, and pattern vary. This irregularity prevents a hacker from guessing the actual password based on assumptions about its length, type, or other characteristics.

[0027] According to one embodiment of the present invention, the authorization verification module 118 receives a password entered by a user, compares the password with another password generated by the password generation unit 114, and confirms the user's authorization if the two passwords match.

[0028] As an example, a user attempts to log in to an account on an online banking website at 4:20 PM via the client data processing unit 126. The user is prompted to enter a username and password. When prompted for a password, the user enters "sher1620lock". The password is then passed to the authorization check module 118 of the dynamic password program 112, which in turn queries the password data store 120 to retrieve any predefined, dynamic password patterns and / or rules belonging to the user. The password generation unit 114 then generates the actual password based on the retrieved patterns and / or rules. In this example, the stored pattern is "sher{TIME}lock". Since the user logged in at 4:20 PM, the password generated by the password generation unit 114 is "sher1620lock".The authorization check module 118 verifies whether there is a match between the generated password and the password entered by the user. If the passwords match, the user's authorization is confirmed, and they can gain access to the account.

[0029] Whenever a user defines a pattern or rule for a dynamic password, the pattern / rule module 116 can store the pattern or rule in the password data store 120 and associate it with the user. Later, when the authorization check module 118 needs to verify the user's authorization, it recognizes that a dynamic password is being used and requests the password generation unit 114 to retrieve the stored rules and patterns to generate the actual password. The authorization check module 118 allows access to the user's account, provided the received password and the generated password match.

[0030] The Pattern / Rule module 116 can simplify the process of creating patterns or rules by providing a graphical user interface (GUI) to customize the patterns contained in the passwords. Fig. 2 and Fig.Figure 3 presents example GUIs that can allow a user to create a dynamic password according to different embodiments of the invention.

[0031] Fig. Figure 2 shows an exemplary user interface 200 for configuring rules when generating or using dynamic passwords according to an embodiment of the present invention. Using the exemplary user interface 200, a user can create customized rules and specify when and under what conditions these should be applied.

[0032] Fig.Figure 2 illustrates how, according to an embodiment of the invention, a user can define a sample rule via the exemplary user interface 200. A new password window 210 allows a user to assign a name, such as "Rule1", to a rule and to enable or disable it. A conditions window 220 allows the user to specify the conditions under which "Rule1", if enabled, should be used to generate a dynamic password. An actions window 230 allows the user to specify which actions should be performed when "Rule1" is present. In this case, "Rule1" specifies a substitution string. The specified rule is: If the (filing) time is "even", i.e., the number of minutes consists of an even number, the user is expected to provide "@123$" as a substitution string.For example, the user may be required to enter the expression {Rule1} for the purpose of authorization checking, as further below in . Fig. As shown in Figure 3, the string "@123$" is replaced with "@123$" whenever it occurs in a dynamic password, provided the login time is an even number. Other, more complex rules are also conceivable. For example, a rule could be: if the location is Phoenix and the time is an even number, or if the location is Boston and the time is an odd number, use the string "$123@".

[0033] In certain embodiments of the invention, a rule can be created from dynamic elements by a user, as described above. In other embodiments, a rule can be selected from a predefined set of rules. A list of predefined rules can be displayed to a user, for example, in a drop-down list in a GUI.

[0034] Fig. Figure 3 shows an exemplary user interface for generating and using a dynamic password according to an embodiment of the present invention. Using the exemplary user interface, a user can generate a dynamic password that includes a static part and one or more dynamic elements. In one embodiment of the invention, each dynamic element can be defined by a rule or a pattern. The static part and the dynamic elements can be stored in the password data storage 120.

[0035] Fig.Figure 3 illustrates how to define a dynamic password that includes both a pattern and a rule. In this example, the static password string is "sherlockStatic1234". The expression {TIME} represents a pattern that will be replaced by the current time at login. The expression {Rule1} represents a predefined string generation rule, such as the one in Fig. 2 defined rule that specifies that if the time is an even number, the expression {Rule1} should be replaced by the string “@123$” at the corresponding reference character position.

