Techniques for real-time adaptive password policies

• US 8,332,918 B2
• Filed: 12/06/2007
• Issued: 12/11/2012
• Est. Priority Date: 12/06/2007
• Status: Expired due to Fees

• Current Assignee: RPX Corporation
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Henderson, Larry Hal, Morris, Cameron Craig, Vedula, Srinivas
• Primary Examiner(s): Colin, Carl
• Assistant Examiner(s): LESNIEWSKI, VICTOR D
• Application Number:
  US11/951,524
• Publication Number:
  US 20090150677A1
• Time in Patent Office: 1,832 Days
• Field of Search: 713/182, 713/183, 713/184, 726/1, 726/5, 726/6, 726/7, 726/18, 726/19, 726/21
• US Class Current: 726/6
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

Techniques real-time adaptive password policies are presented. Patterns for passwords are regularly analyzed along with other factors associated with the patterns to dynamically determine password strength values. The strength values can change over time based on usage statistics. When a strength value falls below an acceptable threshold, passwords associated with that particular pattern can be downgraded or rejected in real-time and existing policy can be adapted to reflect the undesirability of that pattern.

Claims

1. A machine-implemented method residing and implemented in a non-transitory machine-readable medium for executing on a machine, comprising:

integrating, by the machine, processing of the method as a supplemental service to an enterprise authentication service that is just invoked by the authentication service when newly presented passwords are being established by the authentication service;

enforcing, by the machine, a first password policy against users of a network service;

dynamically evaluating, by the machine, password patterns being used by the users; and

adapting, by the machine, in real-time to a second password policy in response to evaluation of the password patterns and enforcing the second password policy in place of the first password policy against the users, the first password policy is dynamically altered to adapt to the second password policy and the second password policy evolves based on changing patterns for used passwords, the used passwords stored as regular expressions that define the password patterns without retaining the used passwords, and the first password policy counts a total number of decorations or modifications made to each base pattern identified in the regular expressions and when a predefined threshold of iterative modifications on that base pattern is detected, the second password policy is dynamically enforced without administrative intervention or analysis.

2. The method of claim 1, wherein dynamically evaluating further includes detecting a particular base pattern being modified by a variety of the users, wherein the total number of decorations or modifications to the particular base pattern exceeds the predefined threshold.

3. The method of claim 2, wherein adapting further includes identifying that the first password policy permits the particular base pattern and modifying the first password policy to deny subsequent usage of the particular base pattern by the users for subsequent passwords and making the second password policy the modified first password policy that excludes usage of the particular base pattern.

4. The method of claim 1, wherein dynamically evaluating further includes dynamically mining a password database to identify regular expressions in use within the password database for passwords.

5. The method of claim 4, wherein dynamically mining further includes categorizing the regular expressions into groupings, each group associated with a particular user, a particular grouping of users, or the users as a whole.

6. The method of claim 5 further comprising:

assigning, by the machine, frequency numbers to each grouping for each regular expression; and

adjusting, by the machine, a strength attribute for each password associated with each regular expression in response to that regular expression'"'"'s associated frequency number.

7. The method of claim 6 further comprising:

migrating, by the machine, to the second password policy in response to a threshold strength value when compared to the strength attributes for the regular expressions;

denying, by the machine, a new password received as a modification password from one of the users or received from a new user when the new password is associated with a particular strength attribute that falls below the threshold strength value.

8. A machine-implemented method residing and implemented in a non-transitory machine-readable medium for executing on a machine, comprising:

integrating, by the machine, processing of the method as a supplemental service to an enterprise authentication service that is just invoked by the authentication service when newly presented passwords are being established by the authentication service;

prompting, by the machine, a user to change an existing password;

receiving, by the machine, a new password from the user;

analyzing, by the machine, past password patterns used by the user in view of a new pattern associated with the new password by at least detecting a total number of modifications made to each unique previous pattern and detecting when a predefined threshold of iterative modifications is reached, the past password patterns and the previous patterns retained as regular expressions and the existing password not retained;

dynamically adjusting, by the machine, password strength attributes for the past password patterns and the new pattern in response to a frequency of use for each past password pattern and the new pattern in view of the predefined threshold and without administrative intervention or analysis; and

determining, by the machine, in real time whether the new password is to be accepted or denied in response to comparing the strength attribute associated with the new pattern against a threshold strength value.

9. The method of claim 8, wherein analyzing further includes, analyzing other password patterns used by a group of users to which the user is assigned and including the other password patterns when adjusting the password strength attributes.

10. The method of claim 8 further comprising, dynamically, by the machine, and in real time modifying an existing password policy to exclude the new pattern when the new pattern is denied.

