Password check by decomposing password

• US 10,152,588 B2
• Filed: 09/01/2017
• Issued: 12/11/2018
• Est. Priority Date: 06/01/2011
• Status: Active Grant

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Inventors: Jakobsson, Bjorn Markus
• Primary Examiner(s): Brown, Anthony D
• Application Number:
  US15/694,731
• Publication Number:
  US 20180052990A1
• Time in Patent Office: 466 Days
• Field of Search: 726 6
• CPC Class Codes: A61B 2090/3735 Optical coherence tomography [OCT]
• CPC Class Codes: A61B 90/37 Surgical systems with images on a monitor during operation
• CPC Class Codes: G01B 9/02044 Imaging in the frequency domain, e.g. by using a spectrometer
• CPC Class Codes: G01B 9/02083 characterised by particular signal processing and presentation
• CPC Class Codes: G01B 9/02089 Displaying the signal, e.g. for user interaction
• CPC Class Codes: G01B 9/02091 Tomographic interferometers, e.g. based on optical coherence
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A proposed password is decomposed into basic components to determine and score transitions between the basic components and create a password score that measures the strength of the proposed password based on rules, such as concatenation, insertion, and replacement. The proposed password is scored against all known words, such as when a user is first asked to create a password for an account or access. The proposed password can also be scored against one or more previous passwords for the user, such as when the user is asked to change the user'"'"'s previous password, to determine similarity between the two passwords.

Claims

1. A system comprising:

a non-transitory memory; and

one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising;

receiving a proposed password from a user;

accessing a previous password of the user;

decomposing the proposed password and the previous password into a first plurality of components and a second plurality of components, respectively;

determining that the proposed password is formed by the first plurality of components using a first set of formation rules;

determining that the previous password is formed by the second plurality of components using a second set of formation rules; and

determining to accept the proposed password based on a comparison between the first formation rules and the second formation rules.

2. The system of claim 1, wherein determining to accept the proposed password is further based on a comparison between the first plurality of components and the second plurality of components.

3. The system of claim 1, wherein determining to accept the proposed password comprises:

determining a first similarity score based on a comparison between the first set of formation rules and the second set of formation rules;

determining a second similarity score based on a comparison between the first plurality of components and the second plurality of components; and

generating a total similarity score as a function of the first similarity score and the second similarity score.

4. The system of claim 1, wherein determining to accept the proposed password comprises:

determining a similarity score based on a comparison between the first set of formation rules and the second set of formation rules; and

determining that the similarity score is below a predetermined threshold score.

5. The system of claim 4, wherein the first set of formation rules comprises a first weight and the second set of formation rules comprises a second weight different from the first weight.

6. The system of claim 4, wherein the operations further comprise denying the proposed password when the similarity score is above the predetermined threshold score.

7. The system of claim 1, wherein determining that the proposed password is formed by the first plurality of components using the first set of formation rules comprises analyzing the first plurality of components in relation to the proposed password to detect a presence of one or more operations selected from the group of operations comprising insertion, concatenation, and replacement, used to form the proposed password from the first plurality of components.

8. The system of claim 1, wherein the previous password and the proposed password comprise alphanumeric characters and symbols.

9. The system of claim 1, wherein the first plurality of components comprises distinct, portions of the proposed password.

10. The system of claim 1, wherein the operations further comprise determining a length of the proposed password and a number of different characters used in the proposed password, wherein determining to accept the proposed password is further based on the determined length and the determined number of different characters.

17. The method of claim 1, wherein the first plurality of components comprises distinct portions of the proposed password.

18. The method of claim 1, further comprising determining a length of the proposed password and a number of different characters used in the proposed password, wherein determining to accept the proposed password is further based on the determined length and the determined number of different characters.

11. A method, comprising:

receiving, by one or more hardware processors, a proposed password from a user;

accessing, by the one or more hardware processors, a previous password of the user;

decomposing, by the one or more hardware processors, the proposed password and the previous password into a first plurality of components and a second plurality of components, respectively;

determining, by the one or more hardware processors, that the proposed password is formed by the first plurality of components using a first set of formation rules;

determining, by the one or more hardware processors, that the previous password is formed by the second plurality of components using a second set of formation rules; and

determining, by the one or more hardware processors, to accept the proposed password based on a comparison between the first formation rules and the second formation rules.

12. The method of claim 11, wherein determining to accept the proposed password comprises:

determining a similarity score based on a comparison between the first set of formation rules and the second set of formation rules; and

determining that the similarity score is below a predetermined threshold score.

13. The method of claim 12, wherein different formation rules are weighted differently for determining the similarity score between the first set of formation rules and the second set of formation rules.

14. The method of claim 12, wherein the operations further comprise denying the proposed password when the similarity score is above the predetermined threshold score.

15. The method of claim 11, wherein determining that the proposed password is formed by the first plurality of components using the first set of formation rules comprises analyzing the first plurality of components in relation to the proposed password to detect a presence of one or more operations selected from the group of operations comprising insertion, concatenation, and replacement, used to form the proposed password from the first plurality of components.

16. The method of claim 11, wherein the previous password and the proposed password comprise alphanumeric characters and symbols.

19. A non-transitory machine readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

receiving a proposed password from a user;

accessing a previous password of the user;

decomposing the proposed password and the previous password into a first plurality of components and a second plurality of components, respectively;

determining that the proposed password is formed by the first plurality of components using a first set of formation rules;

determining that the previous password is formed by the second plurality of components using a second set of formation rules; and

determining to accept the proposed password based on a comparison between the first formation rules and the second formation rules.

20. The transitory machine readable medium of claim 19, wherein determining to accept the proposed password comprises:

determining a similarity score based on a comparison between the first set of formation rules and the second set of formation rules; and

determining that the similarity score is below a predetermined threshold score.