User-Specific Password Policy Generation for Brute Force Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password policies are often generic and not tailored to individual users, making them vulnerable to brute force attacks as users may employ the same complex password structures, thereby compromising security.
Innovation Solution
A method to create unique password policies on a user-by-user basis, where a random password policy is generated for each user based on a global password requirement, ensuring that each user's password meets specific and varied criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a generic password policy is applied to all users, then the implementation is simple and uniform, but the security is compromised because users may employ the same complex password structures making them vulnerable to brute force attacks
Solution Approach 1:
The patent applies local quality by generating unique password policies for individual users based on their specific characteristics (user ID, role, department). Each user receives a customized password policy with specific requirements for length, character types, and complexity, rather than applying a uniform policy to all users. This localized approach enhances security while maintaining manageable complexity through automated generation.
Solution Approach 2:
The system dynamically changes password policy parameters (minimum length, required character types, complexity requirements) based on user-specific attributes. The password policy generator modifies these parameters individually for each user, creating varied security requirements that prevent predictable password patterns while keeping the overall system manageable through automated parameter adjustment.
2Reliability
If unique password policies are generated for each user, then brute force attacks become more difficult and security is enhanced, but the system complexity increases
Solution Approach 1:
The system implements self-service by automatically generating unique password policies for each user based on their attributes without requiring manual configuration. The password policy generator autonomously creates customized policies, and the system automatically enforces these policies, reducing the operational burden despite the increased complexity of managing unique policies for each user.
Solution Approach 2:
The system manages complexity by dynamically adjusting password policy parameters based on user characteristics rather than maintaining static complex rules. This parameter-based approach allows the system to handle uniqueness and security requirements through automated generation and enforcement, rather than requiring complex manual policy management.
3Reliability
If password length is increased to 12 characters, then password strength improves, but user convenience and ease of memorization deteriorates
Solution Approach 1:
The system applies local quality by tailoring password length requirements to individual users based on their roles and security needs. Not all users require the maximum 12-character length - the system adjusts this parameter locally for each user, providing stronger passwords where needed while maintaining convenience for users with lower security requirements.
Solution Approach 2:
The system dynamically changes the minimum password length parameter based on user attributes rather than enforcing a uniform 12-character requirement. This allows the system to optimize password strength for critical accounts while maintaining ease of use for less sensitive accounts, balancing security and convenience through parameter adjustment.
Data Source
AI summary
A random password policy for a specific user associated with an entity is generated based on a global password requirement. A new password created by the specific user based on the generated random password policy is identified. That the new password complies with a set of requirements specified by the generated random password policy is confirmed.