Calculating a password strength score based upon character proximity and relative position upon an input device

• US 8,108,932 B2
• Filed: 06/12/2008
• Issued: 01/31/2012
• Est. Priority Date: 06/12/2008
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Himberger, Kevin D., Parees, Benjamin M.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): SHAIFER HARRIMAN, DANT B
• Application Number:
  US12/137,645
• Publication Number:
  US 20090313696A1
• Time in Patent Office: 1,328 Days
• Field of Search: 726/25, 713/183, 713/184
• US Class Current: 726/25
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords

Abstract

A solution for computing password strength based upon layout positions of input mechanisms of an input device that entered a password. A password including an ordered sequence of at least two characters can be identified. A position of each of the characters of the sequence can be determined relative to a layout of an input device used for password entry. Each position can correspond to an input region (key) of the input device (keyboard). A proximity algorithm can generate a proximately score for the determined positions based upon a pattern produced by the positions given the layout of the input device. A password strength score can be computed based at least in part upon the proximity score.

Claims

1. A method for computing password strength comprising:

a computing device, which comprises hardware executing software, identifying a password consisting of a sequence of at least two characters;

the computing device determining a position of each of the characters of the sequence relative to a layout of an input device used for password entry, wherein each position corresponds to an input region of the input device;

the computing device applying a proximity algorithm configured to generate a proximity score for the determined positions based upon a pattern produced by the positions given the layout of the input device, wherein the applying step further comprises;

computing a distance between each consecutive pair of positions corresponding to the at least two characters processed in an order of the sequence;

computing an average distance based upon the distances between each consecutive pair;

calculating the proximity score based upon the computed average distance; and

the computing device computing a password strength score based at least in part upon the proximity score.

2. The method of claim 1, wherein the input device is a keyboard, wherein each of the input region is a key on the keyboard.

3. The method of claim 1, further comprising:

the computing device taking a programmatic action relating to the password when the password strength exceeds a previously established threshold value; and

the computing device taking a different programmatic action relating to the password when the password strength does not exceed the previously established threshold value.

4. The method of claim 3, wherein the programmatic action taken when the password strength exceeds the threshold is accepting the password, and wherein the different programmatic action taken when the password strength does not exceed the threshold is denying the password.

5. The method of claim 1, further comprising:

the computing device prompting a user to enter a new password, wherein the identified password is one received in response to the prompting;

the computing device comparing the password strength score to a previously determined threshold;

the computing device, based upon the comparison, determining that too strong of a pattern exists for the password to be a strong password; and

the computing device presenting a notification to the user that the password is weak based upon an existence of the pattern formed by the sequence relative to the layout.

6. The method of claim 1, wherein the proximity algorithm generates a greater proximity score for patterns easily discernable by an observer in viewable range of the input region of the input device due to consecutive characters in the sequence of the password being proximately positioned on the input device than a score generated for patterns less easily discernable by the observers.

7. The method of claim 1, wherein the applying of the proximity algorithm comprises:

the computing device computing a center point of the determined positions for the layout;

the computing device computing a distance of each of the determined positions from this center point; and

the computing device calculating the proximity score based upon the distances of each of the determined positions and the center point.

8. The method of claim 1, wherein the applying of the proximity algorithm comprises:

the computing device computing a number of line segments needed to pass through the positions to create the sequence; and

the computing device calculating the proximity score based upon the number of computed line segments.

9. The method of claim 1, further comprising:

the computing device biasing the proximity algorithm to disfavor a subset of common positions given the layout relative to other positions, where the disfavoring applies to a position corresponding to at least one of the first character in the sequence and the last character in the sequence, wherein the biasing results in a weaker than baseline proximity score when at least one of a first and a last character in the sequence corresponds to one of the common positions.

