IP Library Granted Patent US 11,693,949
Granted Patent B2
US 11,693,949 · App. 17/153,335 · Granted Jul 4, 2023

Password security warning system

Inventors: Reza Farivar (Champaign, IL); Anh Truong (Champaign, IL); Vincent Pham (Champaign, IL); Austin Grant Walters (Savoy, IL); Galen Rafferty (Mahomet, IL); Jeremy Edward Goodsitt (Champaign, IL)
Assignee: Capital One Services, LLC
G06F21/46G06N3/04G06N3/08
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,693,949
App. No.
17/153,335
Granted
Jul 4, 2023
Kind
B2
Abstract

Various embodiments are directed to a password security warning system. An artificial neural network or other types of models may be used to determine whether a password that is created, input, or proposed by a user via an interface includes one or more predictable or typical transformations or combinations of characters derived from user-specific information. Based on the determination, a warning may be provided to the user.

Claims (58)

1. An apparatus comprising:

at least one memory storing instructions;

one or more processors, operably coupled to the at least one memory, operable to execute the instructions that, when executed by the one or more processors, cause the one or more processors to:

determine one or more patterns associated with combinations of at least: first personal information and second personal information different from the first personal information typical or predictable in weak passwords;

determine a user-specific pattern of passwords specific to a user, the user-specific pattern not general to a population of users;

train a neural network based at least in part on: a plurality of typical or predictable password transformations comprising at least one replacement of a letter with an associated special character, the one or more patterns of the combinations of at least the first and second personal information, the user-specific pattern, and a plurality of blacklisted passwords, the trained neural network configured to output a plurality of possible password strings unique to the user in response to user-specific information associated with the user provided to the neural network;

receive a password created by the user;

determine whether the password matches at least one possible password string of the plurality of possible password strings based on a threshold match; and

provide a warning that the password is unsafe or insecure in response to the password matching the at least one possible password string.

2. The apparatus of claim 1 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:

receive user-specific information associated with the user;

provide the received user-specific information to the neural network, and

wherein the neural network is trained using the provided user-specific information.

3. The apparatus of claim 2 , wherein the plurality of possible password strings output by the neural network comprises at least one or more typical or predictable transformations of the user-specific information and one or more typical or predictable combinations of the user-specific information.

4. The apparatus of claim 2 , wherein the user-specific information is provided by the user and comprises one or more of the following: a legal first name, a legal middle name, a legal last name, a nickname, a date of birth, a social security number, a home address, a work address, a telephone number, spousal information, and/or a maiden name.

5. The apparatus of claim 1 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:

perform an Internet search on the user and provide one or more results of the Internet search to the neural network,

wherein the one or more results of the Internet search comprises information associated with user from a social media account, a professional networking profile, a professional profile webpage, a blog, an online dating profile, a public article, and/or an image, and

wherein the one or more results of the Internet search comprises one or more of the following: a pet name, a hobby, information related to a profession, a high school, a college or university, a graduate school, and/or a favorite vacation destination.

6. The apparatus of claim 1 , wherein the plurality of typical or predictable password transformations comprises one or more of the following: combination of two or more character strings, formatting at least one character in the character string differently, and/or arranging the two or more character strings in a sequence.

7. The apparatus of claim 1 , wherein the user-specific pattern is determined based on an identification of a specific pattern used in previous passwords of the user.

8. The apparatus of claim 1 , the instructions, when executed by the one or more processors, further cause the one or more processors to:

receive at least one compromised password determined to have been cracked or compromised; and

add the at least one compromised password to the plurality of blacklisted passwords for updating the training of the neural network to include cracked and compromised passwords.