11. The method of claim 8, wherein dynamically adjusting further includes resolving the new password'"'"'s strength attribute in response to:

a quality value for the new pattern as determined by characteristics of the new pattern defined in a quality policy;

usage of the past password patterns by the user;

group password pattern statistics that accounts for a number of users currently using the new pattern for the new password; and

attributes of the new password including a length of the new password, variation in characters used in the new password, and variation in casing for the characters.

12. The method of claim 8, wherein determining further includes, accepting the new pattern but advising the user that the strength attribute is close to being unacceptable when compared to the threshold strength value, wherein what is close is determined using another threshold representing a range of values for the difference between the strength attribute and the threshold strength value.

13. The method of claim 8, wherein determining further includes, denying the new pattern and suggesting a particular password pattern to the user that is identified as having a particular strength value that is greater than the threshold strength value.

14. The method of claim 8, wherein dynamically adjusting further includes downgrading the strength attribute associated with the new pattern when the new pattern represents a particular pattern that the user has repeated and used before, and wherein policy dictates whether the downgrading forces the strength attribute for the new pattern to fall below the threshold strength value or whether the strength attribute for the new pattern remains above the threshold strength value.

15. A system comprising:

a processing device configured for accessing a password pattern store residing in a non-transitory machine-accessible and computer-readable medium and accessible to a password service that executes on the processing device;

the processing device further configured with the password service implemented in a non-transitory machine-accessible and computer-readable medium and the password service executes on the processing device;

wherein the password service stores password patterns as regular expressions received from users in the password pattern store without storing particular passwords and the password service mines the password patterns to dynamically alter password strength attribute values associated with each particular password pattern, and wherein the password service dynamically and in real time alters, evolves, and adapts a password policy in response to changing password strength attribute values for the password patterns being used without administrative intervention or analysis based on counting a total number of modifications made to each base pattern identified in the regular expressions and detecting when a predefined threshold of iterative modifications on that base pattern is reached;

the password service integrated as a supplemental service to an enterprise authentication service that is just invoked by the authentication service when newly presented passwords are being established by the authentication service.

16. The system of claim 15, wherein each entry within the password pattern store includes a particular pattern, particular user identifications for users that are currently or have used the particular pattern, a particular group identification associated with a grouping of users that are currently or have used the particular pattern, a frequency of use number identifying a total number of active users or active groups that are using the particular pattern, and a particular strength attribute value that is dynamically altered and changed as conditions change within the password pattern store, wherein the password service makes the dynamic alternations or changes to the particular strength attribute value.

17. The system of claim 15, wherein the password service mines the password pattern store to acquire a personal password history for a particular user that identifies each pattern for each password that the particular user has used.

18. The system of claim 17, wherein the password service resolves a particular password strength attribute for the particular user in response to the personal password history and a new proposed password offered by the particular user.

19. The system of claim 15, wherein the password service resolves a particular password strength attribute for a particular user in response to a group password history mined from the password pattern store in response to a new proposed password offered by the particular user, wherein the particular user is associated with a group to which the group password history belongs to.

20. The system of claim 15, wherein the password service actively advises the users when the password strength attribute values are unacceptable by providing acceptable password patterns for the users to conform their passwords to.

21. A system, comprising:

a processing device configured with a password management service implemented in a non-transitory machine-accessible and computer-readable medium and the password management service executes on the processing device; and

the processing device or a different processing device from the processing device further configured with an adaptive password policy service implemented in a non-transitory machine-accessible and computer-readable medium and the adaptive password policy service executes on the processing device or the different processing device;

wherein the password management service interacts with a user to receive a new password from the user when the user is newly registered or when the user is changing from an existing password to the new password, and wherein the password management service interacts with the adaptive password policy service to receive an indication as to whether the new password is permissible, and wherein the adaptive password policy service dynamically alters an existing policy in response to mining a history of passwords for the user and the new password and informs the password management service to reject the new password in response to the dynamically altered and modified existing policy and the dynamically altered and modified existing policy is evolved by the adaptive password policy based on changing patterns for used passwords without administrative intervention or analysis by counting a total number of modifications made to each base pattern identified in the history of passwords that are stored as regular expressions and by detecting when a predefined threshold of iterative modifications on that base pattern is reached, history passwords in the history of passwords are not retained, rather, the regular expressions are retained in the history of passwords, and wherein the adaptive password management service is integrated as a supplemental service to an enterprise authentication service that is just invoked by the authentication service when newly presented passwords are being established by the authentication service.

22. The system of claim 21, wherein the adaptive password policy service derives a pattern for the new password and compares that pattern against unique patterns associated with the history of passwords to assign a strength value to the new password.

23. The system of claim 22, wherein the adaptive password policy service determines to reject the new password when the strength value falls below a threshold value.

24. The system of claim 23, wherein the adaptive password policy service alters other strength values for the history of passwords in response to the pattern for the new password.