[0036] In various implementations, patterns and / or rules for dynamic passwords can specify contextual content such as locations or PIN codes, constant strings, or application-specific data such as grid values. Grid authentication is a method for securely performing user logins, where the user must enter values ​​from specific cells in a grid whose contents should only be accessible to the user and the service provider. The grid is typically on a map and consists of letters and numbers in rows and columns. For example, a rule might specify that, under certain user-defined conditions, a dynamic password should contain or consist of a sequence of characters selected from grid cells provided during authentication.Furthermore, a rule can specify a one-time password (OTP) if the user is given the option to generate an OTP via the application. For example, a rule can specify that a dynamic password should include or consist of an OTP under certain conditions configured by the user.

[0037] The user may also be shown various options on the login screen to simplify the process of providing the password upon login, as in Fig. Figure 4 shows that the login GUI can display information such as the time, location, user's PIN code, etc., and the user can use this information to generate the correct password at that time.

[0038] Fig.Figure 4 shows a sample user interface for using a dynamic password according to an embodiment of the present invention. A user can log in to an account via a login interface using dynamically generated information based on predefined patterns and / or rules. The dynamically generated information can include, for example, location, time, PIN code, etc. The login information can be used by the authorization verification module 118 to verify the user's authorization.

[0039] Fig.Figure 5 is a flowchart illustrating the various functional steps performed by the data transmission unit 110 when generating a dynamic password according to one embodiment of the invention. A user enters an initial, static password string and one or more string generation rules with corresponding reference character positions via a user interface on a client data processing unit 126. The client data processing unit 126 transmits the password string, the rules, and the reference character positions to the dynamic password program 112 on the data processing unit 110. The dynamic password program 112 receives the static password string (step 510) and the string generation rules with corresponding reference character positions (step 512).The dynamic password program 112 assigns the static password string and the string generation rules with their corresponding reference character positions to the user (step 514). The dynamic password program 112 stores the static password string, the string generation rules, and the corresponding reference character positions in the password data store 120 (step 516).

[0040] Fig.Figure 6 is a flowchart illustrating various functional steps that are confirmed by the data transmission unit 110 during an authorization check of a dynamic password according to one embodiment of the invention. A password string belonging to a user is received (step 610). The password generation unit 114 retrieves a stored, static password string belonging to the user from the password data store 120 (step 612). The password generation unit 114 identifies one or more string generation rules belonging to the user, as well as corresponding reference character positions (step 614). Using the string generation rules, the password generation unit 114 generates further password strings (step 616).The password generation unit 114 creates a final password string by concatenating the first string with the subsequent password strings at the reference character positions (step 618). The authorization check module 118 compares the password string received from the user with the final password string and, if there is a match, confirms the user's authorization (step 620).

[0041] Fig. Figure 7 shows a block diagram of 900 components of the data processing unit 110 ( Fig. 1) according to one embodiment of the present invention. It should be clear that Fig. Figure 7 serves only to illustrate one embodiment and implies no restrictions with regard to the environments in which different embodiments may be realized. Numerous modifications can be made to the depicted environment.

[0042] The data processing unit 110 can include one or more processors 902, one or more computer-readable RAMs 904, one or more computer-readable ROMs 906, one or more computer-readable storage media 908, unit drivers 912, a read / write drive or read / write interface 914, and a network adapter or network interface 916, all interconnected via a data transmission structure 918. The data transmission structure 918 can be implemented with any architecture designed to transmit and / or control data between processors (such as microprocessors, data transmission and network processors, etc.), system memory, peripheral units, and any other hardware components within a system.

[0043] One or more operating systems 910 and one or more application programs 928 such as the dynamic password program 112 ( Fig. 1) are stored on one or more of the computer-readable storage media 908 to be executed by one or more of the processors 902 via one or more of the RAMs 904 (which typically include a cache memory). In the illustrated embodiment, each of the computer-readable storage media 908 can be a magnetic disk storage unit of an internal hard disk, a CD-ROM, a DVD, a memory stick, a magnetic tape, a magnetic disk, an optical disk, a semiconductor storage unit such as a RAM, a ROM, an EPROM, a flash memory, or any other computer-readable physical storage unit capable of storing a computer program and digital data.

[0044] The data processing unit 110 may also include a read / write drive or a read / write interface 914 for reading from and writing to one or more portable, computer-readable storage media 926.

[0045] The application programs 928 on the client data processing unit and / or the data processing unit 110 can be stored on one or more of the portable, computer-readable storage media 926, read via the relevant read / write drive or read / write interface 914 and loaded into the relevant computer-readable storage media 908.

