Pattern entropy password strength estimator
View Patent ↗A password evaluation system is provided for determining the password strength of a password. A password is provided for evaluation. The password is parsed and substrings are identified from the password. Each substring is associated with a pattern that can generate the substring. The substrings are scored to determine a substring strength measure for the substring. The substrings are combined to identify non-overlapping substring combinations, which together make up the password. The combinations are assigned a combination strength score based in part on the substring strength of the substrings contained in the substring combinations. The substring combination with the lowest combination strength measure is identified and the associated combination strength measure is used as the password strength measure for the password.
1. A computer-implemented method for evaluating the strength of a password, the method comprising:
determining, by a processor, at least one pattern corresponding to a substring of a password, the password including a string of characters, a substring comprising a portion of the string of characters, and for the at least one pattern, determining a total number of different substrings that can be generated from the at least one pattern;
identifying one or more combinations of substrings, each combination of substrings including at least one non-overlapping substring that forms a combination string of characters identical to the string of characters included in the password;
determining, by the processor, for each combination of substrings a measure of entropy for the combination based at least in part on the total number of different substring combinations that can be generated from the at least one pattern; and
determining as a password strength measure for the password a lowest measure of entropy of the substring combinations.
2. The computer-implemented method of claim 1 , further comprising determining, by the processor, whether to accept the password based on the password strength measure.
3. The computer-implemented method of claim 1 , further comprising:
suggesting at least one pattern to a user to strengthen the password.
4. The computer-implemented method of claim 1 , wherein at least one pattern comprises a dictionary word.
5. The computer-implemented method of claim 4 , wherein the measure of entropy of the dictionary word is determined based on a frequency rank of the dictionary word.
6. The computer-implemented method of claim 4 , wherein the at least one pattern comprising a dictionary word contains a substitution of characters in the dictionary word.
7. The computer-implemented method of claim 1 , wherein at least one pattern comprises a keyboard pattern.
8. The computer-implemented method of claim 7 , wherein the keyboard pattern comprises a length and at least one of a number of turns or a number of capitalizations.
9. The computer-implemented method of claim 8 , wherein the keyboard pattern further comprises an adjacency score.
10. The computer-implemented method of claim 7 , wherein determining a measure of entropy is further based on an average number of adjacent keys for a keyboard.
11. A system for evaluating the strength of a password, the system comprising:
at least one processor operatively coupled to a network connection;
memory operatively coupled to the at least one processor; and
wherein the at least one processor is configured to:
determine at least one pattern corresponding to a substring of a password, the password including a string of characters, a substring comprising a portion of the string of characters, and for the at least one pattern, determining a total number of different substrings that can be generated from the at least one pattern;
identify one or more combinations of substrings, each combination of substrings including at least one non-overlapping substring that forms a combination string of characters identical to the string of characters included in the password;
determine, for each combination of substrings, a measure of entropy for the combination based at least in part on the total number of different substring combinations that can be generated from the at least one pattern; and
determine as a password strength measure for the password a lowest measure of entropy of the substring combinations.
12. The system of claim 11 , wherein the at least one processor is further configured to determine whether to accept the password based on the password strength measure.
13. The system of claim 11 , wherein the at least one processor is further configured to suggest at least one pattern to a user to strengthen the password.
14. The system of claim 11 , wherein at least one pattern comprises a dictionary word.
15. The system of claim 11 , wherein at least one pattern comprises a keyboard pattern.