Techniques for presenting password feedback to a computer system user

• US 9,122,867 B2
• Filed: 06/08/2007
• Issued: 09/01/2015
• Est. Priority Date: 06/08/2007
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Keohane, Susann Marie, McBrearty, Gerald Francis, Mullen, Shawn Patrick, Murillo, Jessica Carol, Shieh, Johnny Meng-Han
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): TRUVAN, LEYNNA THANH
• Application Number:
  US11/759,960
• Publication Number:
  US 20080307235A1
• Time in Patent Office: 3,007 Days
• Field of Search: 705/18, 713/166, 713/168, 713183-186, 726/2, 726/4, 726/5, 726/8, 726/19, 726/21, 726/27, 726/28, 726/30
• US Class Current: 1/1
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords

Abstract

A method, system and computer program product for automatically displaying the potential risk associated with cracking a password. While creating or modifying a password, feedback is provided describing the risk associated with cracking the password. Risk assessment may be presented as a percentage, accompanied by an explanation of why the value was ascertained. Risk feedback during password creation provides an opportunity to improve computer, document, and file security.

Claims

1. A method comprising:

displaying a graphical user interface (GUI) for receiving a plain text entry and providing feedback on the plain text entry;

detecting, within a new password field of the GUI, a plain text entry comprising a plurality of characters;

while receiving the plain text entry within the new password field of the GUI;

dynamically determining a level of security risk associated with the plain text entry in the new password field of the GUI based on words utilized within files of respective file systems associated with the computer system and other computer systems within the same group as the computer system;

automatically displaying, within the GUI, feedback of the level of security risk associated with the plain text entry, wherein the feedback includes a calculated risk assessment percentage that represents a future risk of the password being cracked, a security risk assessment rating of one of low, medium, and high that is determined according to the calculated risk assessment percentage of the plain text entry, an explanation of the level of security risk with a risk factor cause including an explanation of how the security risk for cracking the plain text entry was determined, and one or more suggestions for improving the level of security risk associated with the plain text entry; and

in response to detecting any changes in the plain text entry, automatically adjusting the displayed feedback of the level of security risk associated with the plain text entry; and

in response to receiving a selection of a save function within the GUI, saving the plain text entry as a password, wherein the password is one of a new password or a modification to an existing password, wherein the password enables security access to the computer system and the other computer systems within the same group as the computer system.

2. The method of claim 1, further comprising:

calculating a risk potential percentage of a current password for enabling security access to the computer system and the other computer systems within the same group as the computer system;

outputting within the GUI;

the calculated risk potential percentage of the current password;

the feedback of the level of security risk associated with the plain text entry; and

the calculated risk assessment percentage of the plain text entry;

prompting for entry of a different password when the level of security risk associated with the plain text entry falls below a pre-set minimum security threshold;

detecting changes in the plain text entry; and

automatically adjusting the calculated risk assessment percentage while the plain text entry is being changed.

3. The method of claim 1, wherein said dynamically determining further comprises:

evaluating an arrangement and placement of characters within the plain text entry;

comparing the plain text entry with one or more pre-established standard password specifications, which include one or more of;

a minimum length of the plain text entry, required numerical and alphabetical content of the plain text entry, non-usage of identical characters within the plain text entry, and usage and non-usage of specific symbols within the plain text entry; and

prompting for modification of the plain text entry when the plain text entry does not satisfy the standard password specifications.

4. The method of claim 1, wherein said dynamically determining further comprises:

accessing a database of domestic and foreign dictionary words;

assessing the level of security risk associated with the plain text entry by comparing the plain text entry to domestic and foreign words within the database; and

evaluating a match of the plain text entry within the database as indicative of a lower security level.

5. The method of claim 1, wherein said dynamically determining further comprises:

accessing a database of saved common character combinations from emails, files, and documents within the computer system, wherein the contents of the database are refreshed after a specified time period;

assessing the level of security risk associated with the plain text entry by comparing the plain text entry to the character combinations in the emails, files, and documents within the computer system; and

evaluating a match of the plain text entry with a character combination in the emails, files, and documents as indicative of a lower security level.

6. The method of claim 1, wherein said dynamically determining further comprises:

assessing the security risk associated with the plain text entry by comparing a use of symbol and number substitution in the plain text entry with pre-established and approved symbol and number substitutions and random configurations of symbols and numbers.

7. The method of claim 1, wherein said dynamically determining further comprises:

receiving a request to change a current password;

opening a second GUI for modifying the current password;

receiving, within the second GUI, an input of the current password to be changed and a new plain text entry; and

outputting a security risk assessment for both the current password and the new plain text entry.

8. The method of claim 1, wherein dynamically determining a level of security risk associated with the plain text entry further comprises:

evaluating placement of at least one letter within the plain text entry;

assessing the utilization of at least one symbol and at least one number within the plain text entry;

evaluating the at least one symbol and the at least one number against a plurality of symbol and number substitutions; and

evaluating the at least one symbol and the at least one number against a plurality of random character configurations.

9. The method of claim 1, wherein the plain text entry is entered into the new password field by a user.

10. A computer program product comprising:

a computer readable storage device; and

program code stored on the computer readable storage device that, when executed by a processor, configures the processor to;

display a graphical user interface (GUI) for receiving a plain text entry and providing feedback on the plain text entry;

receive, in a new password field of the GUI of a computer system, a plain text entry;

prior to saving the plain text entry as a new password;

dynamically determine a level of security risk associated with the plain text entry in the new password field of the GUI based on words utilized within files of respective file systems associated with the computer system and other computer systems within the same group as the computer system;

automatically display, within the GUI, feedback of the level of security risk associated with the plain text entry, wherein the feedback includes a calculated risk assessment percentage that represents a future risk of the password being cracked, a security risk assessment rating of one of low, medium, and high that is determined according to the calculated risk assessment percentage of the plain text entry, an explanation of the level of security risk with a risk factor cause including an explanation of how the security risk for cracking the plain text entry was determined, and one or more suggestions for improving the level of security risk associated with the plain text entry; and

in response to detecting any changes in the plain text entry, automatically adjust the displayed feedback of the level of security risk associated with the plain text entry;

in response to receiving a selection of a save function within the GUI, save the plain text entry as a password, wherein the password is one of a new password or a modification to an existing password, wherein the password enables security access to the computer system and the other computer systems within the same group as the computer system.

11. The computer program product of claim 10, wherein the code, when executed by the processor, further configures the processor to:

calculate a risk potential percentage of a current password for enabling security access to the computer system and the other computer systems within the same group as the computer system;

output, within the GUI;

the calculated risk potential percentage of the current password;

the feedback of the level of security risk associated with the plain text entry; and

the calculated risk assessment percentage of the plain text entry;

prompt for entry of a different password when the level of security risk of the plain text entry falls below a pre-set minimum security threshold;

detect changes in the password plain text entry; and

automatically adjust the calculated risk assessment percentage while the plain text entry is being changed.

12. The computer program product of claim 10, wherein the code, when executed by the processor, further configures the processor to:

access a database of domestic and foreign dictionary words;

access the level of security risk associated with the plain text entry by comparing the plain text entry to domestic and foreign words within the database; and

evaluate a match of the plain text entry within the database as indicative of a lower security level.

13. The computer program product of claim 10, wherein the code, when executed by the processor, further configures the processor to:

access a database of saved common character combinations from emails, files, and documents within the computer system, wherein the contents of the database are refreshed after a specified time period;

access the level of security risk associated with the plain text entry by comparing the plain text entry to the character combinations in the emails, files, and documents within the computer system; and

evaluate a match of the plain text entry with a character combination in the emails, files, and documents as indicative of a lower security level.

14. The computer program product of claim 10, wherein the code, when executed by the processor, further configures the processor to:

receive a request to change a current password;

open a second GUI for modifying the current password;

receive, within the second GUI, an input of the current password to be changed and a new plain text entry; and

output a security risk assessment for both the current password and the new plain text entry.

