US 11,888,843 B2 · Filtering passwords based on a plurality of criteria · patentgrep

Loading patent…

Abstract

Provided is a process, including: obtaining a first password to a private computer network; determining, with a credential-monitoring application within the private computer network, whether the first password satisfies one or more criteria by: comparing the first password to a set of compromised credentials within a database within the private computer network; and determining whether the first password matches one or more passwords within the database; and in response to the determination that the first password satisfies the one or more criteria from among the plurality of criteria, causing a use of the first password to access the private computer network to be rejected and causing a first user associated with the first password to be notified to change the first password.

Claims96

Dependent claims

A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

obtaining, with a computer system, a first password, the first password being associated with a first username and serving to afford access to a network-accessible resource;
receiving, with the computer system and via a network, a differential update from a remote credential-monitoring system of credentials determined to have been compromised since a previous update of a database resident on a private computer network;
writing, with the computer system, the differential update to the database;
determining, with the computer system, whether the first password satisfies one or more criteria from among a plurality of criteria, wherein the determining whether the first password satisfies the one or more criteria includes determining whether the first password satisfies a first criterion among the plurality of criteria that includes:
comparing the first password to a set of compromised credentials within the database;
and
determining whether the first password matches one or more passwords within the database, wherein the first criterion is satisfied in response to the one or more passwords matching the first password, and wherein the determining whether the first password matches the one or more passwords within the database includes comparing the first password to updated credentials in the database;
and
in response to the determination that the first password satisfies the one or more criteria from among the plurality of criteria, causing, with the computer system, a use of the first password to access the network-accessible resource to be rejected.

6 more elements

A method, comprising:

obtaining, with a computer system, a first password, the first password being associated with a first username and serving to afford access to a network-accessible resource;
receiving, via a network, a differential update from a remote credential-monitoring system of credentials determined to have been compromised since a previous update of a database resident on a private computer network;
writing the differential update to the database;
determining, with the computer system, whether the first password satisfies one or more criteria from among a plurality of criteria, wherein the determining whether the first password satisfies the one or more criteria includes determining whether the first password satisfies a first criterion among the plurality of criteria that includes:
comparing the first password to a set of compromised credentials within the database;
and
determining whether the first password matches one or more passwords within the database, wherein the first criterion is satisfied in response to the one or more passwords matching the first password, wherein determining whether the first password matches the one or more passwords within the database includes comparing the first password to updated credentials in the database;
and
in response to the determination that the first password satisfies the one or more criteria from among the plurality of criteria, causing, with the computer system, a use of the first password to access the network-accessible resource to be rejected.

6 more elements

A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

obtaining, with a computer system, a first password, the first password being associated with a first username and serving to afford access to a network-accessible resource;
determining, with the computer system, whether the first password satisfies one or more criteria from among a plurality of criteria, wherein the determining whether the first password satisfies the one or more criteria includes determining whether the first password satisfies a first criterion among the plurality of criteria that includes:
generating a criterion for a comparison, the criterion for the comparison being generated at least based on whether another comparison identifying the first password has been previously made;
comparing the first password to a set of compromised credentials within a database, wherein the database is continuously updated with additional compromised credentials;
determining whether the first password matches one or more passwords within the database, wherein the first criterion is satisfied in response to the one or more passwords matching the first password;
receiving, from the database, the one or more passwords that matches the first password based on the comparison and the criterion for the comparison;
and
in response to the determination that the first password satisfies the one or more criteria from among the plurality of criteria, causing, with the computer system, a use of the first password to access the network-accessible resource to be rejected.

5 more elements

A method, comprising:

obtaining, with a computer system, a first password, the first password being associated with a first username and serving to afford access to a network-accessible resource;
determining, with the computer system, whether the first password satisfies one or more criteria from among a plurality of criteria, wherein the determining whether the first password satisfies the one or more criteria includes determining whether the first password satisfies a first criterion among the plurality of criteria that includes:
generating a criterion for a comparison, the criterion for the comparison being generated at least based on whether another comparison identifying the first password has been previously made;
comparing the first password to a set of compromised credentials within a database, wherein the database is continuously updated with additional compromised credentials;
determining whether the first password matches one or more passwords within the database, wherein the first criterion is satisfied in response to the one or more passwords matching the first password;
and
receiving, from the database, the one or more passwords that matches the first password based on the comparison and the criterion for the comparison;
and
in response to the determination that the first password satisfies the one or more criteria from among the plurality of criteria, causing, with the computer system, a use of the first password to access the network-accessible resource to be rejected.

6 more elements

A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

obtaining, with a computer system, a first password, the first password being associated with a first username and serving to afford access to a network-accessible resource;
determining, with the computer system, whether the first password satisfies one or more criteria from among a plurality of criteria, wherein the determining whether the first password satisfies the one or more criteria includes determining whether the first password satisfies a first criterion among the plurality of criteria that includes:
comparing the first password to a set of compromised credentials within a database;
and
determining whether the first password matches one or more passwords within the database,
wherein the first criterion is satisfied in response to the one or more passwords matching the first password,
wherein the set of compromised credentials comprise more than 100 million compromised credentials;
and
wherein the determining that a second password does not appear in the set of compromised credentials is performed within 5 seconds of obtaining the second password;
and
in response to the determination that the first password satisfies the one or more criteria from among the plurality of criteria, causing, with the computer system, a use of the first password to access the network-accessible resource to be rejected.

