Password breach registry

Patent metadata

Field	Value
Publication number	US-10079855-B2
Application number	US-201615254464-A
Country	US
Kind code	B2
Filing date	Sep 1, 2016
Priority date	Sep 1, 2016
Publication date	Sep 18, 2018
Grant date	Sep 18, 2018

Abstract

A password breach registry is utilized to secure a service provided by a service provider. The password breach registry is a publicly accessible registry and includes password tokens written by breached service providers. The password tokens indicate passwords used to access breached service providers that may have been breached. A service provider can subscribe to the password breach registry and periodically query the password breach registry to determine if a password token corresponding to a user of a service provided by the service provider has been written to the password breach registry. This may indicate that the user of the service utilizes the same password on other services that have been breached. Upon determining that the password token has been written to the password breach registry, the user can be locked out from the service to prevent a malicious actor from gaining access to the account of the user.

First claim

What is claimed is:

1. A non-transitory computer storage medium storing computer-useable instructions that, when executed by a computing device, causes the computing device to perform operations, the operations comprising:
subscribing, by a first service provider, to a password breach registry that comprises a plurality of password tokens registered and written by a plurality of breached service providers, the password tokens indicating passwords associated with service providers that have been breached;
querying the password breach registry, by the first service provider as the subscriber of the password breach registry, to determine if a password token corresponding to a user account of a service provided by the first service provider has been registered to the password breach registry; and
in response to the query, upon comparing and determining the password token has been registered to the password breach registry, locking out the user account from the service provided by the first service provider.

2. The computer storage medium of claim 1 , wherein the password tokens comprise usernames, hashed passwords, and hash functions used by the breached service providers.

3. The computer storage medium of claim 1 , further comprising identifying a hash function utilized by a particular breached service provider.

4. The computer storage medium of claim 3 , further comprising creating comparable tokens, by the first service provider, by hashing passwords for each user of the service provided by the first service provider utilizing the identified hash function.

5. The computer storage medium of claim 4 , further comprising comparing the password tokens in the password breach registry to the comparable tokens.

6. The computer storage medium of claim 1 , wherein the password tokens are random strings created by users.

7. The computer storage medium of claim 1 , wherein the password tokens are generated by a password manager.

8. The computer storage medium of claim 1 , wherein the password tokens do not include any personally identifiable information.

9. The computer storage medium of claim 1 , wherein the password tokens do not include information that identifies the passwords.

10. The computer storage medium of claim 1 , wherein the passwords cannot be reconstructed using the password tokens.

11. A computer-implemented method comprising:
subscribing, by a first service provider, to a password breach registry that comprises a plurality of password tokens registered and written by a plurality of breached service providers, the password tokens indicating passwords associated with service providers that have been breached;
querying the password breach registry, by the first service provider as the subscriber of the password breach registry, to determine if a password token corresponding to a user account of a service provided by the first service provider has been registered to the password breach registry; and
in response to the query, upon comparing and determining the password token has been registered to the password breach registry, locking out the user account from the service provided by the first service provider.

12. The method of claim 11 , further comprising determining a hash function for a breached token of the plurality of password tokens written to the password breach registry, the breached token corresponding to a password of a breached user of a breached service.

13. The method of claim 12 , further comprising upon determining the hash function is not used by the first service provider to create the password token, utilizing the hash function for a first service password of the user to create a comparable password token and comparing the breached token to the comparable password token.

14. The method of claim 13 , further comprising, based on the comparing, determining the password token is the breached token and locking out the user from the service.

15. The method of claim 11 , wherein the password tokens do not include any personally identifiable information.

16. The method of claim 11 , wherein the password tokens do not include information that identifies the password.

17. The method of claim 11 , wherein a password cannot be reconstructed using the password tokens.

18. The method of claim 11 , further comprising requiring the user to change a password before utilizing the service.

19. The method of claim 18 , further comprising generating a new first service token for the user.

20. A computerized system comprising:
a hardware processor; and
a non-transitory computer storage medium storing computer-useable instructions that, when executed by the hardware processor, causes the hardware processor to:
subscribe, by a first service provider, to a password breach registry that comprises a plurality of password tokens registered and written by a plurality of breached service providers, the password tokens indicating passwords associated with service providers that have been breached;
query the password breach registry, by the first service provider as the subscriber of the password breach registry, to determine if a password token corresponding to a user account of a service provided by the first service provider has been registered to the password breach registry; and
in response to the query, upon comparing and determining the password token has been registered to the password breach registry, locking out the user account from the service provided by the first service provider.

Assignees

• Ca Inc

Inventors

• Versteeg Steven Cornelis
• Hastings Nathan Allin
• Yao Xien
• Bird John Sinclair

Classifications

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/1466 Primary

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title