Granted Patent B2

US 12,563,030 · App. 17/988,863 · Granted Feb 24, 2026

Inventors: Radia J. Perlman (Redmond, WA); Charles Kaufman (Redmond, WA)

Assignee: Dell Products L.P.

H04L63/083

Abstract

Claims (57)

1 . An apparatus comprising:

at least one processing device comprising a processor coupled to a memory, the at least one processing device further comprising credential customization logic implemented at least in part utilizing the processor and the memory;

wherein the at least one processing device is configured:

to obtain, using the credential customization logic, access credentials for accessing a protected resource via a server over a network;

to modify, using the credential customization logic, at least a portion of the obtained access credentials based at least in part on identifying information of at least one of the protected resource and the server, by applying a designated function to the at least a portion of the obtained access credentials in combination with the identifying information; and

in response to a given user requesting access to the protected resource, to utilize the modified access credentials in place of the obtained access credentials in an authentication protocol carried out with the server;

wherein the modified access credentials are generated at least in part by a corresponding automatic translation operation performed on the obtained access credentials by the credential customization logic;

wherein a different automatic translation operation is performed by the credential customization logic on the obtained access credentials to generate different modified access credentials for accessing a different protected resource;

wherein the designated function when applied to the at least a portion of the obtained access credentials in combination with first identifying information of at least one of a first protected resource and a first server produces first modified access credentials, and further wherein the designated function when applied to the at least a portion of the obtained access credentials in combination with second identifying information of at least one of a second protected resource and a second server, different than the first protected resource and first server, produces second modified access credentials different than the first modified access credentials, the designated function thereby producing, for a given set of access credentials of the given user, different modified access credentials for different instances of the at least one of the protected resource and the server; and

wherein utilizing the modified access credentials in place of the obtained access credentials in the authentication protocol carried out with the server comprises:

sending a modified password of the modified access credentials to the server, the modified password being generated utilizing a password of the obtained access credentials;

receiving a challenge from the server; and

sending to the server a result of performing one or more hash operations on (i) the challenge received from the server and (ii) the modified password, at least one of the one or more hash operations being applied to both the challenge and the modified password.

2 . The apparatus of claim 1 wherein modifying at least a portion of the obtained access credentials comprises modifying at least a portion of the obtained access credentials in a manner compliant with one or more credential format rules for the protected resource.

3 . The apparatus of claim 1 wherein the access credentials comprise a username and the password, and wherein the protected resource comprises an access-controlled user account of a website hosted at least in part by the server.

4 . The apparatus of claim 1 wherein the at least one processing device comprises at least a portion of a user device configured to communicate with the server over the network.

5 . The apparatus of claim 1 wherein modifying at least a portion of the obtained access credentials based at least in part on identifying information of at least one of the protected resource and the server comprises hashing a first password of the obtained access credentials with the identifying information to generate a second password different than the first password but compliant with one or more credential format rules for the protected resource.

6 . The apparatus of claim 1 wherein the identifying information of at least one of the protected resource and the server comprises at least an identifier of at least one of the protected resource and the server.

7 . The apparatus of claim 1 wherein modifying at least a portion of the obtained access credentials based at least in part on identifying information of at least one of the protected resource and the server comprises performing one or more hash operations on at least a portion of the obtained access credentials utilizing the identifying information of at least one of the protected resource and the server.

8 . The apparatus of claim 7 wherein modifying at least a portion of the obtained access credentials based at least in part on identifying information of at least one of the protected resource and the server further comprises converting a result of performing the one or more hash operations into a character string that complies with one or more credential format rules for the protected resource.

9 . The apparatus of claim 7 wherein modifying at least a portion of the obtained access credentials comprises generating the modified password at least in part by performing the one or more hash operations on the password of the obtained access credentials using the identifying information of at least one of the protected resource and the server.

10 . The apparatus of claim 1 wherein utilizing the modified access credentials in place of the obtained access credentials in the authentication protocol carried out with the server comprises sending a username of the access credentials in unmodified form to the server with the modified password.

11 . The apparatus of claim 1 wherein utilizing the modified access credentials in place of the obtained access credentials in the authentication protocol carried out with the server comprises sending a username of the access credentials in unmodified form to the server with the result of performing one or more hash operations on (i) the challenge received from the server and (ii) the modified password.

12 . The apparatus of claim 1 wherein the at least one processing device is further configured to obtain at least a portion of one or more credential format rules for the protected resource from at least one external source.

13 . The apparatus of claim 12 wherein the at least one external source comprises the server associated with the protected resource.

14 . The apparatus of claim 12 wherein the at least one external source comprises a database that stores a plurality of different sets of one or more credential format rules for respective ones of a plurality of protected resources.

