Dynamic Password Expiration Based on Entropy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password expiration policies treat all passwords as having the same level of complexity, leading to unnecessary password changes for users with strong, complex passwords, which can decrease security and user satisfaction.
Innovation Solution
A system that analyzes the entropy of a password to determine its complexity and sets an expiration date based on this measurement, allowing more complex passwords to be kept longer than less complex ones, encouraging users to choose stronger passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a fixed expiration time is used for all passwords, then password expiration is simple to implement, but security is reduced because weak passwords are kept as long as strong ones
Solution Approach 1:
The patent applies dynamics by transitioning from a static fixed expiration time to a dynamic expiration time that varies based on password strength. The system calculates password entropy and sets expiration dates accordingly, making the expiration policy adaptive rather than rigid. This resolves the contradiction by allowing the system to maintain simplicity through automated entropy calculation while achieving enhanced security through differentiated expiration times.
Solution Approach 2:
The patent changes the parameter of expiration time from a fixed value to a variable value determined by password entropy. By measuring entropy and adjusting expiration dates based on this measurement, the system achieves both enhanced security for strong passwords and simplified management for weak passwords. This parameter change resolves the contradiction by making the expiration policy intelligent rather than mechanical.
2Ease of operation
If all passwords expire at the same fixed time, then password management is simple, but user satisfaction decreases due to unnecessary password changes
Solution Approach 1:
The patent applies self-service by having the system automatically measure password entropy and determine expiration dates without user intervention. The system serves itself by calculating entropy, comparing it against thresholds, and setting appropriate expiration times. This eliminates the need for users to manually manage expiration dates and reduces unnecessary password changes, resolving the contradiction between ease of operation and time loss.
Solution Approach 2:
The patent implements feedback by continuously measuring password entropy and using this information to adjust expiration policies. The system provides feedback to users about their password strength and corresponding expiration dates, allowing them to understand why certain passwords expire sooner than others. This feedback mechanism resolves the contradiction by making password management transparent and user-friendly.
3Reliability
If weak passwords are treated the same as strong passwords, then policy implementation is simple, but security is compromised by allowing weak passwords to persist
Solution Approach 1:
The patent applies local quality by treating different passwords differently based on their individual entropy characteristics. Instead of uniform treatment, the system measures each password's entropy and applies appropriate expiration policies locally to each user's password. This resolves the contradiction by ensuring strong passwords receive extended expiration times while weak passwords are expired sooner, improving both security and password change efficiency.
Solution Approach 2:
The patent segments the password population into different categories based on entropy thresholds. By dividing passwords into strong and weak categories and applying different expiration policies to each segment, the system achieves both enhanced security for strong passwords and improved efficiency for weak passwords. This segmentation resolves the contradiction by making the expiration policy differentiated rather than uniform.
Data Source
AI summary
A password application system receives a credential for a first privilege of a plurality of privileges whereby the first privilege corresponds to a first set of credential requirements and the plurality of privileges have a second privilege that corresponds to a different set of credential requirements. The system determines whether the credential for the first privilege satisfies the first set of credential requirements. If the credential satisfies this set of credential requirements, the system enables the credential to be used for access in accordance with the first privilege.