Determining the Intersection of a Set of Compromised Credentials with a Set of Active Credentials with Data Structures and Architectures that Expedite Comparisons

• US 20200137105A1
• Filed: 10/29/2019
• Published: 04/30/2020
• Est. Priority Date: 10/31/2018
• Status: Active Grant

• Current Assignee: Spycloud, Inc.
• Original Assignee: Spycloud, Inc.
• Inventors: Endler, David
• Granted Patent: US 11,438,360 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Provided is a process that includes: obtaining, with one or more processors, a query identifying a user identification; retrieving, with one or more processors, via an application programming interface, from a database, one or more passwords associated with one or more user identification entries in the database that matches the user identification in response to the obtained query; determining, with one or more processors, whether the one or more passwords matches a password associated with the user identification; blocking, with one or more processors, access to a user account associated with the user identification and the password when the one or more passwords matches the password associated with the user identification; and notifying, with one or more processors, a user associated with the user account to reset the password when the one or more passwords matches the password associated with the user identification.

Claims

1. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

obtaining, with one or more processors, a query identifying a user identification;

retrieving, with one or more processors, via an application programming interface, from a database, one or more passwords associated with one or more user identification entries in the database that matches the user identification in response to the obtained query;

determining, with one or more processors, whether the one or more passwords matches a password associated with the user identification;

blocking, with one or more processors, access to a user account associated with the user identification and the password when the one or more passwords matches the password associated with the user identification; and

notifying, with one or more processors, a user associated with the user account to reset the password when the one or more passwords matches the password associated with the user identification.

2. The medium of claim 1, wherein the operations comprise:

obtaining the query at a scheduled time responsive to a scheduled batch process by which an intersection of a first set and a second set is determined, the first set comprising more than 100 million compromised credentials and the second set comprising more than 1 million credentials that afford access to a computer system.

3. The medium of claim 1, wherein the query identifies a plurality of user identifications so as to retrieve, from the database, passwords associated with the plurality of user identifications.

4. The medium of claim 1, wherein determining whether the one or more passwords match the password associated with the user identification comprises:

determining whether one or more of the retrieved one or more passwords is a plaintext password; and

determining whether the one or more of the retrieved one or more passwords match the password associated with the user identification when it is determined that the one or more of the retrieved one or more passwords is the plaintext password.

5. The medium of claim 1, wherein the operations comprise:

determining whether the user account associated with the user identification is an active user account; and

determining whether the one or more passwords match the password associated with the user identification when it is determined that the user account associated with the user identification is the active user account.

6. The medium of claim 5, wherein determining whether the user account associated with the user identification is the active user account comprises:

retrieving, from another database, a previous time stamp of access of the user account; and

determining that the user account is the active user account when a time difference between the previous time stamp and a current time is less than a predetermined amount.

7. The medium of claim 1, wherein notifying the user associated with the user account to reset the password comprises:

notifying the user via another user identification associated with the user that is different from the user identification.

8. The medium of claim 1, wherein notifying the user associated with the user account to reset the password comprises:

notifying the user associated with the user account that the user account has been blocked and to reset the password when the user attempts to login using the user identification and the password associated with the user identification.

9. The medium of claim 1, wherein the operations comprise:

receiving, by a monitored computer system, via a network, a differential update from a remote credential-monitoring system of credentials determined to have been compromised since a previous update;

writing the differential update to a compromised credential repository resident on a private network of the monitored computer system;

selecting, by the monitored computer system, from a repository of active credentials of the monitored computer system, a subset of active credentials added to the repository since a previous batch process by which compromised credentials are compared to active credentials; and

determining an intersection of credentials in the compromised credential repository with the subset of active credentials.

10. The medium of claim 9, wherein the operations comprise determining the intersection of credentials concurrently with operations comprising:

replicating the subset of active credentials on each of a plurality of compute nodes of a compute cluster;

storing different subsets of compromised credentials from the compromised credential repository on each of the different compute nodes; and

comparing, with each of the compute nodes, a respective one of different subsets of compromised credentials stored on the respective compute node with each of the subset of active credentials with a content addressable data structure.

11. The medium of claim 1, wherein the operations comprise:

before obtaining the query, determining whether one or more of the retrieved one or more passwords is a non-plaintext password;

cracking the one or more of the retrieved one or more passwords based on a rainbow table when it is determined that the one or more of the retrieved one or more passwords is the non-plaintext password; and

determine whether a result of the password cracking matches the password associated with the user identification.

12. The medium of claim 11, wherein the operations comprise:

blocking access to the user account associated with the user identification and the password when the result of the password cracking matches the password associated with the user identification; and

notifying the user associated with the user account to reset the password when the result of the password cracking matches the password associated with the user identification.

13. The medium of claim 1, wherein the operations comprise:

determining whether the user account is being accessed at a time when it is determined that the one or more passwords matches the password associated with the user identification; and

causing the user account to be automatically logged off after a threshold amount of time when it is determined that the user account is being accessed at the time when it is determined that the one or more passwords matches the password associated with the user identification.

14. The medium of claim 1, wherein the operations comprise:

determining an amount of times the user of the user account has been notified to change passwords associated with the user identification;

determining the user account to be a high-risk user account when the amount of times satisfies a threshold; and

notifying the user associated with the user account that the user account requires a two-factor authentication to be accessed when the user account is determined to be the high-risk user account.

15. The medium of claim 1, wherein the operations comprise:

granting access to the user account when the password has been reset.

16. The medium of claim 1, wherein retrieving, via the application programming interface, from the database, the one or more passwords associated with the one or more user identification entries in the database that matches the user identification comprises:

generating, via the application programming interface, a search query for retrieving data related to the user identification from the database in response to the obtained query;

generating a criterion for the search query, the criterion being generated at least based on whether another query identifying the user identification has been previously obtained; and

retrieving, via the application programming interface, from the database, the one or more passwords associated with the one or more user identification entries in the database that matches the user identification based on the search query and the criterion for the search query.

17. The medium of claim 16, wherein the retrieving the one or more passwords associated with the one or more user identification entries in the database that matches the user identification based on the search query and the criterion for the search query comprises:

retrieving, via the application programming interface, from a subset of the database, the one or more passwords associated with the one or more user identification entries in the subset of the database that matches the user identification when it is determined that the other query identifying the user identification has been previously obtained.

18. The medium of claim 17, wherein:

the subset of the database corresponds to a portion of the database populated with data on or after a date on which the other query identifying the user identification was previously obtained; and

the operations comprise;

determining whether the user account is being accessed at a time when it is determined that the one or more passwords matches the password associated with the user identification; and

causing one or more functionalities of the user account to be disabled when it is determined that the user account is being accessed at the time when it is determined that the one or more passwords matches the password associated with the user identification.

19. The medium of claim 1, wherein the operations comprise:

steps for determining an intersection of data sets; and

steps for performing a differential comparison relative to an earlier comparison.

20. A method that facilitates prevention of account takeover, the method comprising:

obtaining, with one or more processors, a query identifying a user identification;

retrieving, with one or more processors, via an application programming interface, from a database, one or more passwords associated with one or more user identification entries in the database that matches the user identification in response to the obtained query;

determining, with one or more processors, whether the one or more passwords matches a password associated with the user identification;

blocking, with one or more processors, access to a user account associated with the user identification and the password when the one or more passwords matches the password associated with the user identification; and

notifying, with one or more processors, a user associated with the user account to reset the password when the one or more passwords matches the password associated with the user identification.