[0046] The data processing unit 110 may also include a network adapter or network interface 916, such as a TCP / IP adapter card or a wireless data transmission adapter (such as an adapter for wireless data transmission using OFDMA technology). Application programs 928 on the data processing unit 110 can be downloaded to the data processing unit from an external computer or storage device via a network (for example, the Internet, a local area network, or other wide area network or wireless network) and the network adapter or network interface 916. From the network adapter or network interface 916, the programs can be loaded onto computer-readable storage media 908. The network may include copper cables, fiber optic cables, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers.

[0047] The data processing unit 110 may also include a display screen 920, a keyboard or keypad 922, and a computer mouse or touchpad 924. The unit drivers 912 serve as an interface to the display screen 920 for displaying an image, to the keyboard or keypad 922, to the computer mouse or touchpad 924, and / or to the display screen 920 for detecting input of alphanumeric characters and user selections by touch. The unit drivers 912, the read / write drive or read / write interface 914, and the network adapter or network interface 916 may include hardware and software (stored on the computer-readable storage media 908 and / or the ROM 906).

[0048] The present invention may be a system, a method, and / or a computer program product. The computer program product may include a computer-readable storage medium (or media) containing computer-readable program instructions to instruct a processor to perform aspects of the present invention.

[0049] A computer-readable storage medium can be a physical unit capable of retaining and storing instructions for use by an instruction execution unit. For example, a computer-readable storage medium can be an electronic storage unit, a magnetic storage unit, an optical storage unit, an electromagnetic storage unit, a semiconductor storage unit, or any suitable combination of the foregoing, but not limited to these. A non-exhaustive list of more specific examples of computer-readable storage media includes: a portable computer disk, a hard disk, random-access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random-access memory (SRAM), a portable CD-ROM, a DVD, a flash drive, a floppy disk, a mechanically coded unit such as...Punched cards or raised structures in a groove with instructions recorded on them, as well as any suitable combination of the aforementioned elements. In the case of a computer-readable storage medium such as the one used here, it is not to be assumed that the signals are per se volatile, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses traveling through an optical fiber cable), or electrical signals transmitted over a wire.

[0050] The computer-readable program instructions described here can be downloaded from a computer-readable storage medium to appropriate data processing units (DPUs) or to an external computer or storage device via a network such as the internet, a local area network (LAN), a wide area network (WAN), and / or a wireless network. The network may include copper cables, fiber optic cables, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each DPU receives computer-readable program instructions from the network and forwards them for storage on a computer-readable storage medium within the DPU.

[0051] The computer-readable program instructions for performing operations of the present invention may be assembly instructions, ISA (Instruction Set Architecture) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-defining data, or either source code or object code written in any combination of one or more programming languages, such as an object-oriented programming language like Smalltalk, C++ or the like, as well as in conventional procedural programming languages ​​such as the programming language "C" or similar programming languages.The computer-readable program instructions can be executed entirely on the user's computer, partially on the user's computer as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be established with an external computer (e.g., via the internet using an internet service provider). In some embodiments, an electronic circuit such as a microcontroller can be used to execute the program instructions.a programmable logic circuit, field-programmable gate arrays (FPGAs) or programmable logic arrays (PLAs) that execute computer-readable program instructions by using state data of the computer-readable program instructions to personalize the electronic circuit and implement aspects of the present invention.

[0052] Aspects of the present invention are described here with reference to flowcharts and / or block diagrams of processes, devices (systems), and computer program products according to embodiments of the invention. It should be clear that each block of the flowcharts and / or block diagrams, as well as combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program commands.

[0053] These computer-readable program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing device to create a machine such that the instructions executed by the processor of the computer or other programmable data processing device create a means by which the functions / actions specified in the block(s) of the flowchart and / or block diagram can be realized. These computer-readable program instructions can also be stored on a computer-readable storage medium capable of instructing a computer, programmable data processing device, and / or other units to operate in a particular manner, such that the computer-readable storage medium containing instructions constitutes a manufacturing item containing instructions that specify aspects of the block(s) of the flowchart and / or block diagram.to carry out the function / action specified in the blocks of the schedule and / or the block diagram.

