Zero-Knowledge Password Breach Detection System

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The increasing complexity of password and authentication processes due to rigorous security measures has led to user frustration, and users are at risk of having their sensitive data breached as hackers use sophisticated tools to guess username and password combinations, with many users resorting to weak or reused passwords.

Innovation Solution

A system and method that detects breached user login data by hashing user login data on a client device and comparing it with hashed breached web data elements using a hardware security module, providing breach notifications and anonymous identifiers for unbreached data, thus helping users select safer combinations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If users select strong passwords to limit intrusion risk, then security reliability is improved, but user frustration increases due to complexity of authentication processes

Engineering Contradiction:

Improvesecurity reliabilityVSAvoidease of authentication

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system performs preliminary breach detection by hashing user passwords and comparing them against known breached password databases before users attempt authentication. This advance check prevents users from using compromised passwords, allowing them to select strong passwords without the frustration of failed authentication attempts, thus improving both security reliability and ease of operation.

Inventive Principle:

Principle #10Preliminary action

2Productivity

If hackers use sophisticated tools to generate password combinations quickly, then breach detection speed is improved, but the risk of successful intrusion increases

Engineering Contradiction:

Improvepassword generation speedVSAvoidintrusion risk

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system applies preliminary anti-action by proactively detecting and alerting users about breached passwords before hackers can successfully use them for intrusion. By comparing user passwords against databases of known breached credentials, the system neutralizes the threat of sophisticated password guessing tools, maintaining security reliability despite increased hacker productivity.

Inventive Principle:

Principle #9Preliminary anti-action

3Ease of operation

If users reuse the same passwords across multiple services, then ease of operation is improved, but security reliability deteriorates due to increased breach vulnerability

Engineering Contradiction:

Improveease of password managementVSAvoidbreach vulnerability

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The system implements feedback by notifying users when their reused passwords appear in breach databases. This feedback mechanism allows users to identify which of their reused passwords are compromised and change them, balancing ease of operation with improved security reliability by enabling informed password management decisions.

Inventive Principle:

Principle #23Feedback

4Difficulty of detecting and measuring

If the system stores hashed user login data for breach detection, then breach detection capability is improved, but information security risk increases due to potential exposure of user data

Engineering Contradiction:

Improvebreach detection capabilityVSAvoidinformation security risk

Core Design Contradiction:

Difficulty of detecting and measuringVSObject-affected harmful factors

Solution Approach 1:

The system applies the extraction principle by removing identifiable user information from the breach detection process. Only hashed password data is stored and compared against breach databases, while user identities and personal information remain on the user's device. This extraction of sensitive information maintains breach detection capability while minimizing information security risk.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system uses hashing as an intermediary mechanism that transforms user passwords into fixed-length hash values for comparison purposes. This intermediary process allows breach detection without storing or exposing actual user passwords, reducing information security risk while maintaining detection capability. The hash function acts as a mediator between user credentials and breach databases.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11218304B2System and method for detecting breached passwords without disclosing identifiable information

Publication Date: 2022.01.04 KEEPER SECURITY INC

AI summary

Systems and methods for detecting breached user login records in a zero-knowledge architecture. A breach detection module obtains login data that has been breached from breached data sources and service providers. The breached data is hashed with a system key and the breached data hashes are hashed in a hardware security module (HSM) using a hashing method and a non-exportable key. Clients provide user login data that has been hashed using the hashing method by the client device to the breach detection module. The breach detection module hashes the hashed user login data and compares the hashed user login hashes with the hashed breached data hashes and sends a breach alert to the client device if any hashes match.