Automated password generation

Patent metadata

Field	Value
Publication number	US-11625477-B2
Application number	US-202016993050-A
Country	US
Kind code	B2
Filing date	Aug 13, 2020
Priority date	Aug 13, 2020
Publication date	Apr 11, 2023
Grant date	Apr 11, 2023

Abstract

Disclosed herein are system, method, and device embodiments for implementing password suggestion. An embodiment operates by selecting one or more random terms from dictionary information, generating an alphanumeric string based on a password requirement, combining the one or more random terms and the alphanumeric string to form a generated password, determining a password strength of the generated password based on compromised password information, and presenting the generated password for selection by a user device when the password strength meets or exceeds a threshold value.

First claim

What is claimed is:

1. A method comprising:
receiving a proposed password associated with a user account;
determining that a first password strength of the proposed password is lower than a first threshold value;
selecting, from dictionary information, one or more random terms;
generating an alphanumeric string based on a password requirement;
combining the one or more random terms and the alphanumeric string to form a generated password;
determining a second password strength of the generated password based on compromised password information; and
presenting the generated password for selection by a user device when the second password strength meets or exceeds a second threshold value.

2. The method of claim 1 , wherein determining that the first password strength is lower than the first threshold value comprises determining the first password strength based on the compromised password information.

3. The method of claim 1 , wherein determining the second password strength comprises:
determining a distance result by applying a distance function to the generated password and a compromised password of the compromised password information; and
comparing the distance result to a distance threshold associated with a password strength policy.

4. The method of claim 1 , wherein determining the second password strength comprises:
generating a classification model based at least in part on the compromised password information; and
classifying the generated password based at least in part on the classification model.

5. The method of claim 1 , further comprising:
receiving a selection of the generated password; and
setting an account password to the generated password based on the selection of the generated password.

6. The method of claim 1 , further comprising modifying the dictionary information based on the compromised password information.

7. The method of claim 1 , wherein the alphanumeric string is a numeric value consisting of no less than a predetermined amount of numbers.

8. The method of claim 1 , wherein the one or more random terms include a first random term and a second random term.

9. A system comprising:
a dictionary database comprising dictionary terms;
a compromised password information containing compromised passwords; and
one or more processors configured to:
receive proposed password information from a user device;
determine a first password strength based on the proposed password information;
receive, from the dictionary database, one or more random terms based at least in part on the first password strength being less than a predetermined threshold;
generate an alphanumeric string based on a password requirement;
combine the one or more random terms and the alphanumeric string to form a generated password;
determine, based on the compromised password information, a second password strength of the generated password; and
present, via the user device, the generated password for selection based on the second password strength.

10. The system of claim 9 , wherein to determine the first password strength, the one or more processors are configured to determine the first password strength using the compromised password information.

11. The system of claim 9 , wherein to determine the first password strength, the one or more processors are configured to:
determine a string distance between the generated password and a compromised password of the compromised password information; and
compare the string distance to a distance threshold associated with a password strength policy.

12. The system of claim 9 , wherein to determine the second password strength, the one or more processors are configured to:
generate a classification model based at least in part on the compromised password information; and
classify the generated password based at least in part on the classification model.

13. The system of claim 9 , wherein the one or more processors are configured to modify the dictionary database based on the compromised password information.

14. The system of claim 9 , wherein the alphanumeric string is a numeric value consisting of no less than a predetermined amount of numbers.

15. A non-transitory computer-readable device having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:
receiving a proposed password associated with a user account;
determining that a first password strength of the proposed password is lower than a first threshold value;
selecting, from dictionary information, one or more random terms;
generating an alphanumeric string based on a password requirement;
combining the one or more random terms and the alphanumeric string to form a generated password;
determining a second password strength of the generated password based on compromised password information; and
presenting the generated password for selection by a user device when the second password strength meets or exceeds a second threshold value.

16. The non-transitory computer-readable device of claim 15 , wherein determining that the first password strength of the proposed password is lower than the first threshold value comprises determining the first password strength based on the compromised password information.

17. The non-transitory computer-readable device of claim 15 , wherein determining the second password strength comprises:
determining a distance result by applying a distance function to the generated password and a compromised password of the compromised password information; and
comparing the distance result to a distance threshold associated with a password strength policy.

18. The non-transitory computer-readable device of claim 15 , wherein determining the second password strength comprises:
generating a classification model based at least in part on the compromised password information; and
classifying the generated password based at least in part on the classification model.

19. The non-transitory computer-readable device of claim 15 , wherein the first threshold value and the second threshold value are identical.

20. The non-transitory computer-readable device of claim 15 , wherein the operations further comprise modifying the dictionary information based on the compromised password information.

Assignees

• Capital One Services Llc

Inventors

• Miracolo Max
• Learned Jacob
• Gibilterra Kaylyn S
• Saia Michael

Classifications

• G06N20/00

  Machine learning · CPC title

• G06Q50/265

  Personal security, identity or safety · CPC title

• G06F21/46 Primary

  by designing passwords or checking the strength of passwords · CPC title

• G06N5/04

  Inference or reasoning models · CPC title