[0054] The computer-readable program instructions can also be loaded into a computer, other programmable data processing device, or other unit to cause a series of functional steps to be performed on the computer, other programmable data processing device, or other unit, so that the instructions executed on the computer, other data processing device, or other unit realize the functions / actions specified in the block(s) of the flowchart and / or block diagram.

[0055] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, processes, and computer program products according to various embodiments of the present invention. Thus, each block of the flowcharts or block diagrams can represent a module, segment, or part of instructions that includes one or more executable instructions with which the one or more specified logical functions can be implemented. In some alternative embodiments, the functions mentioned in the block may occur in a different order than that shown in the figures. For example, two consecutively depicted blocks may actually occur essentially simultaneously, or the blocks may sometimes be executed in reverse order, depending on the functionality in question.It should also be mentioned that each block of the block diagrams and / or flowchart representations, as well as combinations of blocks in the block diagrams and / or flowchart representations, can be realized or executed by special hardware-based systems that perform the specified functions or actions or combinations thereof, or by combinations of special hardware and computer commands.

[0056] The programs described here are identified based on the application for which they are implemented in a specific embodiment of the invention. However, it should be clear that any specific program nomenclature mentioned here is used solely for the purpose of simplification and that the invention is not limited to being used exclusively in any specific application whatsoever indicated and / or implied by such a nomenclature.

[0057] Based on the above, a method, computer system, and computer program product have been disclosed. However, numerous modifications and substitutions can be made without altering the scope of the present invention. The present invention has therefore been disclosed by way of example and not as a limitation.

[0058] Although this disclosure includes a detailed description of cloud data processing, it should be clear from the outset that the implementation of the teachings presented herein is not limited to a cloud data processing environment. Rather, embodiments of the present invention can be implemented in conjunction with any other type of data processing environment according to the current or future state of the art.

[0059] Cloud computing is a service delivery model designed to provide convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing power, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative overhead and interaction with a service provider. This cloud model can include, for example, at least five features, at least three service models, and at least four deployment models.

[0060] The features are as follows: On-demand self-service: A cloud consumer can unilaterally and automatically provide data processing capabilities such as server time and network storage as needed, without requiring any human interaction with the service provider.

[0061] Broad network access: Capabilities are made available over a network and allocated via standard mechanisms that allow use by various thin or thick client platforms (e.g. mobile phones, laptops and PDAs).

[0062] Resource pooling: The provider's data processing resources are pooled to be made available to multiple consumers using a multi-tenant model, with various physical and virtual resources being dynamically allocated or reassigned as needed. Location independence is ensured in that the consumer generally neither controls nor knows the exact location of the provided resources, but may be able to specify a location at a higher level of abstraction (e.g., country, state, or data center).

[0063] Flexible adaptability: Capabilities can be deployed quickly and elastically (in some cases automatically) to enable rapid scaling up, and just as quickly released for rapid scaling down. To the consumer, the available capabilities often appear unlimited and can be acquired at any time in any quantity.

[0064] Service measurement: Cloud systems automatically monitor and optimize resource usage by employing a measurement function at a specific abstraction layer appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and logged, providing transparency for both the service provider and the consumer.

[0065] The service models are as follows: Software as a Service (SaaS): The capability provided to the consumer is to use the provider's applications running in a cloud infrastructure. Access to the applications can be via a thin-client interface, such as a web browser, from various client devices (e.g., an email message based on the web). With the exception of limited user-specific application configuration settings, the underlying cloud infrastructure, such as the network, servers, operating systems, storage, or even individual application functions, is neither managed nor controlled by the consumer.

[0066] Platform as a Service (PaaS): The capability provided to the consumer is to deploy user-created or purchased applications, built using programming languages ​​and tools provided by the provider, within the cloud infrastructure. The underlying infrastructure, such as networks, servers, operating systems, or storage, is neither managed nor controlled by the consumer; however, the consumer retains control over the deployed applications and potentially over configurations of the hosting environment for those applications.

[0067] Infrastructure as a Service (IaaS): The capability provided to the consumer consists of access to processing, storage, networking, and other basic data processing resources, allowing the consumer to deploy and run freely chosen software such as operating systems and applications. The underlying cloud infrastructure is neither managed nor controlled by the consumer; however, the consumer has control over systems and units (e.g., operating systems, storage, deployed applications, etc.) and potentially limited control over selected network components (e.g., host firewalls).

