Password Breach Monitoring via Hash Prefix Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional password breach detection services face security vulnerabilities by requiring full hash credentials for monitoring and notification, which can lead to user privacy concerns, and often lack comprehensive monitoring and notification capabilities for partial password hashes.
Innovation Solution
A method and system for password breach monitoring and notification that generates a one-way hash for user credentials, selects a hash prefix, and sends it to a backend service for matching with known compromised password suffixes, enabling breach detection and security actions without sharing full hashes, thus enhancing security and user privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If full hash credentials are used for breach monitoring, then breach detection accuracy is improved, but user privacy and security are worsened
Solution Approach 1:
The patent segments the password hash into two parts: a prefix that is sent to the breach detection service and a suffix that remains on the client device. This segmentation allows the service to check for breaches using only the prefix, avoiding exposure of the full hash while maintaining detection accuracy. The service stores and compares only prefix-suffix pairs, never the complete hash.
Solution Approach 2:
The patent extracts only the necessary portion (prefix) of the credential data needed for breach detection, leaving the sensitive remainder (suffix) on the client device. This extraction principle enables the system to perform effective breach monitoring while minimizing the exposure of sensitive credential information to the service provider.
2Object-affected harmful factors
If partial password hashes are used for monitoring, then user privacy is improved, but breach detection capability is worsened
Solution Approach 1:
The breach detection service maintains a database of segmented credential data in the form of prefix-suffix pairs. By segmenting the stored credentials into the same format as client submissions, the service can perform accurate matching while working exclusively with partial hashes, thus maintaining both privacy and detection reliability.
Solution Approach 2:
The patent changes the parameter of credential representation from full hashes to prefix-suffix pairs. This parameter change enables the system to achieve the same breach detection functionality while operating with reduced-information inputs, thereby maintaining reliability without compromising privacy.
3Measurement precision
If full credentials are stored in breach database, then matching accuracy is improved, but security vulnerability is worsened
Solution Approach 1:
The patent segments all credentials stored in the breach database into prefix-suffix pairs. This segmentation ensures that even if the database is compromised, attackers only obtain segmented data that is significantly harder to reverse-engineer than full hashes, reducing the security vulnerability while maintaining matching accuracy through the pair-based comparison system.
Data Source
AI summary
The disclosed computer-implemented method for password breach monitoring and notification may include (i) detecting a set of authentication credentials for a user, (ii) generating a one-way hash for a password associated with the authentication credentials, (iii) selecting a hash prefix including a subset of data in the hash, (iv) sending the hash prefix to a backend service for matching with a set of hash suffixes associated with known compromised passwords, (v) determining that a breach has occurred based on the password associated with the authentication credentials being compromised when the hash prefix matches a hash suffix in the set of hash suffixes, and (vi) performing a security action that protects against an additional breach associated with the compromised password. Various other methods, systems, and computer-readable media are also disclosed.