DETECTING USER CREDENTIALS FROM INPUTTED DATA

• US 20170169210A1
• Filed: 02/28/2017
• Published: 06/15/2017
• Est. Priority Date: 01/09/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: GitHub Incorporated (Microsoft Corporation)
• Inventors: Marti, Vicent
• Granted Patent: US 9,916,438 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management

Abstract

A system for detecting user credentials comprising an interface and a processor. The interface is configured to receive a plurality of data chunks. The processor is configured to determine a number of continuous bytes in the plurality of data chunks having appropriate values and, in the event that the number of the continuous bytes is greater than or equal to a threshold number of bytes, determine whether continuous byte data of the continuous bytes comprises a credential.

Claims

1. A system for detecting user credentials, comprising:

an interface configured to

receive a plurality of data chunks;

a processor configured to;

determine a number of continuous bytes in the plurality of data chunks having appropriate values; and

in the event that the number of the continuous bytes is greater than or equal to a threshold number of bytes, determine whether continuous byte data of the continuous bytes comprises a credential.

2. A system as in claim 1, further comprising a data chunk storage configured to store the plurality of data chunks.

3. A system as in claim 1, wherein appropriate values comprise values in a range of ASCII values.

4. A system as in claim 1, wherein the threshold number of bytes comprises a minimum credential length.

5. A system as in claim 1, wherein determining whether data of the continuous bytes comprises a credential comprises matching the continuous byte data to a credential pattern.

6. A system as in claim 1, wherein determining whether data of the continuous bytes comprises a credential comprises matching the continuous byte data to a credential prefix.

7. A system as in claim 1, wherein determining whether data of the continuous bytes comprises a credential comprises determining whether the continuous byte data meet a credential entropy test.

8. A system as in claim 1, wherein a data chunk of the plurality of data chunks comprises an M-byte data chunk

9. A system as in claim 8, wherein the M-byte data chunk comprises one of the following:

a 4 byte chunk, 8 byte chunk, a 16 byte chunk, a 32 byte chunk, a 64 byte chunk, or a 128 byte chunk.

10. A system as in claim 1, wherein a bit is used to indicate a byte having the appropriate value.

11. A system as in claim 10, wherein the number of the continuous bytes is represented using a continuous number of bits.

12. A system as in claim 11, wherein determining whether the number of the continuous bytes is greater than or equal to the threshold number of bytes comprises determining the continuous number of bits across N data chunks.

13. A system as in claim 12, wherein N comprises one of the following:

1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, or 16.

14. A system as in claim 1, wherein receiving the plurality of data chunks comprises receiving input data and determining the plurality of data chunks from the input data.

15. A system as in claim 1, wherein the processor is further configured to delete the credential in the event that the continuous byte data comprises the credential.

16. A system as in claim 1, wherein the processor is further configured to replace the is credential in the event that the continuous byte data comprises the credential.

17. A system as in claim 1, wherein the processor is further configured to indicate that the credential has been uploaded in the event that the continuous byte data comprises the credential.

18. A method for detecting user credentials, comprising:

receiving a plurality of data chunks;

determining, using a processor, a number of continuous bytes in the plurality of data chunks having appropriate values; and

in the event that the number of the continuous bytes is greater than or equal to a threshold number of bytes, determining whether continuous byte data of the continuous bytes comprises a credential.

19. A computer program product for detecting user credentials, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving a plurality of data chunks;

determining, using a processor, a number of continuous bytes in the plurality of data chunks having appropriate values; and

in the event that the number of the continuous bytes is greater than or equal to a threshold number of bytes, determining whether continuous byte data of the continuous bytes comprises a credential.