[0068] The deployment models are as follows: Private Cloud: The cloud infrastructure is operated for only one organization. It can be managed by the organization itself or by a third party and can be located on-premises or elsewhere.

[0069] Community cloud: The cloud infrastructure is shared by multiple organizations and supports a specific community with common concerns (e.g., tasks, security requirements, policies, and compliance with laws and regulations). It can be managed by the organizations themselves or by a third party and can be located on-premises or off-premises.

[0070] Public cloud: The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization that sells cloud services.

[0071] Hybrid cloud: The cloud infrastructure is a composition of two or more (private, community or public) clouds that remain independent entities but are connected by a standardized or vendor-specific technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds).

[0072] A cloud data processing environment is service-oriented, emphasizing statelessness, low coupling, modularity, and semantic compatibility. At the heart of cloud data processing is an infrastructure comprised of a network of interconnected nodes.

[0073] With regard to Fig.Figure 8 illustrates a cloud data processing environment 50. As shown, the cloud data processing environment 50 has one or more cloud data processing nodes 10 with which local data processing units, such as a personal digital assistant or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an automotive computer system 54N, can exchange data. The nodes 10 can exchange data with each other. They can be physically or virtually grouped in one or more networks, such as private, community, public, or hybrid clouds as described above, or a combination thereof (not shown). In this way, the cloud data processing environment 50 can offer infrastructure, platforms, and / or software as services for which a cloud consumer does not need to maintain resources on a local data processing unit.It should be clear that the in . Fig. The 8 types of data processing units 54A to N shown are for illustrative purposes only, and the data processing nodes 10 and the cloud data processing environment 50 can exchange data with any type of computer-based unit over any type of network and / or network-addressable connection (e.g. using a web browser).

[0074] With regard to Fig. Figure 9 shows a set of function-related abstraction layers provided by the Cloud Data Processing Environment 50 ( Fig. 8) is provided. It should be clear from the outset that the in Fig. The components, layers, and functions shown in the 9 are for illustrative purposes only, and embodiments of the invention are not limited to them. As shown, the following layers and associated functions are provided: A hardware and software layer 60 contains hardware and software components. Examples of hardware components include: mainframes 61; servers 62 based on the RISC (Reduced Instruction Set Computer) architecture; servers 63; blade servers 64; storage units 65; and networks and network components 66. In some embodiments, software components include software for network application servers 67 and database software 68.

[0075] A virtualization layer 70 provides an abstraction layer which can provide the following examples of virtual entities: virtual servers 71; virtual memory 72; virtual networks 73 such as virtual private networks; virtual applications and operating systems 74; and virtual clients 75.

[0076] In one example, an administration layer 80 can provide the functions described below. A resource provisioning function 81 provides dynamic procurement of data processing and other resources used to perform tasks within the cloud data processing environment. Metering and pricing functions 82 provide cost tracking for resource usage within the cloud data processing environment, as well as invoicing and billing for the consumption of these resources. In one example, these resources might include licenses for application software. A security function provides identity verification for cloud consumers and tasks, as well as protection for data and other resources. A user portal function 83 provides consumers and system administrators with access to the cloud data processing environment.A service level management function (84) provides the allocation and management of cloud data processing resources to achieve required service level levels. A service level agreement (SLA) planning and execution function (85) provides the pre-specification and procurement of cloud data processing resources for which a future requirement is expected according to an SLA.

[0077] A utilization layer 90 provides examples of functionality for which the cloud data processing environment can be used. Examples of utilizations and functions that can be provided by this layer include: mapping and navigation 91; software development and lifecycle management 92; delivery of virtual training 93; data analytics processing 94; transaction processing 95; and a dynamic password program 96.

[0078] The above description of the various embodiments of the present invention serves for illustration and description purposes. It makes no claim to be complete, nor does it claim to limit the invention to the precise form as disclosed herein. Many modifications and variations are possible. Such modifications and variations, which should be obvious to a person skilled in the art in the field of the invention, are intended to be covered by the scope of the invention as defined by the appended claims.