8 more elements

A method, comprising:

obtaining, with a computer system, a first password, the first password being associated with a first username and serving to afford access to a network-accessible resource;
determining, with the computer system, whether the first password satisfies one or more criteria from among a plurality of criteria, wherein the determining whether the first password satisfies the one or more criteria includes determining whether the first password satisfies a first criterion among the plurality of criteria that includes:
comparing the first password to a set of compromised credentials within a database;
and
determining whether the first password matches one or more passwords within the database,
wherein the first criterion is satisfied in response to the one or more passwords matching the first password,
wherein the set of compromised credentials comprise more than 100 million compromised credentials;
and
wherein the determining that a second password does not appear in the set of compromised credentials is performed within 5 seconds of obtaining the second password;
and
in response to the determination that the first password satisfies the one or more criteria from among the plurality of criteria, causing, with the computer system, a use of the first password to access the network-accessible resource to be rejected.

8 more elements

A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

obtaining, with a computer system, a first password, the first password being associated with a first username and serving to afford access to a network-accessible resource;
determining, with the computer system, whether the first password satisfies one or more criteria from among a plurality of criteria, wherein the determining whether the first password satisfies the one or more criteria includes determining whether the first password satisfies a first criterion among the plurality of criteria that includes:
comparing the first password to a set of compromised credentials within a database;
and
determining whether the first password matches one or more passwords within the database,
wherein the first criterion is satisfied in response to the one or more passwords matching the first password, and
wherein the match is determined based on a cryptographic hash collision;
and
in response to the determination that the first password satisfies the one or more criteria from among the plurality of criteria, causing, with the computer system, a use of the first password to access the network-accessible resource to be rejected.

6 more elements

A method, comprising:

obtaining, with a computer system, a first password, the first password being associated with a first username and serving to afford access to a network-accessible resource;
determining, with the computer system, whether the first password satisfies one or more criteria from among a plurality of criteria, wherein the determining whether the first password satisfies the one or more criteria includes determining whether the first password satisfies a first criterion among the plurality of criteria that includes:
comparing the first password to a set of compromised credentials within a database;
and
determining whether the first password matches one or more passwords within the database,
wherein the first criterion is satisfied in response to the one or more passwords matching the first password, and
wherein the match is determined based on a cryptographic hash collision;
and
in response to the determination that the first password satisfies the one or more criteria from among the plurality of criteria, causing, with the computer system, a use of the first password to access the network-accessible resource to be rejected.

6 more elements

A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

obtaining, with a computer system, a first password, the first password being associated with a first username and serving to afford access to a network-accessible resource;
determining, with the computer system, whether the first password satisfies one or more criteria from among a plurality of criteria, wherein the plurality of criteria includes a first criterion, wherein determining whether the first password satisfies the first criterion includes determining whether the first password includes one or more context-specific words, and wherein the first criterion is satisfied in response to the determination that the first password includes the one or more context-specific words;
and
in response to the determination that the first password satisfies the one or more criteria from among the plurality of criteria, causing, with the computer system, a use of the first password to access the network-accessible resource to be rejected.

1 more element

A method, comprising:

obtaining, with a computer system, a first password, the first password being associated with a first username and serving to afford access to a network-accessible resource;
determining, with the computer system, whether the first password satisfies one or more criteria from among a plurality of criteria, wherein the plurality of criteria includes a first criterion, wherein determining whether the first password satisfies the first criterion includes determining whether the first password includes one or more context-specific words, and wherein the first criterion is satisfied in response to the determination that the first password includes the one or more context-specific words;
and
in response to the determination that the first password satisfies the one or more criteria from among the plurality of criteria, causing, with the computer system, a use of the first password to access the network-accessible resource to be rejected.

1 more element

Dependencies are inferred from the claim text.

Facts

Application: 17/846,938Filed 22 Jun 2022 · continuation
Priority: 31 Oct 2018
Published: US 2022/0407849 A122 Dec 2022
Granted: 30 Jan 2024
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

H04L 63/083
For authentication of entities: using passwords
H04L 63/1466
Countermeasures against malicious traffic: active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g.…
G06F 21/46
Structures or tools for the administration of authentication: by designing passwords or checking the strength of passwords
H04L 63/102
For controlling access to devices or network resources: entity profiles

Family

Application62/753,807Us provisional application · filed 31 Oct 2018
Application16/667,447Parent of this continuation · filed 29 Oct 2019
US 2022/0407849 A1Pre-grant publication · published 22 Dec 2022
US 11,399,021 B2Parent of this continuation
US 2020/0137038 A1Published application
US 11,888,843 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere