Patent Application
20200143037
This disclosure relates to managing enterprise authentication policies using password strength.
Computer networks are often configured to incorporate network security systems in order to protect the networks against malicious activity. Such malicious activity can include, for example, fraudulent access requests made by human users or possibly by networks of compromised computers or “botnets.”
Network security systems can be designed to protect a computer network of a company, organization or other large enterprise comprising many thousands of user devices. However, enterprise computer networks are in many cases continuously growing in size, and often incorporate a diverse array of user devices, including mobile telephones, laptop computers and tablet computers. This continuous growth can make it increasingly difficult to provide a desired level of protection using the limited resources of the network security system. For example, available network security system functionality such as processing of security alerts and deployment of attack remediation measures on user devices can be strained by the demands of large enterprise networks.
Moreover, recent years have seen the rise of increasingly sophisticated attacks including advanced persistent threats (APTs) which can pose severe risks to enterprises. These APTs are typically orchestrated by well-funded attackers using advanced tools to adapt to the victim environment while maintaining low profiles of activity. As a result, conventional credential-based authentication techniques and other traditional defenses typically deployed by enterprise network security systems today often fail at detecting and remediating access anomalies at a sufficiently early stage.
One type of credential-based authentication technique is a user password. User passwords, however, are notorious for a being a weak link in information security. Yet they remain ubiquitous and are not going away anytime soon.
In the context of an enterprise, there is a need to use password strength when managing enterprise access each time a user logs in.
A method is used in managing enterprise authentication policies using password strength. A request is received from an enterprise user to use a user password in order to access a protected resource within an enterprise. A password score for the user password is determined. The password score indicates quality of the user password, A user risk score for the enterprise user is determined based on the password score. An enterprise authentication policy is enforced based on the user risk score. The user risk score is determined each time the enterprise user uses the user password.
Objects, features, and advantages of embodiments disclosed herein may be better understood by referring to the following description in conjunction with the accompanying drawings. The drawings are not meant to limit the scope of the claims included herewith. For clarity, not every element may be labeled in every figure. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating embodiments, principles, and concepts. Thus, features and advantages of the present disclosure will become more apparent from the following detailed description of exemplary embodiments thereof taken in conjunction with the accompanying drawings in which:
Illustrative embodiments may be described herein with reference to exemplary cloud infrastructure, data centers, data processing systems, computing systems, data storage systems and associated servers, computers, storage units and devices and other processing devices. It is to be appreciated, however, that embodiments of the invention are not restricted to use with the particular illustrative system and device configurations shown. For example, the term “computer network” as used herein is intended to be broadly construed, so as to encompass, for example, any system comprising multiple networked computing devices.
The term “module” is intended to be interpreted broadly as software, firmware, or both configured to operate on a processor or in memory for performing a function as described more fully with respect to embodiments.
Embodiments herein are intended to be deployed on or in private or public cloud computing, private or public networks, private or public data storage systems, or any other electronic device protected by password authentication.
Similarly, the term “enterprise” is to be construed broadly to include, without limitation, an organization, a network, a group, an affiliation, a team, a league, humans organized by one or common attributes, machines organized by one or more common attributes, and the like. The term “password” is to be construed broadly so as to encompass, without limitation, any combination of information, whether text, photographic, audio, optical, biometric, and the like, used to grant or deny access to something tangible, such as without limitation, a network, data, a public or private cloud, a physical location, a virtual location, a web browser, an API, a portal, an enterprise cloud, and the like.
A given embodiment may more generally comprise any arrangement of one or more devices.
Described below is a technique for use in managing enterprise authentication policies using password strength, which technique may be used to provide, among other things, receiving a request from an enterprise user to use a user password in order to access a protected resource within an enterprise, determining a password score for the user password, wherein the password score indicates quality of the user password; based on the password score determining a user risk score for the enterprise user, and based on the user risk score, enforcing an enterprise authentication policy, wherein the user risk score is determined each time the enterprise user uses the user password. The method is performed by at least one processing device comprising a processor coupled to a memory.
One important aspect of passwords is password quality, also known as password strength. In a conventional system, password quality is generally only considered when a user creates or resets his or her password. But, password quality may change over time, for instance, as new breaches with user passwords are disclosed or as certain terms become more popular in the media. Thus, in such a conventional system, once a user has established his or her password, the strength of the password is not evaluated again until the user resets the password.
Password strength checking is a de facto standard in end-user applications that require users to have passwords. Password strength checking is typically done upfront when a user is setting or resetting his or her password, and it's used to guide users in choosing passwords that are unlikely to be cracked by attackers. Strength checking can be done client-side (for instance in the client's web browser or a mobile app) or server-side, with the password or a partial hash of the password being sent over a secured connection to another host.
One form of password strength checking relies on password policies that prescribe a minimum password length and the types of characters (such as uppercase and lowercase letters, numbers, and special characters) that must be contained in the password. Techniques that use statistics and machine learning have become available and there are third-party remote web services that can be used for password strength checking, where such services match passwords against known bad passwords and known breached passwords.
Conventionally, when an enterprise authentication policy is used in an enterprise during authentication process of a user password, the strength of the user password is neither taken into consideration nor evaluated in an ongoing manner. In such a conventional system, a user's password strength may be checked only once, that is at initialization time, and not as a matter of coarse each time the user logs in. Further, in such a conventional system, strength of a user password is not taken into account when determining a risk score for a user in an enterprise, which, especially in light of the dynamic nature of network security, poses a risk for network administrators and those in the enterprise field.
By contrast, in at least some implementations in accordance with the technique as described herein, managing authentication policies using password strength by taking password quality as an input to determining a user risk score, at the time the user enters his or her password, and using such user risk score to enforce user authentication policy, such as requiring step-up authentication mitigates the risk of compromise due to inadvertent or malicious exposure of passwords.
In order to explain the functionality of embodiments, a portion of a computer network 100 configured in accordance with an illustrative embodiment is shown in
The user devices 102 comprise, for example, mobile telephones, laptop computers, tablet computers, desktop computers or other types of devices, in any combination, that are capable of supporting user logins or other types of requests to access protected resources of the computer network 100. These user devices 102 are examples of what are more generally referred to herein as “processing devices.” Some of these processing devices are also generally referred to herein as “computers.”
The user devices 102 in some embodiments comprise respective computers associated with a particular company, organization or other enterprise. In addition, at least portions of the computer network 100 may also be referred to herein as collectively comprising an “enterprise network.” Numerous other operating scenarios involving a wide variety of different types and arrangements of processing devices and networks are possible, as will be appreciated by those skilled in the art.
Also, it is to be appreciated that the term “user” in this context and elsewhere herein is intended to be broadly construed so as to encompass, for example, human, hardware, software or firmware entities, as well as various combinations of such entities.
The network 104 is assumed to comprise a portion of a global computer network such as the Internet, although other types of networks can be part of the computer network 100, including a wide area network (WAN), a local area network (LAN), a satellite network, a telephone or cable network, a cellular network, a wireless network such as a WiFi or WiMAX network, or various portions or combinations of these and other types of networks. The computer network 100 in some embodiments therefore comprises combinations of multiple different types of networks each comprising processing devices configured to communicate using Internet protocol (IP) or other related communication protocols.
Network 104 further comprises protected resources 111, which could be internally stored, externally stored, coupled to, and so forth, network 104. In embodiments, protected resources 111 are resources requiring password authentication of a sufficiently robust password prior to being granted access thereto. Similarly, the information housed within database 130 also requires password authentication according to embodiments described more fully below.