Claims

[1] Computer-implemented method for permitting access to electronic information, wherein the method comprises: - Receiving (610) a first password string from a user by a first computer (110) from a second computer (126) over a network (130) in response to information entered through a user interface (128) of the second computer (126) and to a rule for configuring and generating a second password string from the first password string, wherein the rule specifies a dynamic element to be inserted at a specified position in the first password string depending on a first context information from the user and wherein a value of the specified dynamic element is determined depending on a second context information from the user; - in response to the first computer (110) receiving a third password string from the user from the second computer (126) via a network (130) using information entered through the user interface (128) of the second computer (126): o Configuring and generating (612) the second password string from the first password string by the first computer (110) depending on the received rule by: ▪ Selecting the specified dynamic element depending on the first context information provided by the user; ▪ Inserting the selected dynamic element into the first password string at the specified position; and ▪ Determining the value of the selected dynamic element depending on the second contextual information provided by the user; and ▪ in response to the first computer (110) determining that the third password string matches the second password string (620), allow the first computer (110) to access the electronic information to the second computer (126). [2] Method according to claim 1, further comprising: Storing (516) the first password string, the rule for configuring and generating the second password string and the specified position in the first password string in a data store (120) by the first computer (110). [3] Method according to claim 1, wherein the second computer (110) is a mobile data processing unit (126). [4] Method according to claim 1, wherein the first computer (126) is a cloud data processing node (110). [5] Method according to claim 1, wherein the rule for configuring and generating the second password string includes rules for generating a string based on the first and second context information belonging to the user. [6] Method according to claim 5, wherein the first and second context information belonging to the user includes one or more pieces of information selected from the group consisting of: a location, a time, a date, a month, a day of the week, a PIN code, a predefined constant string, a string based on a grid map, and a one-time password. [7] Method according to claim 1, wherein the rule for configuring and generating the second password string has a pattern. [8] Method according to claim 1, wherein the rule for configuring and generating the second password string comprises one or more rules selected from the group consisting of: a string generation rule defined by the user, and a string generation rule selected from a predefined set of string generation rules. [9] Computer system (110) for allowing access to electronic information, wherein the computer system comprises: one or more computer processors (902), one or more non-volatile, computer-readable storage media (908) and program instructions stored on one or more of the computer-readable storage media (908) for execution by at least one of the one or more processors (902), wherein the program instructions comprise: Program commands to receive a first password string from a user from a second computer (126) over a network (130) in response to information entered through a user interface (128) of the second computer (126) and to a rule for configuring and generating a second password string from the first password string (610), wherein the rule specifies a dynamic element to be inserted at a specified position in the first password string depending on a first context information from the user and wherein a value of the specified dynamic element is determined depending on a second context information from the user; Program commands to perform the following in response to the receipt of a third password string from the user by the computer system (110) from the second computer (126) via a network (130) using information entered via the user interface (128) of the second computer (126): o Configuring and generating (612) the second password string from the first password string by the computer system (110) depending on the received rule by: ▪ Selecting the specified dynamic element depending on the first context information provided by the user; ▪ Inserting the selected dynamic element into the first password string at the specified position; and ▪ Determining the value of the selected dynamic element depending on the second contextual information provided by the user; and ▪ in response to the computer system (110) determining that the third password string matches the second password string (620), the computer system (110) allows the second computer (126) to access the electronic information. [10] Computer program product for allowing access to electronic information, wherein the computer program product comprises: one or more non-volatile, computer-readable storage media (908) and program instructions stored on the one or more computer-readable storage media (908), wherein the program instructions comprise: Program commands to receive a first password string from a user from a second computer (126) over a network (130) in response to information entered through a user interface (128) of the second computer (126) and to a rule for configuring and generating a second password string from the first password string (610), wherein the rule specifies a dynamic element to be inserted at a specified position in the first password string depending on a first context information from the user and wherein a value of the specified dynamic element is determined depending on a second context information from the user; Program commands to perform the following in response to receiving a third password string from the user of the second computer (126) over a network (130) using information entered via the user interface (128) of the second computer (126): o Configure and generate (612) the second password string from the first password string depending on the received rule by: ▪ Selecting the specified dynamic element depending on the first context information provided by the user; ▪ Inserting the selected dynamic element into the first password string at the specified position; and ▪ Determining the value of the selected dynamic element depending on the second context information from the user; and in response to determining that the third password string matches the second password string (620), allowing the second computer (126) access to the electronic information.

Images