Back to results
US 8,412,931 B2Granted
Techniques for credential strength analysis via failed intruder access attempts
AssigneeApple Inc.
InventorsSrinivas Vedula, Cameron Craig Morris
Life of this patent
Estimating the term…
Abstract
Techniques for credential strength analysis via failed intruder access attempts are presented. Intruders attempting to access a secure network with failed credentials are monitored. The failed credentials are retained and evaluated in view of previously recorded failed credentials. Credential policy is updated in response to the evaluation and intruder trends and sophistication levels are also predicted in response to the evaluation.
Claims23
A machine-implemented method implemented in a non-transitory machine-readable medium and for execution on a machine, comprising:
- detecting, by the machine, that a failed authentication to a secure network has occurred;
- acquiring, by the machine, a failed credential used in the failed authentication from an authentication service, the failed authentication included a valid user identifier and the failed credential and automatically deriving a failed pattern used with the failed authentication;
- determining, by the machine, when the failed credential falls within a defined threshold of tolerance, the defined threshold of tolerance is a numeric range, a numeric value for the failed credential is obtained by comparing the failed credential and its failed pattern against a legitimate credential having a legitimate pattern for the valid user identifier and determining when the numeric value falls within the numeric range or outside the numeric range;
- ignoring, by the machine, the failed credential when the numeric value falls within the numeric range by assuming an instance where a valid user for the valid user identifier has mistyped a part of the legitimate credential with the failed credential;
- recording, by the machine, the failed credential and failed pattern in a failed credential store when the numeric value associated with the failed credential falls outside the numeric range;
- and
- using, by the machine and in accordance with a policy, when the numeric value associated with the failed credential falls outside the numeric range, the failed credential and other entries for other failed credentials in the failed credential store to resolve a strength attribute associated with the legitimate credential or one or more existing valid credentials that properly authenticate to the secure network, and dynamically modifying the strength attribute associated with the legitimate credential or one or more existing valid credentials to increase security within the secure network.
4 more elements
A machine-implemented method implemented in a non-transitory machine-readable medium and for execution on a machine, comprising:
- determining, by the machine, a failed password supplied with a valid user identification in an attempt to access a secure resource, the failed password and the valid user identification originates from an intruder;
- automatically analyzing, by the machine, the failed password in view of previous failed passwords and previous patterns associated with those failed passwords, the previous patterns automatically derived and retained with the failed passwords for the analysis;
- and
- updating, by the machine, intruder detection metrics in response to the analysis, the intruder detection metrics include rankings and patterns for the failed passwords and are used for dynamically adjusting password policy.
1 more element
A system, comprising:
- an authentication service implemented in a non-transitory machine-accessible and computer-readable medium and that executes on a machine;
- the credential analysis service implemented in a non-transitory machine-accessible and computer-readable medium and to process on the machine or a different machine;
- wherein the authentication service is to supply a failed credential, which is associated with a legitimate resource identifier, to the credential analysis service when a requesting resource attempts to use the failed credential under the guise of the legitimate resource identifier for purposes of accessing a secure network, and wherein the credential analysis service is to determine when the requesting resource is an intruder and when the intruder is detected, the credential analysis service dynamically and automatically acquires metrics associated with the failed credential and its usage by the intruder and updates an intruder data store, and wherein the credential analysis service evaluates the data store having other previously dynamically and automatically derived metrics associated with other failed credentials and other intruders for purposes of adjusting strength values for legitimate credentials used in the secure network and for purposes of dynamically and automatically adjusting a credential policy that is derived from intruder trends, the credential policy for usage of the legitimate credentials.
A system, comprising:
- a password service implemented in a non-transitory machine-accessible and computer-readable medium and is to process on a machine;
- and
- a intruder analysis service implemented in a non-transitory machine-accessible and computer-readable medium and is to process on the machine or a different machine;
- wherein the password service supplies a failed password and user identifier received from a requesting user, who is attempting to login to a secure network, to the intruder analysis service, and wherein the intruder analysis service is to dynamically and automatically evaluate the failed password, in view of a data store of failed passwords historically maintained for previously failed passwords used to attempt access into the secure network, each previous failed password having a previously dynamically and automatically derived previous failed patters and the failed passwords and the failed patterns used for purposes of automatically and dynamically adjusting password policy for the secure network for legitimate passwords of the secure network.
1 more element
Dependencies are inferred from the claim text.