# Password Guessability as a Service (PGaaS)
## 6 Conclusions and Future Works  
This paper presents a micro-service architecture that can offer an adaptable password strength estimator through a Security as a Service model. The interested reader may browse the source code of its implementation on Github [69]. The architecture as depicted adapts to today's requirements for cloud-based applications in terms of how scalable, heterogeneous and modular they should be. Thus, this is the first password security level validation offered as a cloud-based service to benefit from all the features and goals expected for cloud applications. The model of offering an application as a service is becoming very popular among cloud-based applications because it allows clients to use or pay for precisely the amount of service required each month, which adapts usage and payments according to what is necessary.  
The proposal uses frequently updated datasets as input to the password validation tool to better reflect tendencies in password creation, contrary to what password strength estimators usually use. Training models on large datasets might not be possible on resource-constrained devices. For example, on IoT networks, devices rely on edge computing layers. These layers are composed of resource-constrained computers. Those devices running on this layer might need to train and update trained models with a particular frequency. The security-as-a-service model allows these devices to request parameters from the database service, which will run on a dynamically updated dataset. Thanks to the dynamic dataset, an adaptable password strength estimator is produced, which architects could quickly tailor to different languages as needed. The literature has shown the importance of adapting estimators to how different users from different populations create passwords, whether because of language or demographics.  
In terms of future works, we plan to evaluate the architecture on different cloud computing configurations to measure how the platform could influence the tool's performance. This evaluation also includes escalating the architecture to a cluster deployment, where different orchestration systems might influence future architecture design changes. The purpose of these future evaluations is to test the architecture as the deployment escalates to a distributed fashion to address a possible exponential increase in user requests.  
Another future work is to engineer the guessability component to perform its computations privately in the cloud. We plan to research how to design and build this component to be privacy preserving, and how to make it secure in the semi-honest model by employing cryptographic techniques, such as homomorphic encryption techniques or secure multiparty computation techniques.  
Conceptualization, R.V.-P. and M.J.; methodology, R.V.-P.; software, J.B., D.D. and G.M.; validation, R.V.-P.; formal analysis, R.V.-P.; investigation, R.V.-P., M.J., J.B., D.D. and G.M.; resources, G.M.; data curation, D.D.; writing--original draft preparation, J.B. and G.M.; writing--review and editing, R.V.-P. and M.J. All authors have read and agreed to the published version of the manuscript.  
The APC was funded by Universidad del Norte.  
Data Availability Statement:Publicly available datasets were used and analyzed in this study. This data can be found here [67].