Detecting user credentials from inputted data

• US 9,619,670 B1
• Filed: 01/09/2015
• Issued: 04/11/2017
• Est. Priority Date: 01/09/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: GitHub Incorporated (Microsoft Corporation)
• Inventors: Marti, Vicent
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US14/594,016
• Time in Patent Office: 823 Days
• Field of Search: 726 4- 7
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management

Abstract

A system for detecting user credentials comprising a data chunker, a data chunk storage, a bytewise checker, a bit counter, and a credential checker. The data chunker is for determining a data chunk. The data chunk storage is for storing the data chunk. The bytewise checker is for checking that each byte of the data chunk comprises an appropriate value. The bit counter is for: determining a continuous number of bytes greater than or equal to the threshold byte value; and in the event the continuous number of bytes is greater than or equal to a threshold number of bytes, determining a credential address range corresponding to the continuous number of bytes. The credential checker is for determining whether data stored in the data chunk storage corresponding to the credential address range comprises a credential.

Claims

1. A method for detecting user credentials, comprising:

determining, using a processor, a data chunk;

storing, in a data chunk storage, the data chunk;

checking that each byte of the data chunk comprises an appropriate value, wherein the appropriate value comprises a value in a range of ASCII values;

determining whether a continuous number of bytes having the appropriate value is greater than or equal to a threshold number of bytes, comprising;

analyzing each byte from a last N data chunks, wherein N corresponds to a positive integer value; and

determining, from the last N data chunks, continuous bytes having the appropriate value;

in the event the continuous number of bytes having the appropriate value is greater than or equal to the threshold number of bytes, determining, from the last N data chunks, a credential address range corresponding to the continuous number of bytes; and

determining whether data stored in the data chunk storage corresponding to the credential address range comprises a credential.

2. A method as in claim 1, wherein determining whether data comprises a credential comprises meet a credential entropy test, comprising:

determining a sequence of potential credential symbols relating to the credential address range;

determining whether an entropy of the sequence of potential credential symbols is equal to or greater than an entropy of regular text; and

in the event that the entropy of the sequence of potential credential symbols is equal to or greater than the entropy of regular text, determining that the data comprises the credential.

3. A method as in claim 1, further comprising receiving data.

4. A method as in claim 3, wherein the data chunk is determined using the received data.

5. A method as in claim 1, further comprising providing data in response to a data address range.

6. A method as in claim 1, wherein the threshold number of bytes comprises a minimum credential length.

7. A method as in claim 1, wherein determining whether data comprises a credential comprises matching a credential pattern.

8. A method as in claim 1, wherein determining whether data comprises a credential comprises matching a credential prefix.

9. A method as in claim 1, wherein determining whether data comprises a credential comprises meet a credential entropy test.

10. A method as in claim 1, wherein the range of ASCII values comprises credential values.

11. A method as in claim 1, wherein the data chunk comprises an M-byte data chunk.

12. A method as in claim 11, wherein the M-byte data chunk comprises one of the following:

a 4 byte chunk, 8 byte chunk, a 16 byte chunk, a 32 byte chunk, a 64 byte chunk, or a 128 byte chunk.

13. A method as in claim 1, wherein a bit is used to indicate a byte having the appropriate value.

14. A method as in claim 13, wherein the continuous number of bytes is represented using a continuous number of bits.

15. A method as in claim 14, wherein determining whether the continuous number of bytes having the appropriate value is greater than or equal to the threshold number of bytes comprises determining the continuous number of bits across the last N chunks.

16. A method as in claim 1, wherein N comprises one of the following:

1 chunk, 2 chunks, 3 chunks, 4 chunks, 5 chunks, 6 chunks, 7 chunks, 8 chunks, 9 chunks, 10 chunks, 11 chunks, 12 chunks, 13 chunks, 14 chunks, 15 chunks, or 16 chunks.

17. A method as in claim 1, wherein in the event that the data comprises a credential, one or more of the following are performed:

the credential is deleted, the credential is replaced, a code is code associated with the credential is stored in a private portion of a repository, and an indication is provided to a user or administrator that the credential has been uploaded.

18. A system for detecting user credentials, comprising:

a processor; and

a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to;

determine a data chunk;

store, in a data chunk storage, the data chunk;

check that each byte of the data chunk comprises an appropriate value, wherein the appropriate value comprises a value in a range of ASCII values;

determine whether a continuous number of bytes having the appropriate value is greater than or equal to a threshold number of bytes, comprising to;

analyze each byte from a last N data chunks, wherein N corresponds to a positive integer value; and

determine, from the last N data chunks, continuous bytes having the appropriate value;

in the event the continuous number of bytes having the appropriate value is greater than or equal to the threshold number of bytes, determine, from the last N data chunks, a credential address range corresponding to the continuous number of bytes; and

determine whether data stored in the data chunk storage corresponding to the credential address range comprises a credential.

19. A computer program product for detecting user credentials, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

determining, using a processor, a data chunk;

storing, in a data chunk storage, the data chunk;

checking that each byte of the data chunk comprises an appropriate value, wherein the appropriate value comprises a value in a range of ASCII values;

determining whether a continuous number of bytes having the appropriate value is greater than or equal to a threshold number of bytes, comprising;

analyzing each byte from a last N data chunks, wherein N corresponds to a positive integer value; and

determining, from the last N data chunks, continuous bytes having the appropriate value;

in the event the continuous number of bytes having the appropriate value is greater than or equal to the threshold number of bytes, determining, from the last N data chunks, a credential address range corresponding to the continuous number of bytes; and

determining whether data stored in the data chunk storage corresponding to the credential address range comprises a credential.