Popularity Determination Module for Password Guessing Risk
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password selection mechanisms are inadequate in preventing statistical guessing attacks, as they often complicate user experience and do not effectively reduce password predictability, as users may choose complex passwords that are still easily guessable due to common patterns.
Innovation Solution
A popularity determination module (PDM) assesses the popularity of passwords by maintaining count information on previously selected passwords, allowing users to choose any password not deemed popular, thereby reducing the risk of prediction and eliminating common, easily guessable entries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users select passwords that are easy to remember using common strategies, then ease of operation is improved, but security is worsened due to increased predictability
Solution Approach 1:
The system provides real-time feedback to users about password popularity and predictability risk. The popularity determination module analyzes the selected password and returns popularity information to the user, allowing them to adjust their choice without needing to understand complex security rules. This feedback mechanism helps users make better security decisions while maintaining ease of use.
Solution Approach 2:
The popularity determination module acts as an intermediary between the user's memory-based password selection and the security requirements. Instead of directly enforcing complex password rules, the PDM provides popularity assessments that mediate between what users want (easy-to-remember passwords) and what is secure (unpredictable passwords).
2Reliability
If the system enforces strict password rules and uses strength meters, then security is improved, but device complexity and user annoyance increase
Solution Approach 1:
The invention extracts the essential security function from complex rule-based systems and strength meters. Instead of enforcing multiple password rules or displaying complex strength assessments, the system extracts and implements only the core function of identifying popular and predictable passwords through the popularity determination module, simplifying the overall mechanism.
Solution Approach 2:
The popularity determination module copies and analyzes actual user behavior patterns from historical data rather than relying on theoretical password strength metrics. By copying real-world password selection patterns, the system achieves security effectiveness without the complexity of rule-based enforcement systems.
3Ease of operation
If users try to simplify passwords to make them memorable, then ease of operation is improved, but security is worsened as users circumvent password policies
Solution Approach 1:
The system provides feedback about password popularity that works effectively even when users try to circumvent policies. Instead of relying on users to follow rules, the popularity determination module analyzes the actual password chosen and provides feedback on its popularity, preventing policy-circumventing passwords from being selected because they are still identified as popular choices.
Solution Approach 2:
The system changes the evaluation parameter from rule-based compliance to popularity-based assessment. Rather than checking whether a password follows stated policies, the system evaluates whether the password is popular among users, which naturally prevents policy-circumventing passwords from being selected since they will be identified as popular choices.
Data Source
AI summary
A popularity determination module (PDM) is described which reduces the effectiveness of statistical guessing attacks. The PDM operates by receiving a password (or other secret information item) from a user. The PDM uses a model to determine whether the password is popular among a group of users. If so, the PDM may ask the user to select another password. In one implementation, the model corresponds to a probabilistic model, such a count-min sketch model. The probabilistic model provides an upper-bound assessment of a number of times that a password has been encountered. Further, the probabilistic model provides false positives (in which passwords are falsely assessed as popular) at a rate that exceeds a prescribed minimum rate. The false positives are leveraged to reduce the effectiveness of statistical guessing attacks by malicious entities.