Credential Verification System Using Batched Pair-Wise Comparisons
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity systems face challenges in efficiently and proactively identifying and notifying users of exposed or stolen passwords to prevent account takeovers, particularly due to the computational complexity and bandwidth issues associated with large datasets of compromised and active credentials.
Innovation Solution
The implementation of a system that locally caches compromised credentials and performs batched pair-wise comparisons using content-addressable data structures, concurrent operations, and heterogeneous compute architectures to expedite comparisons, reducing bandwidth, storage, and latency issues, and utilizing differential updates and analyses to mitigate the challenges of large datasets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional pair-wise matching methods are used to compare compromised credentials with active credentials, then detection accuracy is maintained, but time computational complexity increases significantly with large datasets
Solution Approach 1:
The patent segments the large-scale credential comparison problem into smaller manageable units by implementing a hierarchical architecture where credential data is divided into subsets processed by multiple worker nodes. The comparison process is segmented into distinct phases: preprocessing compromised credentials, processing active credentials in batches, and aggregating results. This segmentation reduces the time computational complexity from O(n²) in traditional pair-wise matching to a more scalable approach while maintaining detection accuracy through comprehensive coverage of all credential pairs.
Solution Approach 2:
The patent applies preliminary action by pre-processing compromised credentials before the actual matching process. This includes creating normalized representations, extracting relevant features, and organizing data structures in advance. By performing these preparatory actions beforehand, the system reduces the computational burden during the actual comparison phase, thereby reducing time computational complexity while preserving the ability to accurately detect compromised credentials.
2Reliability
If comprehensive credential comparison is performed across large datasets, then detection completeness is improved, but bandwidth and latency costs increase
Solution Approach 1:
The patent extracts and processes only the essential features and characteristics of credentials needed for comparison, rather than transmitting and processing complete credential datasets. By extracting relevant identifiers, normalized representations, and key features, the system maintains detection completeness while significantly reducing bandwidth requirements and latency costs associated with transmitting large volumes of credential data across the network.
Solution Approach 2:
The patent introduces intermediary components including proxy servers, load balancers, and result aggregation services that mediate between credential sources and comparison algorithms. These intermediaries optimize data flow, cache frequently accessed credential data, and manage communication protocols, thereby reducing bandwidth consumption and latency while ensuring comprehensive comparison across all credentials.
3Reliability
If real-time credential verification is implemented, then user security is enhanced, but system complexity increases
Solution Approach 1:
The patent implements a universal credential verification system that handles multiple credential types (passwords, hashes, salts, encrypted credentials) through a single standardized processing pipeline. The architecture provides multi-functionality by serving both real-time verification and batch processing needs, supporting various authentication methods, and integrating with different data sources. This universality enhances user security across diverse scenarios while managing system complexity through standardized interfaces and unified processing logic.
Data Source
AI summary
Provided is a process that includes: obtaining, with one or more processors, a query identifying a user identification; retrieving, with one or more processors, via an application programming interface, from a database, one or more passwords associated with one or more user identification entries in the database that matches the user identification in response to the obtained query; determining, with one or more processors, whether the one or more passwords matches a password associated with the user identification; blocking, with one or more processors, access to a user account associated with the user identification and the password when the one or more passwords matches the password associated with the user identification; and notifying, with one or more processors, a user associated with the user account to reset the password when the one or more passwords matches the password associated with the user identification.