Secure System and Method for Detecting Credential Stuffing Attacks

A centralized system for preventing cross-site credential reuse comprising:

• a central database, hosted on at least one of a plurality of servers, for storing data relating to credentials associated with a plurality of secure services hosted on the plurality of servers;
• whereby at least one of the plurality of secure services is configured to communicate with the central database such that the at least one of the plurality of secure services determines whether a credential is used across more than one of the plurality of secure services,
• whereby the at least one of the plurality of secure services is configured to jointly execute with the central database a secure multi-party computation cryptographic protocol such that the central database cannot ascertain the identities of users of the at least one of the plurality of secure services,
• wherein a private set intersection of credentials is computed such that the at least one of the plurality of secure services determines whether a credential is used across more than one of the plurality of secure services,
• wherein at least one of the plurality of secure services is configured to store cryptographic hashes of credentials,
• wherein credentials that are the same, or similar but not identical, are identified, and
• wherein similarity to other credentials or the same credentials in the central database are used to calculate credential strength.

A decentralized system for preventing cross-site credential reuse comprising:

• a secured service belonging to a plurality of secure services hosted on a plurality of servers, each of the plurality of secure services having its own set of credentials, the plurality of secure services together forming a decentralized system, wherein each of a plurality of entities in the decentralized system is configured to execute a substantively identical decentralized protocol such that no entity assumes a role of special privilege, authority, or trust in the decentralized system and no entity serves a unique or centralized function in the decentralized system;
• whereby the secured service of the plurality of secure services communicates directly with at least one other of the plurality of secure services such that the secured service of the plurality of secure services determines whether a credential is used across more than one of the plurality of secure services,
• whereby the secured service of the plurality of secure services and the at least one other of the plurality of secure services jointly execute a secure multi-party computation cryptographic protocol such that the at least one other of the plurality of secure services cannot ascertain the identities of users of the secured service of the plurality of secure services,
• whereby a private set intersection of credentials is computed such that the secured service of the plurality of secure services determines whether a credential is used across more than one of the plurality of secure services,
• whereby at least one of the plurality of secure services is configured to store cryptographic hashes of credentials,
• wherein credentials that are the same, or similar but not identical, are identified, and
• wherein similarity to other credentials or the same credentials in the central database are used to calculate credential strength.

A federated system for preventing cross-site credential reuse comprising:

• a secured service belonging to a plurality of secure services hosted on a first plurality of servers, each of the plurality of secure services having its own set of credentials;
• whereby the secured service of the plurality of secure services communicates with at least one of a plurality of service providers such that the secured service of the plurality of secure services determines whether a credential is used across more than one of the plurality of secure services,
• wherein the plurality of service providers is hosted on a second plurality of servers, the plurality of service providers together forming a decentralized system, wherein each of a plurality of entities in the decentralized system is configured to execute a substantively identical decentralized protocol such that no entity assumes a role of special privilege, authority, or trust in the decentralized system and no entity serves a unique or centralized function in the decentralized system
• whereby at least one of the plurality of service providers is configured to communicate directly with at least one other of the plurality of service providers such that the at least one of the plurality of service providers is able to determine whether a credential is used across more than one of the plurality of service providers,
• whereby the at least one of the plurality of service providers and the at least one other of the plurality of service providers are configured to jointly execute a secure multi-party computation cryptographic protocol such that the at least one other of the plurality of service providers cannot ascertain the identities of users of the at least one of the plurality of service provider,
• wherein a private set intersection of credentials is computed such that the secured service of the plurality of secure services determines whether a credential is used across more than one of the plurality of secure services,
• wherein at least one of the plurality of secure services is configured to store cryptographic hashes of credentials,
• wherein credentials that are the same, similar but not identical, are identified, and
• wherein similarity to other credentials or the same credentials in the central database are used to calculate credential strength.