15. The computer program product of claim 10, wherein the code, when executed by the processor, further configures the processor to:

evaluate placement of at least one letter within the plain text entry;

assess the utilization of at least one symbol and at least one number within the plain text entry;

evaluate the at least one symbol and the at least one number against a plurality of symbol and number substitutions; and

evaluate the at least one symbol and the at least one number against a plurality of random character configurations;

wherein the plain text entry is entered into the new password field by a user.

16. An electronic device comprising:

a processor component;

an input/output (I/O) mechanism that enables entry of a password into the electronic device;

a mechanism for outputting a security risk associated with the password; and

a utility executing on the processor component and which comprises code that enables the processor component to;

display a graphical user interface (GUI) for receiving a plain text entry and providing feedback on the plain text entry;

receive, in a new password field of the GUI of an electronic device, a plain text entry;

prior to saving the plain text entry as a new password;

dynamically determine a level of security risk associated with the plain text entry in the new password field of the GUI based on words utilized within files of respective file systems associated with the electronic device and other electronic devices within the same group as the electronic device; and

automatically display, within the GUI, feedback of the level of security risk associated with the plain text entry, wherein the feedback includes a calculated risk assessment percentage that represents a future risk of the password being cracked, a security risk assessment rating of one of low, medium, and high that is determined according to the calculated risk assessment percentage of the plain text entry, an explanation of the level of security risk with a risk factor cause including an explanation of how the security risk for cracking the plain text entry was determined, and one or more suggestions for improving the level of security risk associated with the plain text entry; and

in response to detecting any changes in the plain text entry, automatically adjust the displayed feedback of the level of security risk associated with the plain text entry; and

in response to receiving a selection of a save function within the GUI, save the plain text entry as a password, wherein the password is one of a new password, wherein the password enables security access to the electronic device and the other electronic devices within the same group as the electronic device.

17. The electronic device of claim 16, wherein said utility further comprises code that enables the processor component to:

calculate a risk potential percentage of a current password for enabling security access to the computer system and the other electronic devices within the same group as the electronic device;

output, within the GUI;

the calculated risk potential percentage of the current password;

the feedback of the level of security risk associated with the plain text entry; and

the calculated risk assessment percentage of the plain text entry;

prompt for entry of a different password when the level of security risk associated with the plain text entry falls below a pre-set minimum security threshold;

detect changes in the password plain text entry; and

automatically adjust the calculated risk assessment percentage while the plain text entry is being changed.

18. The electronic device of claim 16, said code for dynamically determining further comprises program code that enables the processor component to:

access a database of domestic and foreign dictionary words, assess the level of security risk associated with the plain text entry by comparing the plain text entry to domestic and foreign words within the database, and evaluate a match of the plain text entry within the database as indicative of a lower security level;

access a database of saved common character combinations from emails, files, and documents within the electronic device, wherein the contents of the database are refreshed after a specified time period, assess the level of security risk associated with the plain text entry by comparing the plain text entry to the character combinations in the emails, files, and documents within the electronic device, and evaluate a match of the plain text entry with a character combination in the emails, files, and documents as indicative of a lower security level; and

assess the security risk associated with the plain text entry by comparing a use of symbol and number substitution in the plain text entry with pre-established and approved symbol and number substitutions and random configurations of symbols and numbers.

19. The electronic device of claim 16, wherein said program code for determining further comprises code that enables the processor component to:

receive a request to change a current password;

open a second GUI for modifying the current password;

receive, within the second GUI, an input of the current password to be changed and a new plain text entry; and

output a security risk assessment for both the current password and the new password entry.

20. The electronic device of claim 16, said code for dynamically determining further comprises program code that enables the processor component to:

evaluate placement of at least one letter within the plain text entry;

assess the utilization of at least one symbol and at least one number within the plain text entry;

evaluate the at least one symbol and the at least one number against a plurality of symbol and number substitutions; and

evaluate the at least one symbol and the at least one number against a plurality of random character configurations;

wherein the plain text entry is entered into the new password field by a user.