Methods and devices for detecting unauthorized access to credentials of a credential store

• US 9,088,556 B2
• Filed: 05/10/2013
• Issued: 07/21/2015
• Est. Priority Date: 05/10/2013
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Truskovsky, Alexander, Bender, Christopher Lyle, Martin, Daryl Joseph
• Primary Examiner(s): LEE, JASON T
• Application Number:
  US13/891,258
• Publication Number:
  US 20140337937A1
• Time in Patent Office: 802 Days
• Field of Search: 726/4, 726/5, 726/22
• US Class Current: 1/1
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Methods and devices for detecting unauthorized access to credentials of a credential store on a computing device are disclosed herein. In one broad aspect, the method comprises monitoring a plurality of credentials of the credential store accessed within a period associated with a first setting, and responsive to determining that a number of credentials accessed within the period exceeds a threshold associated with a second setting, outputting, in a user interface, an indication of potential unauthorized access to the credential store. In at least one embodiment, each of the credentials accessed within the period is associated with a different user account.

Claims

1. A method of detecting unauthorized access, the method comprising:

monitoring access to credentials of credential store on a computing device within a time period associated with a first setting, wherein the time period is defined by a time interval or by a duration of an event;

determining that a number of credentials accessed within the time period exceeds a threshold associated with a second setting; and

outputting, in a user interface, an indication of potential unauthorized access to the credential store responsive to determining that the number of credentials access within the time period exceeds the threshold,

wherein one or more of the credentials are stored in encrypted form.

2. The method of claim 1, wherein each of the credentials accessed within the time period is associated with a different user account.

3. The method of claim 1, further comprising restricting access to one or more credentials of the credential store in response to determining that the number of credentials accessed within the time period.

4. The method of claim 1, wherein at least one of the credentials accessed within the time period comprises a password.

5. The method of claim 1, wherein at least one of the credentials accessed within the time period comprises at least one of:

a digital certificate, a cryptographic key, a username, an access code, or a secure data item.

6. The method of claim 1, wherein the credentials comprise at least one of an identifier or an authentication token.

7. The method of claim 1, further comprising decrypting a requested credential when access to the requested credential is provided.

8. The method of claim 1, further comprising receiving a request for at least one credential of the credentials within the time period, and providing access to the at least one credential.

9. The method of claim 8, wherein the request is received by a keyring application, and wherein the request is received from a requesting application that is different from the keyring application.

10. The method of claim 9, wherein the requesting application is a browser application.

11. The method of claim 9, further comprising denying the requesting application access to further credentials in the credential store in response to determining that the number of credentials accessed within the time period exceeds the threshold.

12. The method of claim 1, wherein the first setting is user-configurable.

13. The method of claim 1, wherein the first setting is defined by a security policy governing operation of the computing device.

14. The method of claim 1, wherein the second setting is user-configurable.

15. The method of claim 1, wherein the second setting is defined by a security policy governing operation of the computing device.

16. The method of claim 1, wherein the monitoring comprises recording an identity of each of the credentials accessed within the time period.

17. The method of claim 1, further comprising:

prompting for user input as to whether access to the credential store is unauthorized, in response to determining that the number of credentials accessed within the time period exceeds the threshold;

wherein the indication of potential unauthorized access to the credential store is output in the user interface after user input indicating that the access to the credential store is unauthorized has been received at the computing device.

18. The method of claim 1, wherein the indication of potential unauthorized access to the credential store comprises a description of at least one of the credentials accessed within the time period.

19. The method of claim 18, wherein the at least one credential is identified in a notification displayed on a display.

20. The method of claim 18, wherein the indication of potential unauthorized access to the credential store directs a user of the computing device to take an action to protect the at least one credential.

21. The method of claim 1, wherein at least one credential of the credentials comprises a password, the method further comprising changing the password of each of the at least one credential to a new password.

22. The method of claim 21, further comprising changing at least one additional credential in the credential store to the new password, wherein each of the at least one additional credential comprises a password that corresponds to the password of the at least one credential.

23. A computing device programmed to detect unauthorized access to credentials of a credential store, the computing device comprising a processor configured to:

monitor access to credentials of the credential store within a time period associated with a first setting, wherein the period is defined by a time interval or by a duration of an event;

determine that a number of credentials accessed within the time period exceeds a threshold associated with a second setting; and

output, in a user interface, an indication of potential unauthorized access to the credential store responsive to determining that the number of credentials accessed within the time period exceeds the threshold,

wherein one or more of the credentials are stored in encrypted form.

25. The computing device of claim 23, wherein the processor is configured to restrict access to one or more credentials of the credential store in response to determining that the number of credentials accessed within the time period exceeds the threshold.

24. A non-transitory computer-readable storage medium comprising executable instructions for programming a computing device to detect unauthorized access to credentials of a credential store, the instructions configuring a processor of the computing device to:

monitor access to credentials of the credential store within a time period associated with a first setting, wherein the period is defined by a time interval or by a duration of an event;

determine that a number of credentials accessed within the time period exceeds a threshold associated with a second setting; and

output, in a user interface, an indication of potential unauthorized access to the credential store responsive to determining that the number of credentials accessed within the time period exceeds the threshold,

wherein one or more of the credentials are stored in encrypted form.

26. The non-transitory computer-readable storage medium of claim 24, wherein the instructions configure the processor to restrict access to one or more credentials of the credential store in response to determining that the number of credentials accessed within the time period exceeds the threshold.

27. The non-transitory computer-readable storage medium of claim 24, wherein the instructions configure the processor to record an identity of each of the credentials accessed within the time period.