Techniques for dynamic generation and management of password dictionaries

A method implemented in a non-transitory computer-readable storage medium and for execution on a machine, comprising:

• detecting, by the machine, an event indicating that a password database is to be analyzed;
• parsing, by the machine, the password database for recognizable terms included within passwords of the password database, each password identified as a separate password database entry in the password database, each password parsed for particular terms located as substrings within that password;
• updating, by the machine, a term database with each unique recognizable term found, each term database entry in the term database includes a unique one of the recognizable terms;
• maintaining, by the machine, a frequency counter for each term database entry and updating the term database with the frequency counter each time one of the recognizable terms is found in the password database, the frequency counter for each term reflects a total number of times that the term is used and each term database entry appearing once in the term database and stored in the term database in its morphological root format and in its proper spelling format, each frequency counter for each term including an active frequency counter and an inactive frequency counter, the active frequency counter providing a particular count for each term reflecting active passwords with that term and the inactive frequency counter providing a different count for each term reflecting prior passwords that used that term but are no longer active;
• and
• using, by the machine, each frequency counter and its associated term database entry to assign a strength attribute value to each password of the password database once the password database has been completely parsed and processed, wherein the strength attribute when combined with a policy evaluation determines when certain ones of the passwords are to be rejected or accepted, and wherein users associated with rejected passwords are given an opportunity to change those rejected passwords.

A system, comprising:

• a machine configured with a password term database residing in a non-transitory computer-readable medium and accessible to a password term processing service that executes on the machine;
• the machine is also configured with the password term processing service implemented in a non-transitory computer-readable medium and to process on the machine;
• wherein the password term processing service parses passwords for users and decomposes the passwords into terms, each term is stored a single time as an entry in the password term database and a frequency counter is maintained for each entry representing how many times the term associated with that entry was used within an enterprise secure network environment, each frequency counter including an active frequency counter for active passwords that use each term and an inactive frequency counter for prior passwords that used that term but are no longer active, and some passwords include multiple terms as substrings, each such term uniquely stored in the password term database once and some passwords share a particular same term with one another, and each term stored in a proper spelling format even when a particular password includes a misspelling for such term, and wherein the frequency counter is used to assign a strength attribute to each password and a policy dictates a minimum strength value for accepting or denying certain ones of the passwords.

A system, comprising:

• a machine configured with a password service implemented in a non-transitory computer-readable medium for processing on the machine;
• and
• the machine or a different machine configured with a password term processing service implemented in a non-transitory computer-readable medium and for processing on the machine or the different machine;
• wherein the password term processing service detects terms housed in passwords and maintains statistics for a particular term's usage throughout an enterprise environment with respect to the passwords, and wherein the password service uses the statistics to provide each password with a strength value, and the password service enforces a policy as to a minimum acceptable strength value for each password before that password is permitted for use by a particular user of the enterprise environment and the password term processing service maintains the statistics as for each password to include a frequency counter and a category, the category including whether each password is deemed an offensive term or not, each particular term including an active frequency counter for active passwords having that term and each particular term including an inactive frequency counter for prior passwords that used that term but are no longer active.