# US 12,010,121 B2 · Gradual credential disablement

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,010,121 B2
- Document ID: US12010121B2
- Status: Granted
- Kind: B2
- Application number: 17/661,035
- Filed: 2022-04-27
- Published: 2022-08-11
- Granted: 2024-06-11
- Earliest claimed: 2018-03-01
- Assignees: Google Inc.
- Applicants: Google LLC
- Inventors: Gregory Roth; Naveen Chand
- Web page: https://patentgrep.com/patent/US12010121B2

## CPC

- H04L 63/108: {when the policy decisions are valid for a limited amount of time}
- G06F 21/31: User authentication
- G06F 21/45: Structures or tools for the administration of authentication
- H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 2221/2137: Time limited access, e.g. to a computer or data
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method for a gradual credential disablement is provided. The method includes receiving, at data processing hardware, a request for access to a resource. The request includes a request authenticator. The method also includes comparing, by the data processing hardware, the request authenticator against a security credential associated with the resource. The method further includes determining, by the data processing hardware, whether the request authenticator satisfies the security credential. When the request authenticator satisfies the security credential, the method includes granting or denying, by the data processing hardware, access to the resource based on a request failure rate associated with the security credential.

## Claims

### Claim 1

A computer-implemented method when executed by data processing hardware causes the data processing hardware to perform operations comprising:
receiving, from a client, a request to access a resource, the request comprising a request credential;
obtaining a security credential associated with the resource;
comparing the request credential to the security credential;
determining that the client is authorized to access the resource based on the comparison of the request credential and the security credential; and
based on determining that the client is authorized to access the resource:
determining a request failure rate associated with the security credential;
determining that denying the request satisfies the request failure rate, wherein determining that denying the request satisfies the request failure rate comprises determining that the request failure rate is enabled; and
based on determining that denying the request satisfies the request failure rate, denying access to the resource.

### Claim 2 (depends on 1)

The method of claim 1, wherein determining that denying the request satisfies the request failure rate comprises:
obtaining a random number; and
comparing the random number with a reference number associated with the request failure rate.

### Claim 3 (depends on 1)

The method of claim 1, wherein the operations further comprise:
determining that a number of received requests having corresponding request credentials satisfying the security credential satisfies a threshold number; and
implementing a remedial action.

### Claim 4 (depends on 3)

The method of claim 3, wherein implementing the remedial action comprises:
granting access to the resource when the request credential satisfies the security credential; and
not enforcing the request failure rate associated with the security credential.

### Claim 5 (depends on 1)

The method of claim 1, wherein:
the security credential comprises an old security credential and a new security credential; and
determining whether granting or denying the request satisfies the request failure rate comprises determining whether the request credential satisfies the new security credential.

### Claim 6 (depends on 1)

The method of claim 1, wherein the operations further comprise:
receiving an indication of a selection of the resource through a user interface for a security credential update;
receiving an association of a new security credential with the resource; and
receiving the request failure rate for requests to access the resource using the security credential.

### Claim 7 (depends on 1)

The method of claim 1, wherein the security credential comprises at least one of a public key or a hash message authentication code (hmac) key.

### Claim 8 (depends on 1)

The method of claim 1, wherein the request failure rate increases based on a function of time.

### Claim 9 (depends on 1)

The method of claim 1, wherein the request failure rate comprises at least one of:
a denial count for request credentials satisfying the security credential;
a percentage of request credentials satisfying the security credential and denied access to the resource; or
a percentage of request credentials satisfying the security credential and granted access to the resource.

### Claim 10

A system comprising:
data processing hardware; and
memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
receiving, from a client, a request to access a resource, the request comprising a request credential;
obtaining a security credential associated with the resource;
comparing the request credential to the security credential;
determining that the client is authorized to access the resource based on the comparison of the request credential and the security credential; and
based on determining that the client is authorized to access the resource:
determining a request failure rate associated with the security credential;
determining that denying the request satisfies the request failure rate, wherein determining that denying the request satisfies the request failure rate comprises determining that the request failure rate is enabled; and
based on determining that denying the request satisfies the request failure rate, denying access to the resource.

### Claim 11 (depends on 10)

The system of claim 10, wherein determining that denying the request satisfies the request failure rate comprises:
obtaining a random number; and
comparing the random number with a reference number associated with the request failure rate.

### Claim 12 (depends on 10)

The system of claim 10, wherein the operations further comprise:
determining that a number of received requests having corresponding request credentials satisfying the security credential satisfies a threshold number; and
implementing a remedial action.

### Claim 13 (depends on 12)

The system of claim 12, wherein implementing the remedial action comprises:
granting access to the resource when the request credential satisfies the security credential; and
not enforcing the request failure rate associated with the security credential.

### Claim 14 (depends on 10)

The system of claim 10, wherein:
the security credential comprises an old security credential and a new security credential; and
determining whether granting or denying the request satisfies the request failure rate comprises determining whether the request credential satisfies the new security credential.

### Claim 15 (depends on 10)

The system of claim 10, wherein the operations further comprise:
receiving an indication of a selection of the resource through a user interface for a security credential update;
receiving an association of a new security credential with the resource; and
receiving the request failure rate for requests to access the resource using the security credential.

### Claim 16 (depends on 10)

The system of claim 10, wherein the security credential comprises at least one of a public key or a hash message authentication code (hmac) key.

### Claim 17 (depends on 10)

The system of claim 10, wherein the request failure rate increases based on a function of time.

### Claim 18 (depends on 10)

The system of claim 10, wherein the request failure rate comprises at least one of:
a denial count for request credentials satisfying the security credential;
a percentage of request credentials satisfying the security credential and denied access to the resource; or
a percentage of request credentials satisfying the security credential and granted access to the resource.