Identity Management System Detecting Breached Passwords
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity measures are inadequate in preventing the use of stolen or compromised security credentials, leading to significant financial losses and data breaches, as users often reuse weak passwords, and existing systems for detecting compromised credentials are not efficiently implemented in enterprise networks.
Innovation Solution
An identity management system integrates a repository of compromised credentials with a password manager to compare user credentials with a set of compromised credentials, notify users of compromised passwords, and block access to prevent account takeover, using cryptographic hashes to ensure security and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users reuse passwords or use low-entropy variations, then ease of operation is improved, but security reliability deteriorates
Solution Approach 1:
The system performs preliminary comparison of passwords against compromised credential databases before allowing account access. By checking credentials in advance against known breached passwords, the system prevents unauthorized access while allowing users to maintain their password habits.
2Reliability
If systems frequently check credentials against breached databases, then security reliability is improved, but productivity deteriorates due to increased latency
Solution Approach 1:
The system performs partial credential checking by comparing only portions of passwords or using sampling techniques against the breached credentials database. This approach provides adequate security protection while reducing the computational overhead and latency associated with checking entire passwords against large databases.
3Reliability
If enterprise networks implement comprehensive credential monitoring, then security reliability is improved, but device complexity increases
Solution Approach 1:
The system introduces an intermediary credential monitoring service that acts as a mediator between users and the breached credentials database. This intermediary handles the complexity of database queries, password comparison, and threat detection, while presenting a simple interface to end users and requiring minimal integration with existing enterprise systems.
Data Source
AI summary
Provided is a process that includes: obtaining with a distributed application comprising an identity management system, a first password; comparing with the distributed application, the first password to a set of compromised credentials within a database external to the network-accessible resource; receiving one or more passwords that match the first password based on the comparison; determining with the distributed application whether the one or more passwords satisfy a criterion; and in response to the determination that the one or more passwords satisfy the criterion, causing the first user associated with a first account and the first password to be notified that the first password has been compromised.