Password Breach Registry for Credential Reuse Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing rate of password breaches allows malicious actors to access multiple user accounts by reusing stolen credentials across different websites and applications, posing a significant security risk as passwords are often reused and stored in databases that can be compromised.
Innovation Solution
A publicly accessible password breach registry in a blockchain-like format is used to securely publish password tokens from breached service providers, allowing subscribing services to query and lock out users whose credentials have been compromised, preventing malicious access by forcing additional authentication measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords are stored in databases for user authentication, then user account access is enabled, but password databases can be accessed by malicious actors leading to credential theft
Solution Approach 1:
The patent introduces a password breach registry as an intermediary system that sits between password storage and authentication. This registry maintains a separate database of breached credentials and provides query services to subscribing websites without exposing the actual passwords, thereby enabling security verification while maintaining authentication functionality
Solution Approach 2:
The system enables websites to autonomously query the breach registry and implement their own security measures by locking out compromised credentials. This self-service approach allows individual websites to protect their users without requiring centralized control or modification of password storage systems
2Ease of operation
If users reuse the same username and password across multiple websites, then account creation is simplified, but a single database breach allows attackers to access additional websites
Solution Approach 1:
The system implements a feedback mechanism where breached credential information flows from compromised websites through the breach registry back to subscribing websites. This feedback loop enables real-time security updates, allowing websites to respond to breaches by locking out compromised accounts before attackers can exploit them
3Reliability
If a password breach registry is implemented to prevent credential reuse, then malicious access is prevented, but websites must periodically query the registry increasing system complexity
Solution Approach 1:
The breach registry is pre-populated with breached credential data before websites need to query it. By maintaining an up-to-date database of compromised credentials in advance, the system eliminates the need for websites to perform complex real-time analysis, reducing their computational burden while maintaining security
Data Source
AI summary
A password breach registry is utilized to secure a service provided by a service provider. The password breach registry is a publicly accessible registry and includes password tokens written by breached service providers. The password tokens indicate passwords used to access breached service providers that may have been breached. A service provider can subscribe to the password breach registry and periodically query the password breach registry to determine if a password token corresponding to a user of a service provided by the service provider has been written to the password breach registry. This may indicate that the user of the service utilizes the same password on other services that have been breached. Upon determining that the password token has been written to the password breach registry, the user can be locked out from the service to prevent a malicious actor from gaining access to the account of the user.