Patent Application
20110083172
1. Field of the Invention
This invention relates generally to password security systems, and more particularly to a method and apparatus for increasing entropy of user chosen data via data management.
2. Description of Background
Security of computer networks has become of utmost importance as individuals and businesses store and transmit information of both sensitive and confidential nature on and across these networks. Secure environments are created by employing mechanisms that offer protection to the information that is stored within them. Some of the most popular of these security mechanisms are password based. The conventional password based systems often involve the selection of a string of alpha numeric characters that are either user selected or administratively assigned to enable entry into the system. The effectiveness of these security mechanisms largely depends upon the ability to protect the password entry point throughout the duration of network access and over time. Unfortunately, in recent years there has been a continuous increase in the number of attempts made in order to gain unauthorized information by obtaining these passwords. These security threats on the passwords have ranged in sophistication and complexity. Known types of password guessing attacks can, in some cases, be driven by an individual's educated guesses, but more often are driven by automated processes that scan all possible random values, and/or target a specific set of words as large as the entire English language dictionary.
To improve password security, measurements can be taken to improve “Password Entropy” (hereinafter PE). Like in thermodynamics, “entropy” of a password is a measure of its mathematical “randomness”. A great challenge in the area of increasing this entropy, however, lies in the struggle to create a balance between user workable passwords and one that is not vulnerable to internal and external attacks.
Consequently, improvements are desired that can enhance password security by increasing its entropy without imposing cumbersome restrictions on the user.
The short comings of the prior art are overcome and additional advantages are provided through the provision of a method, a computer readable medium, and an apparatus for providing data security for a computing environment, especially one having a plurality of nodes. The apparatus comprises a password mechanism residing in a storage location in the computing environment; and a user specific dictionary including entries generated by the password mechanism about each user by retrieving available data from one or more databases. The password mechanism validates a proposed password for the user by comparing it with entries in the user specific dictionary and rejecting it when the proposed password matches at least part of any entry in the user specific dictionary.
Additional features and advantages are realized through the techniques of the present invention. Other embodiments and aspects of the invention are described in detail herein and are considered a part of the claimed invention. For a better understanding of the invention with advantages and features, refer to the description and to the drawings.
The subject matter which is regarded as the invention is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other objects, features, and advantages of the invention are apparent from the following detailed description taken in conjunction with the accompanying drawings in which:
The memory device 130 and the memory component 120 are in processing communication with each other and/or the nodes. In one embodiment, the nodes 110 are enabled to store or retrieve data from either the device 130 and/or component 120. The environment 100 therefore can use the device(s) and components to either provide redundant systems with one component or device providing backup to another, or alternatively as complementary units, to enable faster processing of data by splitting storage/data retrieval functions among the device(s)/component(s) as appropriate. In other embodiments, a hybrid of these two scenarios can be created where the memory component(s)/device(s) are designed to provide both functions or either function over time. In alternate embodiments, node access can be restricted selectively to one or more memory device or component.
One or more operating systems having one or more applications can run on each node. The computing environment 100 is a secure environment, so processing entry is only enabled by use of a password driven mechanism. In one embodiment, the password driven mechanism can comprise a dictionary as shown in
It should be noted, that, while the computing environment of
The password mechanism 200 can reside on any node and/or storage unit or at a location central to the nodes and/or entire computing environment 100. For ease of understanding, an example of the workings of the password mechanism 200 of
As illustrated in
In the next step, shown in block 430, it is determined if a user specific dictionary is in existence for the particular user and is up to date. In case of a new user, where there is no user specific dictionary in existence, a new user specific dictionary can be generated in a following step shown in block 435. In one embodiment, for existing users, a last minute update may selectively be conducted in the step shown in block 435.
Once the user specific dictionary is retrieved (located, updated or generated), the proposed password is then compared to the entries in the dictionary as shown in block 440. If the word(s) or part of a word for the new/modified password that is being requested appears on the entry/list in the user specific dictionary (as correlates to the user/users), then the request for change or modification of the password is denied as shown in blocks 450 and 455. A new selection for a new proposed password needs to be made. In one embodiment, security components 210 and 320 of
In different embodiments, the proposed password can be selected and reselected by the user or alternatively generated by an automated tool or program which is either part of one of the nodes 110 or is in processing communication with the computing environment 100.
In cases where the proposed password is not found in the user specific dictionary (in whole or in part), the proposed password will then be accepted as the new password as shown at 460. The new (proposed) password will be added to the user specific dictionary, as shown in block 470, so that it cannot be reused afterwards in creation of a subsequent password.
The password entry provides a single point of access to the environment 100. An incorrect password entry will result in access denial to the environment. If desired, additional security measures such as password lockouts that enable users only a selected number of tries to input the password correctly can be also be combined with the password mechanism (200) of the present invention.
In one embodiment of the invention, the password mechanism 200 calculates the time between password updates to search through the same type of publicly visible records and data that an unauthorized individual might use to improve a password guessing attack. Therefore user specific dictionaries will then also be updated as information changes over time. Consequently, each time the user updates/changes a password, the user specific dictionary 300 will already be loaded with most recent updated list of words that this user is restricted from using.
