Systems and methods for evaluating a password policy

• US 8,769,607 B1
• Filed: 01/26/2011
• Issued: 07/01/2014
• Est. Priority Date: 01/26/2011
• Status: Active Grant

• Current Assignee: Intuit, Inc.
• Original Assignee: Intuit, Inc.
• Inventors: Chung, Christopher C., Jerdonek, Robert A.
• Primary Examiner(s): Gee, Jason K.
• Assistant Examiner(s): SARKER, SANCHIT K
• Application Number:
  US13/014,406
• Time in Patent Office: 1,252 Days
• Field of Search: 726/1, 726/2, 726/3, 726/4, 726/6
• US Class Current: 726/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

Systems, methods and articles of manufacture for evaluating a password policy are disclosed. The password evaluation system receives password policy data regarding a password policy, including a password constraint. The system analyzes the password policy data to determine a usability index and a password strength index for the password policy, and also determines a usability index and password strength index for a plurality of modified password policies having password constraints different from the password policy. The system then provides a graphical representation of the usability index and the password strength for the password policy and the modified password policies, thereby allowing a password designer to optimize the tradeoffs between usability and security of a password policy.

Claims

1. A method for evaluating a password policy, comprising:

receiving at an evaluation system, from a user, password policy data regarding a password policy, including a password constraint;

analyzing, by the evaluation system, said password policy data to determine a usability index and a password strength index for said password policy;

determining, by the evaluation system, a usability index and a password strength index for a plurality of modified password policies having password constraints different from said password policy;

creating, by the evaluation system, a curve of the usability against the password strength index for said password policy and said modified password policies;

determining, by the evaluation system, one or more inflection points in said curve where a change in the password strength index has an increased effect on the usability index; and

providing to the user, a graphical representation of the usability index and the password strength for said password policy and said modified password policies, and providing to the user a recommended password policy constraint based on the one or more inflection points.

2. The method of claim 1, wherein said password constraint includes a minimum number of characters in a password.

3. The method of claim 1, wherein said password constraint includes a number of character classes in a password.

4. The method of claim 1, wherein said step of analyzing at the evaluation system, said password policy to determine a usability index and a password strength index for the password policy, includes analyzing the password policy against a database of usability studies.

5. The method of claim 4, wherein said database of usability studies includes empirical data from usability studies measuring password usability.

6. The method of claim 4, wherein said database of usability studies includes empirical data from usability studies measuring password usability, and theoretical data measuring password usability.

7. The method of claim 1, wherein said graphical representation includes a best fit curve charting the usability index versus the password strength index for said password policy and said modified password policies.

8. The method of claim 1, further comprising the step of:

determining a usability threshold for a minimum usability index based on an intended use for the password policy.

9. The method of claim 8, wherein the step of determining a usability threshold comprises receiving usability data from the user.

10. The method of claim 9, wherein said usability data comprises information regarding the intended use for the password policy.

11. The method of claim 10, wherein said information comprises information regarding a type of industry for the password, a type of user for the password, and a number of password users under the password policy.

12. A method for evaluating a password policy, comprising:

receiving at an evaluation system, from a user, password policy data regarding a password policy, including a password constraint;

analyzing, by the evaluation system, said password policy data to determine a usability index and a password strength index for said password policy;

determining, by the evaluation system, a usability index and a password strength index for a plurality of modified password policies having password constraints different from said password policy;

creating, by the evaluation system, a curve of the usability index against the password strength index for said password policy and said modified password policies;

determining, by the evaluation system, one or more inflection points in said curve where a change in the password strength index has an increased effect on the usability index; and

providing a recommended password policy constraint to the user based on the step of determining an inflection point.

13. The method of claim 12, wherein said password policy constraint comprises a number of characters for a password.

14. The method of claim 12, wherein said password policy constraint comprises a number of character classes for a password.

15. The method of claim 12, wherein said step of analyzing, by the evaluation system, said password policy data includes analyzing the password policy against a database of usability studies.

16. A system for evaluating a password policy, comprising:

at least one computer, said computer configured to perform the following steps;

receiving password policy data regarding a password policy, including a password constraint;

analyzing said password policy data to determine a usability index and a password strength index for said password policy;

determining a usability index and a password strength index for a plurality of modified password policies having password constraints different from said password policy;

creating a curve of the usability index against the password strength index for said password policy and said modified password policies;

determining one or more inflection points in said curve where a change in the password strength index has an increased effect on the usability index;

providing a graphical representation of the usability index and the password strength for said password policy and said modified password policies; and

providing a recommended password policy constraint based on the one or more inflection points.

17. An article of manufacture comprising a non-transitory computer program carrier readable by a computer and embodying instructions executable by the computer to program a computer to perform the following steps for evaluating a password policy:

receiving password policy data regarding a password policy, including a password constraint;

analyzing said password policy data to determine a usability index and a password strength index for said password policy;

determining a usability index and password strength index for a plurality of modified password policies having password constraints different from said password policy;

creating a curve of the usability index against the password strength index for said password policy and said modified password policies;

determining one or more inflection points in said curse where a change in the password strength index has an increased effect on the usability index;

providing a graphical representation of the usability index and the password strength for said password policy and said modified password policies; and

providing a recommended password policy constraint based on the one or more inflection points.