PATENT DOCUMENT

Publication Number: US-8108685-B2
Application Number: US-94082607-A
Country: US
Kind Code: B2

Title: Apparatus and method for indicating password quality and variety

Abstract:
A method of presenting password information to a user, the method comprising: receiving a password; determining the number of unique character sets utilized in the password; and displaying the number of unique character sets that are contained within the password.

Claims:
1. A method for displaying information about password quality to a user as the user is entering a password, comprising:
 receiving a substring of the password which includes one or more characters of the password that have been received from the user; 
 dynamically determining a quality of the substring of the password as the characters are being received, wherein the quality of the substring of the password is a measure of the susceptibility of the substring of the password to being cracked; and 
 dynamically updating a quality meter being displayed to the user, wherein the quality meter displays the quality of the substring of the password as the characters are being received from the user so that the user can dynamically improve the quality of the substring of the password as the user is entering characters for the password; 
 wherein determining the quality of the substring involves determining sz N  to determine a number of passwords which can be formed using up to N characters and using a character set with size sz, wherein sz is a number of characters in a character set for the substring, and N is a length of the substring. 
 
     
     
       2. The method of  claim 1 , wherein if the quality of the substring of the password increases after receiving a given character, dynamically updating the quality meter involves increasing a length of a progress bar in the quality meter. 
     
     
       3. The method of  claim 1 , wherein if the quality of the substring of the password decreases after receiving a given character, dynamically updating the quality meter involves decreasing a length of a progress bar in the quality meter. 
     
     
       4. The method of  claim 1 , wherein dynamically updating the quality meter involves dynamically updating a color of the quality meter based on the quality of the substring of the password being received, wherein the color of the quality meter indicates the quality of the substring of the password being received. 
     
     
       5. The method of  claim 1 , wherein if the quality of the substring of the password is below a minimum allowed quality level, the method further comprises indicating to the user that the quality of the substring of the password is below the minimum allowed quality level. 
     
     
       6. The method of  claim 1 , wherein if the quality of the substring of the password is equal to a minimum allowed quality level, the method further comprises indicating to the user that the quality of the substring of the password is equal to the minimum allowed quality level. 
     
     
       7. The method of  claim 1 , wherein if the quality of the substring of the password is above a minimum allowed quality level, the method further comprises indicating to the user that the quality of the substring of the password is above the minimum allowed quality level. 
     
     
       8. The method of  claim 1 , wherein the quality of the substring of the password can be based on quality criteria which can include one or more of:
 a length of the substring of the password; 
 a variety of characters in the substring of the password; 
 a size of a character set used to form the substring of the password; 
 whether the substring of the password can be found in a dictionary; 
 whether the substring of the password is based on a user&#39;s name; and 
 whether the substring of the password is based on a login name for the user. 
 
     
     
       9. The method of  claim 1 , further comprising dynamically updating a text field being displayed to the user, wherein text within the text field provides information about the quality of the substring of the password being received. 
     
     
       10. The method of  claim 1 , wherein the password information is displayed on a change password screen which allows the user to change the password for the user. 
     
     
       11. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for displaying information about password quality to a user as the user is entering a password, comprising:
 receiving a substring of the password which includes one or more characters of the password that have been received from the user; 
 dynamically determining a quality of the substring of the password as the characters are being received, wherein the quality of the substring of the password is a measure of the susceptibility of the substring of the password to being cracked; and 
 dynamically updating a quality meter being displayed to the user, wherein the quality meter displays the quality of the substring of the password as the characters are being received from the user so that the user can dynamically improve the quality of the substring of the password as the user is entering characters for the password; 
 wherein determining the quality of the substring involves determining sz N  to determine a number of passwords which can be formed using up to N characters and using a character set with size sz, wherein sz is a number of characters in a character set for the substring, and N is a length of the substring. 
 
     
     
       12. The computer-readable storage medium of  claim 11 , wherein if the quality of the substring of the password increases after receiving a given character, dynamically updating the quality meter involves increasing a length of a progress bar in the quality meter. 
     
