Password popularity-based limiting of online account creation requests

• US 8,601,548 B1
• Filed: 12/28/2009
• Issued: 12/03/2013
• Est. Priority Date: 12/29/2008
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Shen, Honghai
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): JACKSON, JENISE E
• Application Number:
  US12/648,258
• Time in Patent Office: 1,436 Days
• Field of Search: 726/4, 726/26
• US Class Current: 726/4
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself

Abstract

Upon receiving an account creation request from a client, the server determines a count of new account requests, each having a respective password, received during a predefined time period, that satisfy a requirement that the respective password is a function of the password in the received account creation request, and determines a popularity value associated with the password. The server associates a spam score, based at least in part on the count and the popularity value, with the account creation request, and compares the spam score with certain predefined thresholds. If the spam score is above a first threshold, the server may refuse the account creation request. If the spam score is within a certain range, the server may limit the access to the account associated with the account creation request. If the spam score is below a second threshold, the server may enable normal use of the account.

Claims

1. A computer implemented method, comprising:

at a server having one or more processors and memory storing one or more programs executed by the one or more processors;

receiving an account creation request including a password;

determining a count of new account requests, each having a respective password, received during a predefined time period, that satisfy a requirement that the respective password is a function of the password in the received account creation request;

determining a popularity value associated with the password;

associating a score, based at least in part on the count and the popularity value, with the account creation request; and

performing an action associated with the account creation request based at least in part on the score, wherein the action includes at least one of refusing the account creation request, modifying an account created in response to the account creation request, accepting the account creation request, and maintaining the account created in response to the account creation request.

2. The computer implemented method of claim 1, wherein the function is the identity function of the password in the received account creation request.

3. The computer implemented method of claim 1, wherein the function is used to determine whether the respective password and the password in the received account creation request satisfy predefined similarity criteria.

4. The computer implemented method of claim 1, wherein the predefined time period has a duration that is in the range of one day to one month.

5. The computer implemented method of claim 1, wherein modifying the account created in response to the account creation request comprises disabling the account or limiting account access.

6. The computer implemented method of claim 5, wherein limiting account access includes at least one of requiring a response to a human interaction proof for access to the account, limiting access time to the account, limiting use of account functions, and limiting transmission from the account.

7. The computer implemented method of claim 1, wherein if the score meets predetermined criteria, the action associated with the account creation request comprises disabling the account.

8. The computer implemented method of claim 1, wherein the count is an average, over the predefined time period, of new account requests having similar passwords received during a plurality of successive time intervals;

wherein the predefined time period is longer than each of the time intervals.

9. The computer implemented method of claim 1, wherein the popularity value is a function of a number of times the password has been used to attempt unauthorized access to respective accounts.

10. The computer implemented method of claim 1, wherein the popularity value is equal to a default value unless a number of times the password has been used to attempt unauthorized access is greater than a threshold value.

11. The computer implemented method of claim 1, wherein the popularity value is a function of a number of user accounts having the password.

12. The computer implemented method of claim 11, wherein the popularity value is equal to a default value unless of the number of user accounts having the password is greater than a threshold value.

13. The computer implemented method of claim 11, wherein the popularity value is also a function of a number of times the password has been used to attempt unauthorized access to respective accounts.

14. The computer implemented method of claim 1, wherein the score is inversely proportional to the popularity value.

15. A computer system, comprising:

one or more processors;

memory; and

one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including;

instructions for receiving an account creation request including a respective password;

instructions for determining a count of new account requests, each having a respective password, received during a predefined time period, that satisfy a requirement that the respective password is a function of the password in the received account creation request;

instructions for determining a popularity value associated with the password;

instructions for associating a score, based at least in part on the count and the popularity value, with the account creation request; and

instructions for performing an action associated with the account creation request based at least in part on the score, wherein the action includes at least one of refusing the account creation request, modifying an account created in response to the account creation request, accepting the account creation request, and maintaining the account created in response to the account creation request.

16. A non-transitory computer readable storage medium and one or more computer programs embedded therein, the one or more computer programs comprising instructions, which when executed by a computer system, cause the computer system to:

receive an account creation request including a respective password;

determine a count of new account requests, each having a respective password, received during a predefined time period, that satisfy a requirement that the respective password is a function of the password in the received account creation request;

determine a popularity value associated with the password;

associate a score, based at least in part on the count and the popularity value, with the account creation request; and

perform an action associated with the account creation request based at least in part on the score, wherein the action includes at least one of refusing the account creation request, modifying an account created in response to the account creation request, accepting the account creation request, and maintaining the account created in response to the account creation request.

17. The non-transitory computer readable storage medium of claim 16, wherein the function is the identity function of the password in the received account creation request.

18. The non-transitory computer readable storage medium of claim 16, wherein the function is used to determine whether the respective password and the password in the received account creation request satisfy predefined similarity criteria.

19. The non-transitory computer readable storage medium of claim 16, wherein the predefined time period has a duration that is in the range of one day to one month.

20. The non-transitory computer readable storage medium of claim 16, wherein modifying the account created in response to the received account creation request comprises disabling the account or limiting account access.