Password Uniqueness Enforcement via Credential Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to enforce password uniqueness across assets of different values and access privileges, allowing attackers to reuse passwords, which compromises security and defeats the purpose of separating credentials for varying asset values or privileges.
Innovation Solution
A computer-implemented method using Password Relationship Objects (PROs) to enforce password uniqueness by evaluating uniqueness policies, matching policies, and enforcement policies, which block password reuse across different user accounts and assets, ensuring unique passwords are used for each account.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If different credential sets are used for assets of different value, then security is improved by limiting damage from credential compromise, but password re-use across assets defeats this security measure
Solution Approach 1:
The system implements feedback by continuously monitoring password usage across multiple assets and providing real-time alerts when password re-use is detected. The credential monitoring service analyzes authentication events and notifies users when their credentials appear on unauthorized assets, enabling them to correct the security issue promptly.
Solution Approach 2:
The patent introduces a credential monitoring service as an intermediary between users and multiple assets. This service acts as a mediator that tracks credential usage, detects re-use patterns, and coordinates security responses without requiring users to manually manage credentials across numerous assets.
2Ease of operation
If password re-use is allowed across assets, then ease of operation is improved by reducing password management complexity, but security is compromised as attackers can reuse credentials from low-value to high-value assets
Solution Approach 1:
The system enables self-service by allowing users to automatically register their credentials with the monitoring service, which then autonomously tracks and protects their usage. Users benefit from automated credential monitoring and alerting without manual intervention, while the system independently detects and responds to security threats.
Solution Approach 2:
The patent replaces manual password management mechanics with automated electronic monitoring. Instead of users manually tracking their credentials across assets, an automated credential monitoring service uses digital fingerprinting and authentication event analysis to detect re-use, substituting mechanical tracking with intelligent software-based surveillance.
3Measurement precision
If comprehensive password monitoring is implemented across all assets, then detection precision is improved by identifying password re-use, but device complexity increases due to the need for centralized monitoring infrastructure
Solution Approach 1:
The credential monitoring service implements universality by providing multiple functions through a single platform: credential registration, digital fingerprinting, authentication event monitoring, re-use detection, and alerting. This multi-functional approach consolidates what would otherwise require separate systems for each security function.
Solution Approach 2:
The patent merges credential monitoring, authentication event logging, and security analysis into a single integrated credential monitoring service. By combining these previously separate functions into one unified system, the patent reduces overall architectural complexity while maintaining comprehensive monitoring capabilities.
Data Source
AI summary
Embodiments provide a computer implemented method of enforcing password uniqueness for different user accounts of a particular user. The method includes: receiving a first new password from a first user account of the particular user, wherein the first user account is associated with a first system/object referenced by a first Password Relationship Object (PRO); evaluating a uniqueness policy to determine whether password uniqueness is required by one or more other PROs, wherein each system/object referenced by the one or more other PROs has a different user account of the particular user; if the password uniqueness is required by the one or more other PROs, evaluating a matching policy to determine whether the first new password matches any password of each different user account associated with one or more systems/objects referenced by the one or more other PROs; if there is a match, enforcing an enforcement policy.