Two-level sequence learning for password strength evaluation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current password management systems lack a standardized approach to measuring password strength, leading to vulnerabilities due to the use of easily guessable passwords, which can result in identity theft and data loss, as users often choose common passwords to facilitate memory rather than security.

Innovation Solution

A computer-implemented method using two-level sequence learning to analyze, meter, generate, and crack passwords by categorizing existing passwords into semantic categories, learning composition patterns, and evaluating candidate passwords based on defined strength thresholds, thereby enhancing password security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If users choose common passwords to facilitate memory, then ease of operation is improved, but password strength deteriorates

Engineering Contradiction:
Improveease of memoryVSAvoidpassword strength
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The system performs preliminary analysis of password patterns and entropy calculations before the user finalizes their password choice. By pre-evaluating candidate passwords against learned composition patterns and semantic categories, the system can warn users about weak passwords before they are set, allowing users to choose memorable passwords while avoiding those with low entropy.

Inventive Principle:
Principle #10Preliminary action

2Measurement precision

If systems provide password strength meters with different rules, then measurement capability is improved, but standardization deteriorates

Engineering Contradiction:
Improvepassword strength evaluationVSAvoidstandardization
Core Design Contradiction:
Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The machine learning component is trained on a diverse dataset of existing passwords and learns universal composition patterns and semantic categories that apply across different password contexts. This enables the system to provide standardized password strength evaluation that can be consistently applied across multiple systems and platforms, while still adapting to different password policies and requirements.

Inventive Principle:
Principle #6Universality (Multi-functionality)

3Measurement precision

If a machine learning component learns composition patterns from existing passwords, then password analysis capability is improved, but processing complexity increases

Engineering Contradiction:
Improvepassword pattern recognitionVSAvoidprocessing complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The password analysis process is segmented into distinct stages: training phase where the machine learning component learns from existing passwords, and evaluation phase where candidate passwords are assessed. During training, the system learns composition patterns and semantic categories separately, then combines this knowledge for evaluation. This segmentation allows complex pattern recognition to be broken down into manageable components that can be processed efficiently.

Inventive Principle:
Principle #1Segmentation

Data Source

PatentUS11171946B2Two-level sequence learning for analyzing, metering, generating, and cracking passwords
Publication Date: 2021.11.09 INTERNATIONAL BUSINESS MACHINE CORPORATION
  • US11171946B2 patent drawing
  • US11171946B2 patent drawing
  • US11171946B2 patent drawing

AI summary

Managing passwords is provided. A machine training process is performed using a set of existing passwords to train a machine learning component. Members of a set of semantic categories are used to categorize respective passwords in the set of existing passwords. Password strengths corresponding to a set of candidate passwords are evaluated using the machine learning component. A resource is secured with a candidate password having a password strength greater than or equal to a defined password strength threshold level.