15 . A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device:

to obtain, using credential customization logic of the at least one processing device, access credentials for accessing a protected resource via a server over a network;

to modify, using the credential customization logic, at least a portion of the obtained access credentials based at least in part on identifying information of at least one of the protected resource and the server, by applying a designated function to the at least a portion of the obtained access credentials in combination with the identifying information; and

in response to a given user requesting access to the protected resource, to utilize the modified access credentials in place of the obtained access credentials in an authentication protocol carried out with the server;

wherein the modified access credentials are generated at least in part by a corresponding automatic translation operation performed on the obtained access credentials by the credential customization logic;

wherein a different automatic translation operation is performed by the credential customization logic on the obtained access credentials to generate different modified access credentials for accessing a different protected resource;

wherein the designated function when applied to the at least a portion of the obtained access credentials in combination with first identifying information of at least one of a first protected resource and a first server produces first modified access credentials, and further wherein the designated function when applied to the at least a portion of the obtained access credentials in combination with second identifying information of at least one of a second protected resource and a second server, different than the first protected resource and first server, produces second modified access credentials different than the first modified access credentials, the designated function thereby producing, for a given set of access credentials of the given user, different modified access credentials for different instances of the at least one of the protected resource and the server; and

wherein utilizing the modified access credentials in place of the obtained access credentials in the authentication protocol carried out with the server comprises:

sending a modified password of the modified access credentials to the server, the modified password being generated utilizing a password of the obtained access credentials;

receiving a challenge from the server; and

sending to the server a result of performing one or more hash operations on (i) the challenge received from the server and (ii) the modified password, at least one of the one or more hash operations being applied to both the challenge and the modified password.

16 . The computer program product of claim 15 wherein modifying at least a portion of the obtained access credentials based at least in part on identifying information of at least one of the protected resource and the server comprises performing one or more hash operations on at least a portion of the obtained access credentials utilizing the identifying information of at least one of the protected resource and the server.

17 . The computer program product of claim 15 wherein utilizing the modified access credentials in place of the obtained access credentials in the authentication protocol carried out with the server comprises sending a username of the access credentials in unmodified form to the server with at least one of:

the modified password; and

the result of performing one or more hash operations on (i) the challenge received from the server and (ii) the modified password.

18 . A method comprising:

obtaining, using credential customization logic of at least one processing device, access credentials for accessing a protected resource via a server over a network;

modifying, using the credential customization logic, at least a portion of the obtained access credentials based at least in part on identifying information of at least one of the protected resource and the server, by applying a designated function to the at least a portion of the obtained access credentials in combination with the identifying information; and

in response to a given user requesting access to the protected resource, utilizing the modified access credentials in place of the obtained access credentials in an authentication protocol carried out with the server;

wherein the modified access credentials are generated at least in part by a corresponding automatic translation operation performed on the obtained access credentials by the credential customization logic;

wherein a different automatic translation operation is performed by the credential customization logic on the obtained access credentials to generate different modified access credentials for accessing a different protected resource;

wherein the designated function when applied to the at least a portion of the obtained access credentials in combination with first identifying information of at least one of a first protected resource and a first server produces first modified access credentials, and further wherein the designated function when applied to the at least a portion of the obtained access credentials in combination with second identifying information of at least one of a second protected resource and a second server, different than the first protected resource and first server, produces second modified access credentials different than the first modified access credentials, the designated function thereby producing, for a given set of access credentials of the given user, different modified access credentials for different instances of the at least one of the protected resource and the server;

wherein utilizing the modified access credentials in place of the obtained access credentials in the authentication protocol carried out with the server comprises:

sending a modified password of the modified access credentials to the server, the modified password being generated utilizing a password of the obtained access credentials;

receiving a challenge from the server; and

sending to the server a result of performing one or more hash operations on (i) the challenge received from the server and (ii) the modified password, at least one of the one or more hash operations being applied to both the challenge and the modified password; and

wherein the method is performed by the at least one processing device, the at least one processing device comprising a processor coupled to a memory.

19 . The method of claim 18 wherein modifying at least a portion of the obtained access credentials based at least in part on identifying information of at least one of the protected resource and the server comprises performing one or more hash operations on at least a portion of the obtained access credentials utilizing the identifying information of at least one of the protected resource and the server.

20 . The method of claim 18 wherein utilizing the modified access credentials in place of the obtained access credentials in the authentication protocol carried out with the server comprises sending a username of the access credentials in unmodified form to the server with at least one of:

the modified password; and

the result of performing one or more hash operations on (i) the challenge received from the server and (ii) the modified password.

Assignments (1)

Continuity (1)

References Cited (31)