Plaintext Password Detection Using Stepped Context Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting plaintext passwords in enterprise storage face high false negatives and false positives due to idiosyncratic password creation, high computation costs, and lack of context, especially in free-flowing text without syntax or semantics, leading to inefficient and resource-intensive solutions.
Innovation Solution
A multi-stepped context analysis approach that includes file-based, content-based, and proximity-based context scanning, combined with machine learning models, to identify potential passwords and reduce false positives and negatives, using configuration parameters for selective scanning and kernel-based protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional password scanning techniques are used to detect plaintext passwords, then detection coverage is achieved, but computational cost increases significantly due to the need to scan and analyze too many files
Solution Approach 1:
The patent segments the password detection process into multiple passes: a first pass that performs both password scanning and context scanning simultaneously on all files, and a second pass that performs password scanning only on files where context scanning identified potential passwords. This segmentation reduces the number of files requiring intensive password analysis while maintaining comprehensive detection coverage.
Solution Approach 2:
The patent applies partial action by performing context scanning on all files in the first pass to identify files containing password-related contexts, and then performing intensive password scanning only on the subset of files where passwords are likely to be found. This approach avoids the excessive computational cost of scanning all files with full password detection algorithms.
2Measurement precision
If context scanning is performed to reduce false positives and negatives, then detection accuracy improves, but the complexity of the scanning system increases
Solution Approach 1:
The patent merges password scanning and context scanning into a unified multi-pass system. The first pass combines both scanning types to identify files with password-related contexts, and the second pass focuses password scanning on those identified files. This merging approach improves detection accuracy by considering both password patterns and contextual information while managing system complexity through structured organization of the scanning processes.
Solution Approach 2:
The patent performs context scanning as a preliminary action in the first pass to identify files containing password-related contexts before performing intensive password scanning. This preliminary context analysis filters the file set, reducing the workload for subsequent password detection while improving overall detection accuracy by focusing resources on relevant files.
3Measurement precision
If multiple scanning passes are performed to improve password detection accuracy, then false positives and negatives are reduced, but processing time increases
Solution Approach 1:
The patent segments the detection process into two passes with different objectives: the first pass performs both context and password scanning to identify candidate files, and the second pass performs password scanning only on files where context scanning identified potential passwords. This segmentation reduces total processing time by avoiding redundant password scanning on files unlikely to contain passwords, while maintaining high detection accuracy through the two-pass approach.
Data Source
AI summary
The disclosure relates generally to methods and systems for building rich context for effective password detection in plaintext. Detecting and securing plaintext passwords on hard-disk or storage device is difficult as humans generate passwords in a variety of idiosyncratic ways which results in high false negatives and involves a high computation cost. In the present disclosure, a stepped context analysis is performed which applies different context discovery strategies in sequential manner. In scenarios, where a potential password is unable to find in a file using simple detection method, but if the context likelihood of the file is higher than the configured threshold then the file is searched again with more detailed techniques for detecting presence of a potential password. This selective second pass for a few files helps in reducing the false negatives while balancing the proposed solution's performance.