As a more particular example, some embodiments may utilize one or more high-speed local networks in which associated processing devices communicate with one another utilizing Peripheral Component Interconnect express (PCIe) cards of those devices, and networking protocols such as InfiniBand, Gigabit Ethernet or Fibre Channel. Numerous alternative networking arrangements are possible in a given embodiment, as will be appreciated by those skilled in the art. The password monitoring system 105 has an associated database 106 configured to store user enterprise data 107 accessible by some or all of the users in various embodiments. The database 106 in the present embodiment is implemented using one or more storage systems associated with the password monitoring system 105. Such storage systems can comprise any of a variety of different types of storage including network-attached storage (NAS), storage area networks (SANs), direct-attached storage (DAS) and distributed DAS, as well as combinations of these and other storage types, including software-defined storage.
The storage system utilized to implement database 130 and possibly other parts of the computer network 100 can comprise at least one VNX® or Symmetrix VMAX® storage array from Dell EMC of Hopkinton, Mass. Other types of storage arrays that may be used in illustrative embodiments include scale-out all-flash content addressable storage arrays such as XtremIO™ storage arrays, all-flash and hybrid flash storage arrays such as Unity™, software-defined storage products such as ScaleIO™ and ViPR®, cloud storage products such as Elastic Cloud Storage (ECS), object-based storage products such as Atmos®, and scale-out NAS clusters comprising Isilon® platform nodes and associated accelerators, all from Dell EMC. Combinations of multiple ones of these and other storage products can also be used in implementing a given storage system in an illustrative embodiment.
In addition to client module 103, embodiments herein are further executed on server module 120. Server module 120 oversees password quality assessment as well as determining whether the user's password is sufficiently strong enough to allow access to the desired material, either protected resource 111, database 130, or both.
For simplicity, we assume that password authentication has transpired prior to password strength assessment. In this scenario, a user enters his or her password using user device 102. User device 102 transmits, or shares, the password to client module 103, which in turn relays the password to standard user authorization module 110. If the password is incorrect, it is rejected. The user is notified of the rejection and likely given an opportunity to reenter the password.
If the password is verified, standard user authorization module 110 relays the password to password monitoring module 120. Once the password is received by password monitoring module 120, password scoring module 122 computes a password score for the password. The password score is a measure of the quality of the password. In an alternate embodiment, password monitoring module 120 could also include a module that measures password strength by using a 3rd party password strength checking service 126 in addition to, or in lieu of, the password scoring module 122.
Once a password score has been calculated, it is transmitted to, which can likewise mean shared with, user risk score module 124. User risk score module 124 contains logic sufficient to determine whether the user's password is secure enough to comply with network policies, administrator policies, enterprise policies, or additional factors such as frequency of use of the particular password, geolocation of the user, sensitivity of the data, and myriad other criteria that is controlled by an administrative or policy enforcing entity.
If the password is strong enough, user risk score module 124 relays an access grant message to one or more of client module 103, network 104, database 130, or a user. Similarly, if the password is not sufficiently strong, user risk score module 124 relays an access denied message to one or more of client module 103, network 104, database 130, or a user. Importantly, the strength/quality calculations and decisions related to granting or denying access are performed without the need to store the user's password in memory.
In some embodiments, a strength/quality assessment of a user's password is performed every time he or she logs on or seeks access to protected resource 111, database 130, or any other sensitive information.
In additional embodiments, the password strength measurements are performed when a user establishes a new password or resets a password.
In embodiments, client module 103 is a component, which runs locally on the user's device 102, and which carries out the authentication process on behalf of the user. In this embodiment, client module 103 could be an application running in a web browser on a user's laptop, a mobile app on the user's phone, or an operating system. In this embodiment, standard user authentication module 110 resides within the user's device 102.
In embodiments, the server module 120 handles server-side authentication functions, often residing on one or more remote hosts over the network. Note that the word “module” is a logical term and does not imply a single operating system process. One or more of the components of the server module 120 (standard user authentication 110, password scoring 122, and user risk score module 124 need not all run on the same physical host or service provider.).
In some embodiments, the user's password score may be too low, necessitating either a password reset, or additional security measures such as two-factor authentication, a step-up authentication, biometric authentication, and the like to ensure sufficient password strength.