9. A method comprising:

determining, via one or more processors, one or more patterns associated with combinations of at least: first personal information and second personal information different from the first personal information typical or predictable in weak passwords;

determining a user-specific pattern of passwords specific to a user, the user-specific pattern not general to a population of users;

training, via the one or more processors, a neural network based at least in part on: a plurality of typical or predictable password transformations comprising at least one replacement of a letter with an associated special character, the one or more patterns of the combinations of at least the first and second personal information, the user-specific pattern, and a plurality of blacklisted passwords, the trained neural network configured to output a plurality of possible password strings unique to the user in response to user-specific information associated with the user provided to the neural network;

receiving a password created by the user;

determining, via the one or more processors, whether the password matches at least one possible password string of the plurality of possible password strings based on a threshold match; and

providing a warning that the password is unsafe or insecure in response to the password matching the at least one possible password string.

10. The method of claim 9 , further comprising:

receiving user-specific information associated with the user;

providing the received user-specific information to the neural network, and

wherein the neural network is trained using the provided user-specific information.

11. The method of claim 10 , wherein the user-specific information is provided by the user and comprises one or more of the following: a legal first name, a legal middle name, a legal last name, a nickname, a date of birth, a social security number, a home address, a work address, a telephone number, spousal information, and/or a maiden name.

12. The method of claim 9 , wherein the plurality of typical or predictable password transformations comprises one or more of the following: combination of two or more character strings, formatting at least one character in the character string differently, and/or arranging the two or more character strings in a sequence.

13. The method of claim 9 , wherein the user-specific pattern is determined based on an identification of a specific pattern used in previous passwords of the user.

14. The method of claim 9 , further comprising:

receiving at least one compromised password determined to have been cracked or compromised; and

adding the at least one compromised password to the plurality of blacklisted passwords for updating the training of the neural network to include cracked and compromised passwords.

15. At least one non-transitory computer-readable storage medium storing program code executable by at least one processor to:

determine one or more patterns associated with combinations of at least: first personal information and second personal information different from the first personal information typical or predictable in weak passwords;

determine a user-specific pattern of passwords specific to a user, the user-specific pattern not general to a population of users;

train a neural network based at least in part on: a plurality of typical or predictable password transformations comprising at least one replacement of a letter with an associated special character, the one or more patterns of the combinations of at least the first and second personal information, the user-specific pattern, and a plurality of blacklisted passwords, the trained neural network configured to output a plurality of possible password strings unique to the user in response to user-specific information associated with the user provided to the neural network;

receive a password created by the user;

determine whether the password matches at least one possible password string of the plurality of possible password strings based on a threshold match; and

provide a warning that the password is unsafe or insecure in response to the password matching the at least one possible password string.

16. The at least one non-transitory computer-readable storage medium of claim 15 , wherein the stored program code causes the at least one processor to:

receive user-specific information associated with the user;

provide the received user-specific information to the neural network, and

wherein the neural network is trained using the provided user-specific information.

17. The at least one non-transitory computer-readable storage medium of claim 16 , wherein the user-specific information is provided by the user and comprises one or more of the following: a legal first name, a legal middle name, a legal last name, a nickname, a date of birth, a social security number, a home address, a work address, a telephone number, spousal information, and/or a maiden name.

18. The at least one non-transitory computer-readable storage medium of claim 15 , wherein the plurality of typical or predictable password transformations comprises one or more of the following: combination of two or more character strings, formatting at least one character in the character string differently, and/or arranging the two or more character strings in a sequence.

19. The at least one non-transitory computer-readable storage medium of claim 15 , wherein the user-specific pattern is determined based on an identification of a specific pattern used in previous passwords of the user.

20. The at least one non-transitory computer-readable storage medium of claim 15 , wherein the stored program code causes the at least one processor to:

receive at least one compromised password determined to have been cracked or compromised; and

add the at least one compromised password to the plurality of blacklisted passwords for updating the training of the neural network to include cracked and compromised passwords.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 20, 2021
From: FARIVAR, REZA; TRUONG, ANH; PHAM, VINCENT; WALTERS, AUSTIN GRANT; RAFFERTY, GALEN; GOODSITT, JEREMY EDWARD
To: CAPITAL ONE SERVICES, LLC
Reel/Frame 054970/0508 →
Continuity (2)
Continuation 16549391 · Aug 23, 2019
Related Publication 20210182378A1 · Jun 17, 2021