Password Strength Estimator Using Substring Entropy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional password strength calculators overestimate the strength of passwords containing common patterns, such as number-word-symbol combinations, leading to a higher chance of successful attacks by adversaries.
Innovation Solution
A system and method that assess password strength by measuring entropy based on substring combinations and their patterns, including keyboard layouts and dictionary words, to identify the weakest combination that an adversary can exploit, providing improved ratings and suggestions for stronger passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional password strength calculators use simple rules such as number of unique characters or use of special characters, then the calculation process is simple, but the password strength rating is inaccurate and overestimates the strength of passwords containing common patterns
Solution Approach 1:
The password is divided into substrings of various lengths (1 to N characters), and each substring is independently analyzed for pattern matches. This segmentation allows the system to identify common patterns like keyboard walks and dictionary words without requiring complex analysis of the entire password at once, thereby improving measurement precision while managing computational complexity through divide-and-conquer.
Solution Approach 2:
The system pre-generates and stores sets of common patterns (keyboard walks, dictionary words, common passwords) before password evaluation. These pre-computed pattern sets are then used during password strength calculation to quickly identify matches, eliminating the need for complex real-time pattern generation and improving both accuracy and efficiency.
2Reliability
If the password strength calculator does not recognize common patterns, then the calculation process is simple, but the security risk increases because adversaries can successfully break passwords using pattern-based attacks
Solution Approach 1:
The system introduces an intermediary layer of pattern matching that acts as a mediator between the simple character-based strength calculation and the actual security assessment. By introducing keyboard walk patterns, dictionary word patterns, and common password patterns as intermediary checks, the system can identify weak passwords without requiring the entire evaluation system to become overly complex.
Solution Approach 2:
The password strength evaluation is made dynamic by adjusting the strength rating based on detected patterns. When common patterns are identified, the system dynamically reduces the strength rating to reflect the actual security risk, allowing the calculator to adapt its assessment based on the specific characteristics of each password rather than applying static rules.
Data Source
AI summary
A password evaluation system is provided for determining the password strength of a password. A password is provided for evaluation. The password is parsed and substrings are identified from the password. Each substring is associated with a pattern that can generate the substring. The substrings are scored to determine a substring strength measure for the substring. The substrings are combined to identify non-overlapping substring combinations, which together make up the password. The combinations are assigned a combination strength score based in part on the substring strength of the substrings contained in the substring combinations. The substring combination with the lowest combination strength measure is identified and the associated combination strength measure is used as the password strength measure for the password.