Password Filtering Against Compromised Credentials in Private Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity measures are inadequate in preventing the use of stolen or compromised security credentials, as users often reuse passwords, leading to easy exposure and theft, which can result in significant financial losses and breaches, with existing systems like 'Have I Been Pwned' being underutilized and responses to threats being high-latency and complex.
Innovation Solution
Integrating a repository of compromised credentials with an identity management system, such as a password manager, to compare user credentials with a set of compromised credentials, notify users of breaches, and prevent access, using real-time detection and proactive measures to enforce strong password creation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users reuse passwords or use low-entropy variations, then ease of operation is improved, but security reliability deteriorates
Solution Approach 1:
The system performs preliminary checking of passwords against compromised credential databases before allowing account access. By proactively detecting compromised credentials in advance, the system prevents unauthorized access while allowing users to maintain their password choices, thus resolving the contradiction between ease of operation and security reliability
Solution Approach 2:
The patent introduces an intermediary credential-monitoring application that acts as a mediator between users and the authentication system. This intermediary layer checks passwords against compromised credential databases without requiring users to change their passwords, thereby maintaining ease of operation while improving security reliability through automated threat detection
2Difficulty of detecting and measuring
If external credential monitoring systems are used, then security detection capability is improved, but response time deteriorates
Solution Approach 1:
The patent merges the credential-monitoring application with the private computer network's authentication system. By combining external detection capabilities with internal authentication processes, the system achieves both improved detection capability and fast response time, as the integrated system can block compromised credentials in real-time without external latency
Solution Approach 2:
The system performs preliminary detection of compromised credentials by maintaining a local database of known compromised passwords within the private network. This preliminary action enables rapid detection and blocking of stolen credentials before they can be used for unauthorized access, resolving the contradiction between detection capability and response time
3Reliability
If comprehensive password filtering criteria are applied, then security reliability is improved, but device complexity increases
Solution Approach 1:
The patent applies partial filtering by focusing on the most critical security criterion: checking whether passwords match known compromised credentials in a database. Rather than implementing all possible password strength checks, the system concentrates resources on the highest-impact detection method, thus improving security reliability without excessive device complexity
Solution Approach 2:
The credential-monitoring application performs automated self-service by independently checking passwords against the compromised credential database and automatically blocking unauthorized access attempts. This self-service approach eliminates the need for complex manual security configurations, reducing device complexity while maintaining high security reliability through automated multi-criteria filtering
Data Source
AI summary
Provided is a process, including: obtaining a first password to a private computer network; determining, with a credential-monitoring application within the private computer network, whether the first password satisfies one or more criteria by: comparing the first password to a set of compromised credentials within a database within the private computer network; and determining whether the first password matches one or more passwords within the database; and in response to the determination that the first password satisfies the one or more criteria from among the plurality of criteria, causing a use of the first password to access the private computer network to be rejected and causing a first user associated with the first password to be notified to change the first password.