METHODS AND DEVICES FOR DETECTING UNAUTHORIZED ACCESS TO CREDENTIALS OF A CREDENTIAL STORE

• US 20140337937A1
• Filed: 05/10/2013
• Published: 11/13/2014
• Est. Priority Date: 05/10/2013
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Truskovsky, Alexander, Bender, Christopher Lyle, Martin, Daryl Joseph
• Granted Patent: US 9,088,556 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Methods and devices for detecting unauthorized access to credentials of a credential store on a computing device are disclosed herein. In one broad aspect, the method comprises monitoring a plurality of credentials of the credential store accessed within a period associated with a first setting, and responsive to determining that a number of credentials accessed within the period exceeds a threshold associated with a second setting, outputting, in a user interface, an indication of potential unauthorized access to the credential store. In at least one embodiment, each of the credentials accessed within the period is associated with a different user account.

Claims

1. A method of detecting unauthorized access to credentials of a credential store on a computing device, the method comprising:

monitoring a plurality of credentials of the credential store accessed within a period associated with a first setting; and

responsive to determining that a number of credentials accessed within the period exceeds a threshold associated with a second setting, outputting, in a user interface, an indication of potential unauthorized access to the credential store.

2. The method of claim 1, wherein each of the credentials accessed within the period is associated with a different user account.

3. The method of claim 1, further comprising restricting access to one or more credentials of the credential store in response to determining that the number of credentials accessed within the period exceeds the threshold associated with the second setting.

4. The method of claim 1, wherein at least one of the credentials accessed within the period comprises a password.

5. The method of claim 1, wherein at least one of the credentials accessed within the period comprises at least one of:

a digital certificate, a cryptographic key, a username, an access code, or a secure data item.

6. The method of claim 1, wherein the credentials comprise at least one of an identifier or an authentication token.

7. The method of claim 1, wherein one or more of the plurality of credentials are stored in encrypted form.

8. The method of claim 7, further comprising decrypting a requested credential when access to the requested credential is provided.

9. The method of claim 1, further comprising receiving a request for at least one credential of the plurality of credentials within the period, and providing access to the at least one credential.

10. The method of claim 9, wherein the request is received by a keyring application, and wherein the request is received from a requesting application that is different from the keyring application.

11. The method of claim 10, wherein the requesting application is a browser application.

12. The method of claim 10, further comprising denying the requesting application access to further credentials in the credential store in response to determining that the number of credentials accessed within the period exceeds the threshold associated with the second setting.

13. The method of claim 1, wherein the first setting is user-configurable.

14. The method of claim 1, wherein the first setting is defined by a security policy governing operation of the computing device.

15. The method of claim 1, wherein the period associated with the first setting is defined by a time interval.

16. The method of claim 1, wherein the period associated with the first setting is defined by a duration of an event.

17. The method of claim 1, wherein the second setting is user-configurable.

18. The method of claim 1, wherein the second setting is defined by a security policy governing operation of the computing device.

19. The method of claim 1, wherein the monitoring comprises recording an identity of each of the plurality of credentials accessed within the period.

20. The method of claim 1, further comprising:

prompting for user input as to whether access to the credential store is unauthorized, in response to determining that the number of credentials accessed within the period exceeds the threshold associated with the second setting;

wherein the indication of unauthorized access to the credential store is output in the user interface after user input indicating that the access to the credential store is unauthorized has been received at the computing device.

21. The method of claim 1, wherein the outputting comprises providing a description of at least one of the credentials accessed within the period associated with the first setting.

22. The method of claim 21, wherein the at least one credential is identified in a notification displayed on a display.

23. The method of claim 21, wherein the outputting further comprises directing a user of the computing device to take an action to protect the at least one credential.

24. The method of claim 1, wherein at least one credential of the plurality of credentials comprises a password, the method further comprising changing the password of each of the at least one credential to a new password.

25. The method of claim 24, further comprising changing at least one additional credential in the credential store to the new password, wherein each of the at least one additional credential comprises a password that corresponds to the password of the at least one credential.

26. A computing device programmed to detect unauthorized access to credentials of a credential store, the computing device comprising a processor configured to:

monitor a plurality of credentials of the credential store accessed within a period associated with a first setting; and

responsive to determining that a number of credentials accessed within the period exceeds a threshold associated with a second setting, output, in a user interface, an indication of potential unauthorized access to the credential store.

27. A computer-readable storage medium comprising executable instructions for programming a computing device to detect unauthorized access to credentials of a credential store, the instructions configuring a processor of the computing device to:

monitor a plurality of credentials of the credential store accessed within a period associated with a first setting; and

responsive to determining that a number of credentials accessed within the period exceeds a threshold associated with a second setting, output, in a user interface, an indication of potential unauthorized access to the credential store.