Ad-Hoc Password Generator for Data Warehouse Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of generic user IDs in data warehouses leads to poor password management, as a single hard-coded password is often shared and compromised, increasing the risk of accidental or malicious modification or disclosure of confidential information, and it is difficult to track unauthorized password dissemination.
Innovation Solution
A method and system that generates a short-term, ad-hoc password for a data warehouse environment, where a processor receives a request with a data warehouse environment, ID name, and reason for password reset, calculates a time difference with the latest previous request, and only generates a new password if the time difference exceeds a predetermined limit, ensuring that passwords are not reused within a set timeframe and minimizing sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single hard-coded password is used for generic user IDs, then ease of operation is improved, but security deteriorates due to password compromise and sharing
Solution Approach 1:
The patent segments the password into two components: a static generic user ID and a dynamic single-use password. This segmentation allows the ID to remain easy to remember while the password changes frequently, resolving the contradiction between ease of operation and security.
Solution Approach 2:
The patent introduces dynamic password generation where passwords are created on-demand and expire after use or after a time limit. This dynamic approach maintains ease of operation for legitimate users while eliminating the security risks of static passwords being shared or compromised.
2Reliability
If passwords are stored at secure locations, then security is improved, but password management deteriorates as users still share and copy passwords
Solution Approach 1:
The patent extracts the password from centralized storage and delivers it dynamically to the user only when needed. This eliminates the need for users to store or share passwords, resolving the contradiction between security and ease of operation.
Solution Approach 2:
The patent uses disposable, single-use passwords that expire after use or after a time limit. This approach maintains security by ensuring passwords cannot be reused or shared, while ease of operation is maintained as users simply receive and use the password without management overhead.
3Reliability
If password reset is required on a 30-90 day schedule, then security is improved, but productivity deteriorates due to frequent resets and predictable patterns
Solution Approach 1:
The patent replaces fixed periodic resets with on-demand password generation. Users receive passwords only when they need to access the system, eliminating unnecessary periodic resets and improving productivity while maintaining security through single-use, time-limited passwords.
4Ease of operation
If a single password is shared among multiple users, then ease of operation is improved, but loss of information increases due to unauthorized dissemination
Solution Approach 1:
The patent segments access control into user-specific credentials (ID + unique password) rather than shared credentials. This segmentation prevents information loss while maintaining ease of operation for authorized users who receive their own unique passwords.
Solution Approach 2:
The patent introduces an intermediary system that generates and manages passwords dynamically. This intermediary prevents unauthorized dissemination by ensuring each user receives a unique, time-limited password through a controlled process, eliminating the risk of information loss while maintaining operational ease.
Data Source
AI summary
Methods and apparatus are disclosed for generating a short term password that may be used to access a data warehouse. According to aspects of the disclosure, a user may request a password after inputting a data warehouse environment, an ID name, and a reason for the password reset. A server may receive the request and determine whether the difference in time of the present request and a previous request for the same ID name and data warehouse environment is greater than a time limit. Additionally, the server may determine whether a previous user has logged in using a password for the same ID name and data warehouse environment. Thereafter, the server may generate and output a short term password that expires after the time limit.