Although we depict a single processor 240, it is understood that there could be any number of processors present. The processor 240 illustratively comprises a microprocessor, a microcontroller, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a graphics processing unit (GPU) or other type of processing circuitry, as well as portions or combinations of such circuitry elements.
The memory 242 illustratively comprises random access memory (RAM), read-only memory (ROM), flash memory or other types of memory, in any combination. The memory 242 and other memories disclosed herein may be viewed as examples of what are more generally referred to as “processor-readable storage media” storing executable computer program code or other types of software programs.
Articles of manufacture comprising such processor-readable storage media are considered illustrative embodiments of the present disclosure. A given such article of manufacture may comprise, for example, a storage device such as a storage disk, a storage array or an integrated circuit containing memory, as well as a wide variety of other types of computer program products. The term “article of manufacture” as used herein should be understood to exclude transitory, propagating signals.
The network interface 244 allows the server module 220 to communicate via client module 203 to network 204, user devices 202, database 230, and protected resource 111. Network interface 244 illustratively comprises one or more conventional transceivers. In alternate embodiments, network interface 244 is directly coupled to one or more of network 204, user devices 202, database 230, or protected resource 111.
Input-output device 246 can be a keyboard, display, voice recognition device, or other type of input-output device in any combination. These input-output devices 246 can be used to support one or more user interfaces to any of the devices depicted in the network 200.
In some embodiments, if the user risk score is sufficiently low, the user is prompted to perform additional actions. One scenario where this occurs is if the enterprise contains particularly sensitive information, for example medical records, or financial information. In these embodiments, the enterprise authentication policy contains the variables related to users, data, geographic location, current events, and the like that are taken into consideration in determining 314 an overall user risk score.
In some embodiments, and in accordance with the enterprise authentication policy, a user is required to perform additional security measures such as employing a two factor authentication, a step-up authentication, or a biometric authentication. Likewise, a user in alternate embodiments is required to reset his or her password.
Additionally, in some embodiments, determining the risk score is performed in a privacy-preserving manner with respect to the user password.
Thus, in at least one embodiment of the current technique, a password score, whether determined in a privacy persevering manner or not, can be directly used as part of a user-specific authentication policy. For example, if a user's password score is determined to be a moderately weak password because, for example, it resembles another password in a recent data breach. In such a case, the individual user's risk, considering other factors in a continuous monitoring context, may be too high, and authentication policy in such an example embodiment, may dictate that the user reset his or her password or perform step-up authentication. Note that in some circumstances, such as when a user's password is being managed by an enterprise-global active directory, it may not always be practical to force users to reset their passwords. In such circumstances, step-up authentication may be a better option. Thus, in at least one embodiment of the current technique, strength of a password is used for managing enterprise authentication policies by taking into account quality of the password measured by a password score in determining a user risk score that is used for enforcing such enterprise authentication policies.
The embodiments above do not presuppose where the server process components reside. They could be hosted on premise within the purview of an enterprise or hosted as a service by a trusted third party.
Throughout the entirety of the present disclosure, use of the articles “a” or “an” to modify a noun may be understood to be used for convenience and to include one, or more than one of the modified noun, unless otherwise specifically stated.
Elements, components, modules, and/or parts thereof that are described and/or otherwise portrayed through the figures to communicate with, be associated with, and/or be based on, something else, may be understood to so communicate, be associated with, and or be based on in a direct and/or indirect manner, unless otherwise stipulated herein.
Various changes and modifications of the embodiments shown in the drawings and described in the specification may be made within the spirit and scope of the present invention. Accordingly, it is intended that all matter contained in the above description and shown in the accompanying drawings be interpreted in an illustrative and not in a limiting sense. The invention is limited only as defined in the following claims and the equivalents thereto.
This application is related to co-pending U.S. patent application Ser. No. ______ (Attorney Docket No. 112523.01) for MONITORING STRENGTH OF PASSWORDS and filed concurrently herewith, which is incorporated herein by reference for all purposes.
