# US 12,015,605 B2 · Prioritized ranking for memory device preparation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,605 B2 - Document ID: US12015605B2 - Status: Granted - Kind: B2 - Application number: 18/076,929 - Filed: 2022-12-07 - Published: 2023-03-30 - Granted: 2024-06-18 - Earliest claimed: 2020-12-01 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Rajnish Chitkara; Peter Knaggs - Web page: https://patentgrep.com/patent/US12015605B2 ## CPC - H04L 63/0846: {using time-dependent-passwords, e.g. periodically changing passwords} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - H04L 63/102: {Entity profiles} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A rollover system is provided to facilitate transitioning of client devices in a shared account network environment, from an old password to a new replacement password. The switching of passwords may take place gradually during a rollout period for client devices without required downtime and reducing a risk of lockouts. During the rollover period, a prior salt is temporarily carried over to a new verifier for the replacement password. Two new verifiers are generated: a temporary new verifier using the old salt for verification during the rollover period and another new verifier using a different new salt for verification after the rollover period had expired. During the rollover period, authentication involves the use of the temporary new verifier with the old salt or by the old verifier and old salt of the prior password. After the rollover period, authentication is based on the new verifier with a new salt. ## Claims ### Claim 1 An apparatus for transitioning passwords of a user account accessible to a plurality of client devices, the apparatus comprising: one or more processors; and logic encoded in one or more non-transitory media for execution by the one or more processors and when executed operable to perform operations comprising: activating a rollover period in response to receiving a replacement password to replace a first password associated with a stored first verifier created with a first salt (v1s1), wherein the rollover period is a predefined period of time; during the rollover period: in response to receiving the replacement password, generating a second verifier created with a second salt (v2s2) and a second verifier created with the first salt (v2s1), wherein the first salt is continued from prior use with the first verifier associated with the first password; and authenticating a first entered password, by the first entered password satisfying one of v2s1 or v1s1; and after the rollover period expires: authenticating a second entered password, by the second entered password satisfying v2s2. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein during the rollover period the replacement password is propagated to a client device of the plurality of client devices prior to receiving the first entered password from the client device and wherein the first entered password satisfies v2s1. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the operations further comprise: after rollover period expires, removing v1s1 and v2s1 from an authentication storage. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the operations further comprise: after the replacement password is propagated to each of the plurality of client devices, updating stored status for each of the plurality of client devices. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the operations further comprise: overriding the rollover period after an administrator device propagates the replacement password to the plurality of client devices. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the operations further comprise: prior to authenticating the first entered password during the rollover period: receiving a lock status of the user account, wherein the lock status is continued for a lock period of time; and receiving an unlock status of the user account after the lock period of time, wherein the rollover period is maintained during the lock status and unlock status. ### Claim 7 (depends on 1) The apparatus of claim 1 wherein the operations further comprise: during the rollover period, extending the rollover period by a particular amount of time in response to receiving an extension request, by changing a profile parameter specifying a time for the rollover period. ### Claim 8 A computer-implemented method for transitioning passwords of a user account accessible to a plurality of client devices to access a database server, the method comprising: activating a rollover period in response to receiving a replacement password to replace a first password associated with a stored first verifier created with a first salt (v1s1), wherein the rollover period is a predefined period of time; during the rollover period: in response to receiving the replacement password, generating a second verifier created with a second salt (v2s2) and a second verifier created with the first salt (v2s1), wherein the first salt is continued from prior use with the first verifier associated with the first password; and authenticating a first entered password, by the first entered password satisfying one of v2s1 or v1s1; and after the rollover period expires: authenticating a second entered password, by the second entered password satisfying v2s2. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, wherein during the rollover period the replacement password is propagated to a client device of the plurality of client devices prior to receiving the first entered password from the client device and wherein the first entered password satisfies v2s1. ### Claim 10 (depends on 8) The computer-implemented method of claim 8, further comprising: after rollover period expires, removing v1s1 and v2s1 from an authentication storage. ### Claim 11 (depends on 8) The computer-implemented method of claim 8, further comprising: after the replacement password is propagated to each of the plurality of client devices, updating stored status for each of the plurality of client devices. ### Claim 12 (depends on 8) The computer-implemented method of claim 8, further comprising: overriding the rollover period after an administrator device propagates the replacement password to the plurality of client devices. ### Claim 13 (depends on 8) The computer-implemented method of claim 8, further comprising: prior to authenticating the first entered password during the rollover period: receiving a lock status of the user account, wherein the lock status is continued for a lock period of time; and receiving an unlock status of the user account after the lock period of time, wherein the rollover period is maintained during the lock status and unlock status. ### Claim 14 (depends on 8) The computer-implemented method of claim 8, further comprising: during the rollover period, extending the rollover period by a particular amount of time in response to receiving an extension request, by changing a profile parameter specifying a time for the rollover period. ### Claim 15 A non-transitory computer-readable storage medium carrying program instructions thereon for transitioning passwords of a user account accessible to a plurality of client devices, the instructions when executed by one or more processors cause the one or more processors to perform operations comprising: activating a rollover period in response to receiving a replacement password to replace a first password associated with a stored first verifier created with a first salt (v1s1), wherein the rollover period is a predefined period of time; during the rollover period: in response to receiving the replacement password, generating a second verifier created with a second salt (v2s2) and a second verifier created with the first salt (v2s1), wherein the first salt is continued from prior use with the first verifier associated with the first password; and authenticating a first entered password, by the first entered password satisfying one of v2s1 or v1s1; and after the rollover period expires: authenticating a second entered password, by the second entered password satisfying v2s2. ### Claim 16 (depends on 15) The storage medium of claim 15, wherein during the rollover period the replacement password is propagated to a client device of the plurality of client devices prior to receiving the first entered password from the client device and wherein the first entered password satisfies v2s1. ### Claim 17 (depends on 15) The storage medium of claim 15, wherein the operations further comprise: after rollover period expires, removing v1s1 and v2s1 from an authentication storage. ### Claim 18 (depends on 15) The storage medium of claim 15, wherein the operations further comprise: after the replacement password is propagated to each of the plurality of client devices, updating stored status for each of the plurality of client devices. ### Claim 19 (depends on 15) The storage medium of claim 15, wherein the operations further comprise: overriding the rollover period after an administrator device propagates the replacement password to the plurality of client devices. ### Claim 20 (depends on 15) The storage medium of claim 15, wherein the operations further comprise: prior to authenticating the first entered password during the rollover period: receiving a lock status of the user account, wherein the lock status is continued for a lock period of time; and receiving an unlock status of the user account after the lock period of time, wherein the rollover period is maintained during the lock status and unlock status.