Password Blacklist System for Detecting Compromised Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current password security methods are inadequate in preventing account compromises, as hackers exploit stolen account credentials by making repeated login attempts across systems where users reuse passwords, and users unknowingly expose their accounts by resetting passwords to the same compromised values, leading to unlawful access.
Innovation Solution
The system identifies suspicious patterns in failed login attempts by analyzing records of password and login data, including location and timestamp, to automatically add potentially compromised passwords to a blacklist, preventing their future use and mitigating brute force attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password blacklisting methods are used, then password security is maintained through user password history, but the system cannot detect or prevent hackers from exploiting stolen credentials across multiple systems
Solution Approach 1:
The password blacklist system is transformed from a simple user-history tracker into a multi-functional security mechanism that: (1) monitors failed login attempts across the system, (2) detects suspicious patterns indicating hacker activity, (3) automatically blacklists compromised passwords, and (4) prevents reuse of stolen credentials. This universal approach benefits all users and systems simultaneously rather than relying on individual user password history.
Solution Approach 2:
The system implements continuous feedback loops where failed login attempts are monitored, analyzed for suspicious patterns, and used to dynamically update the password blacklist. When hackers attempt to use stolen credentials, the system detects the pattern of repeated failures, adds the compromised password to the blacklist, and immediately prevents further misuse. This feedback mechanism enables automatic adaptation to emerging threats.
2Reliability
If the system monitors and analyzes failed login attempts across all users, then compromised passwords can be detected and blacklisted, but the system complexity and computational resources increase
Solution Approach 1:
The system applies partial monitoring by focusing only on failed login attempts rather than analyzing all authentication activities. It uses pattern-matching rules that check for suspicious characteristics (multiple failures, same credentials across users, temporal patterns) without requiring deep analysis of each individual attempt. This selective approach provides effective detection while maintaining reasonable system complexity.
Solution Approach 2:
The monitoring system is segmented into distinct functional components: (1) collection of failed login attempt data, (2) pattern analysis engine that applies detection rules, (3) blacklist management module that updates blocked passwords, and (4) enforcement mechanism that prevents usage. This segmentation allows each component to operate independently with optimized complexity, reducing the burden on any single part of the system.
3Reliability
If the system automatically blacklists passwords from failed login attempts, then future unauthorized access is prevented, but legitimate users may be affected if their passwords are mistakenly flagged
Solution Approach 1:
The system performs preliminary analysis of failed login patterns before adding passwords to the blacklist. It evaluates multiple criteria including the number of failed attempts, temporal distribution, source locations, and whether the same credentials were used across multiple user accounts. Only passwords exhibiting clear suspicious patterns are blacklisted, reducing false positives while maintaining strong prevention against actual compromises.
Solution Approach 2:
The password blacklist acts as an intermediary security layer between hackers and user accounts. Rather than directly blocking individual login attempts or notifying users immediately, the system uses the blacklist as a mediating mechanism that silently prevents compromised credentials from working. This intermediary approach allows the system to protect users without requiring their direct involvement or risking alarm from false positives, as legitimate users simply experience normal authentication behavior.
Data Source
AI summary
Systems and methods are disclosed for analyzing a plurality of failed login records that correspond to failed login attempts detected by a computing system, to identify suspicious patterns of activity that can facilitate the supplementation of password blacklists for improving account security. To accomplish the foregoing, failed login records that include information associated with failed login attempts are obtained for analysis. The failed login records are analyzed to identify a set of failed login records that show initial characteristics of a suspicious pattern of activity. The information included in the set of failed login records are further analyzed to determine whether a suspicious pattern of activity is actually present. When a suspicious pattern of activity is identified in the set of failed login records, the passwords used in the failed login attempts are stored in password blacklists associated with the account identifier(s) with which the passwords were used.