The password mechanism 200, in one embodiment uses data searching techniques such as those known to those skilled in the art. The mechanism can use a number of techniques to gather data available on a variety of databases including public sites. The mechanism can then customize select information used, to update/create each specific dictionary. The mechanism will use a classification or clustering of data to arrange gathered information such as in groups. For example, information may be deemed to be user specific or general in nature (and thus not to be included), or it may completely be undefined and grouped together based on other similar premise.
For data searching, a number of methods can be employed as known to those skilled in the art. In some embodiments, rule techniques can be employed to search for relationships between variables.
Any specific type of data searching can also be used in alternate embodiments. For example, the mechanism 200 can employ pattern searching for all users with specific dictionaries to determine commonalities that should be included in general for all user specific dictionaries. One such technique, involves searching for existing patterns in data as known to those skilled in the art. Pattern can be defined as a set of association rules, in one context. The same can be used for each specific user or subset of users.
Subject based data searching can also be used in other embodiments to establish data searching techniques involving search of public sites establishing associations between individuals by gathering large pools of publicly available data. This can even allow for research in more sensitive sites such as financial institution sites or others as selectively permitted by the user.
One benefit of using the password driven mechanism 200 of the present invention is to increase password entropy. PE or “Guessing Entropy” is defined by the National Institute of Standards and Technology as a measure of the difficulty that an attacker has to guess the average password used in a system. In a document entropy is stated in bits. Therefore, when a password has n-bits of entropy, then an attacker has as much difficulty guessing the average password as in guessing an n-bit random quantity.
Serious threats to secure environments have been developed over the past few decades using various permutations of the “password guessing attack”. These types of attacks take many forms and present problems for enterprises and agencies that demand high security but must allow some leeway for users to remember their passwords. Known types of password guessing attacks can in some cases be driven by individuals making educated guesses, but more often are driven by automated processes that scan all possible random values, or target a specific set of words such as the entire English Language dictionary (called a “Dictionary Attack”). Network security protocols can be employed to reduce the number of online attacks. However, these methods would not work in the case of offline attacks where a malicious user may obtain an encrypted password and attempt to find a matching value through brute force guessing without the need to attempt a login.
Password lockout methods also can be employed, but when used alone these methods have many loopholes and will still allow an attacker to succeed in gaining access to the network. A password lockout method disables access by an identity after a certain (X) number of failed passwords has been attempted. Password lockouts have been used as the basis for obtaining unauthorized access creating new problems. In addition, brute force guessing cannot be entirely stopped, it can only be delayed by creating passwords that are difficult to obtain and/or guess. This can only be achieved by increasing PE.
Increasing PE, however, can affect ease of use. Passwords are often chosen by users based on familiar terms, events or other aspects of their life, making them easy to remember. Unfortunately, these passwords are easily guessed. Even when password composition rules disallow the users to incorporate part of an obvious user trait or information into the password, such as user name or birth date, it is still easy to decipher such passwords through information that is readily accessible such as through the internet. For example, a list of users' favorite musicians, authors, team names, and even more sensitive data such as names of family members and friends can become readily available to an attacker by looking at social network sites. These can make the password guessing attack more efficient.
Conventional methods of increasing PE employ longer passwords with many restriction policies, such as forcing the inclusion of at least one number in the password or inclusion of a series of uppercase letters and lowercase letters in a pattern. Other password composition rules may have minimum length requirements or even disallow words that are found in the dictionary (dictionary rules). Besides being cumbersome, these rules still offer limited protection to the user.
Referring back to
No matter what the case, however, the dictionary content is continually updated by a background process that is doing data searching more specifically associated with the user in question (as noted above). In addition, most recently used passwords can be included in the user specific dictionary so that part or all of the password previously used cannot be reused at least for a time period or selectively ever again for that particular user.
Furthermore, passwords typically have an expiration date, a set amount of time such that after which the password has to be changed. The password expiration dates are selective to users and/or enterprises and are designed specifically as a preventative measure to avoid discoverability due to password owners' prolonged use. For example one entity may decide to use a three month time period after which a password expires, while a different entity may use a six month expiration date. As discussed, the password mechanism 200 will be reviewing and updating the entries in the user specific dictionaries according to a preselected time frame, or by calculating time periods between password updates and searching through one or more data bases and public record websites etc to updating the user specific list.
Consequently, what may have passed as a valid or qualified password with satisfactory entropy may not necessarily pass on a subsequent attempted password selection, for example, based on more currently searched data that may have been collected between password expiration cycles. Such deployment is conveniently afforded through plug-ins or exit points within a security component (shown in
In a preferred embodiment, user-specific dictionaries 300 can be used to improve existing dictionaries used by populated them with terms found by searching publicly visible data about specific users. Data gathering in such an instance may be similar as known to those skilled in the art to data gathered by sectors that deliver target advertising to specific customers. Using similar techniques, a dictionary can be created using information specific to each user within the system. The information provided in the dictionary then provides a basis for restricting users from using words found in them. These custom dictionaries, such as the one depicted in
While the invention has been described in accordance with certain preferred embodiments thereof, those skilled in the art will understand the many modifications and enhancements which can be made thereto without departing from the true scope and spirit of the invention, which is limited only by the claims appended below.