10. A storage device comprising:

a non-transitory computer usable storage medium having computer usable program code embodied therewith, said computer usable program code being configured for execution by a processor of a computing device, the computer usable program code comprising;

computer usable program code configured to identify a password consisting of a sequence of at least two characters;

computer usable program code configured to determine a position of each of the characters of the sequence relative to a layout of an input device used for password entry, wherein each position corresponds to an input region of the input device;

computer usable program code configured to apply a proximity algorithm configured to generate a proximity score for the determined positions based upon a pattern produced by the positions given the layout of the input device, wherein the proximity algorithm generates a greater proximity score for patterns easily discernable by an observer in viewable range of the input region of the input device due to consecutive characters in the sequence of the password being proximately positioned on the input device than a score generated for patterns less easily discernable by the observer; and

computer usable program code configured to compute a password strength score based at least in part upon the proximity score.

11. The storage device of claim 10, wherein the input device is a keyboard, wherein each of the input region is a key on the keyboard.

12. The storage device of claim 10, further comprising:

computer usable program code configured to take a programmatic action relating to the password when the password strength exceeds a previously established threshold value; and

computer usable program code configured to take a different programmatic action relating to the password when the password strength does not exceed the previously established threshold value.

13. The storage device of claim 12, wherein the programmatic action taken when the password strength exceeds the threshold is accepting the password, and wherein the different programmatic action taken when the password strength does not exceed the threshold is denying the password.

14. The storage device of claim 10, further comprising:

computer usable program code configured to prompt a user to enter a new password, wherein the identified password is one received in response to the prompting;

computer usable program code configured to compare the password strength score to a previously determined threshold;

computer usable program code configured to determine that too strong of a pattern exists for the password to be a strong password based upon the comparison; and

computer usable program code configured to present a notification to the user that the password is weak based upon an existence of the pattern formed by the sequence relative to the layout.

15. The storage device of claim 10, wherein the applying of the proximity algorithm comprises:

computer usable program code configured to compute a center point of the determined positions for the layout;

computer usable program code configured to compute a distance of each of the determined positions from this center point; and

computer usable program code configured to calculate the proximity score based upon the distances of each of the determined positions and the center point.

16. The storage device of claim 10, wherein the programmatic code configured to apply the proximity algorithm comprises:

computer usable program code configured to compute a number of line segments needed to pass through the positions to create the sequence; and

computer usable program code configured to calculate the proximity score based upon the number of computed line segments.

17. The storage device of claim 10, wherein the applying of the proximity algorithm comprises:

computer usable program code configured to compute an average distance between each consecutive pair of positions corresponding to the characters processed in an order of the sequence;

computer usable program code configured to compute an average distance based upon the distances between each consecutive pair; and

computer usable program code configured to calculate the proximity score based upon the computed average distance.

18. The storage device of claim 10, further comprising:

computer usable program code configured to bias the proximity algorithm to disfavor a subset of common positions given the layout relative to other positions, where the disfavoring applies to a position corresponding to at least one of the first character in the sequence and the last character in the sequence, wherein the biasing results in a weaker than baseline proximity score when at least one of a first and a last character in the sequence corresponds to one of the common positions.

19. A computer system for computing password strength, the computer system comprising:

one or more processors, one or more computer-readable memories, and one or more computer-readable tangible storage devices;

program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, to

prompt a user to enter a new password;

responsive to the prompting, receive the new password consisting of a sequence of at least two characters;

determine a position of each of the characters of the sequence relative to a layout of an input device used for password entry, wherein each position corresponds to an input region of the input device;

apply a proximity algorithm configured to generate a proximity score for the determined positions based upon a pattern produced by the positions given the layout of the input device;

compute a password strength score based at least in part upon the proximity score;

compare the password strength score to a previously determined threshold;

based upon the comparison, determine that too strong of a pattern exists for the password to be a strong password; and

present a notification to the user that the password is weak based upon an existence of the pattern formed by the sequence relative to the layout.

20. The computer system of claim 19, wherein said program instructions are further to:

bias the proximity algorithm to disfavor a subset of common positions given the layout relative to other positions, where the disfavoring applies to a position corresponding to at least one of the first character in the sequence and the last character in the sequence, wherein the biasing results in a weaker than baseline proximity score when at least one of a first and a last character in the sequence corresponds to one of the common positions.