     
       13. The computer-readable storage medium of  claim 11 , wherein if the quality of the substring of the password decreases after receiving a given character, dynamically updating the quality meter involves decreasing a length of a progress bar in the quality meter. 
     
     
       14. The computer-readable storage medium of  claim 11 , wherein dynamically updating the quality meter involves dynamically updating a color of the quality meter based on the quality of the substring of the password being received, wherein the color of the quality meter indicates the quality of the substring of the password being received. 
     
     
       15. The computer-readable storage medium of  claim 11 , wherein if the quality of the substring of the password is below a minimum allowed quality level, the method further comprises indicating to the user that the quality of the substring of the password is below the minimum allowed quality level. 
     
     
       16. The computer-readable storage medium of  claim 11 , wherein if the quality of the substring of the password is equal to a minimum allowed quality level, the method further comprises indicating to the user that the quality of the substring of the password is equal to the minimum allowed quality level. 
     
     
       17. The computer-readable storage medium of  claim 11 , wherein if the quality of the substring of the password is above a minimum allowed quality level, the method further comprises indicating to the user that the quality of the substring of the password is above the minimum allowed quality level. 
     
     
       18. The computer-readable storage medium of  claim 11 , wherein the quality of the substring of the password can be based on quality criteria which can include one or more of:
 a length of the substring of the password; 
 a variety of characters in the substring of the password; 
 a size of a character set used to form the substring of the password; 
 whether the substring of the password can be found in a dictionary; 
 whether the substring of the password is based on a user&#39;s name; and 
 whether the substring of the password is based on a login name for the user. 
 
     
     
       19. The computer-readable storage medium of  claim 11 , further comprising dynamically updating a text field being displayed to the user, wherein text within the text field provides information about the quality of the substring of the password being received. 
     
     
       20. The computer-readable storage medium of  claim 11 , wherein the password information is displayed on a change password screen which allows the user to change the password for the user. 
     
     
       21. An apparatus that displays information about password quality to a user as the user is entering a password, comprising:
 a password-entry mechanism configured to receive a substring of the password which includes one or more characters of the password that have been received from the user; 
 a quality-determination mechanism configured to dynamically determine a quality of the substring of the password as the characters are being received, wherein the quality of the substring of the password is a measure of the susceptibility the substring of the password to being cracked; and 
 a display mechanism configured to dynamically update a quality meter being displayed to the user, wherein the quality meter displays the quality of the substring of the password as the characters are being received from the user so that the user can dynamically improve the quality of the substring of the password as the user is entering characters for the password; 
 wherein determining the quality of the substring involves determining sz N  to determine a number of passwords which can be formed using up to N characters and using a character set with size sz, wherein sz is a number of characters in a character set for the substring, and N is a length of the substring.

Description:
RELATED APPLICATION 
     This application is a continuation of a pending U.S. patent application, entitled “APPARATUS AND METHOD FOR INDICATING PASSWORD QUALITY AND VARIETY,” by inventors John C. Hurley, having Ser. No. 10/421,563 and a filing date of 23 Apr. 2003. This application hereby claims priority under 35 U.S.C. §120 to the above-listed patent application. Moreover, the above-listed application is hereby incorporated by reference. 
    
    
     1. FIELD OF THE INVENTION 
     The present invention generally relates to apparatuses and methods for indicating the quality and variety of a password used for computer system authentication. 
     2. BACKGROUND 
     Several techniques for protecting the data in computer systems have been utilized. The most common technique is to prevent unauthorized user access by providing authentication and access control through the use of a password. A password typically consists of a sequence of letters, numbers, and/or special characters. Passwords are often used to verify the identity of a user before granting access to computer systems, web pages, e-mail, files, or software programs. 
     Unfortunately, users frequently choose words that are familiar to them as their password. Thus, these easily detected passwords can compromise the security of a computer system. High speed communications, increased network capabilities and high performance processors can enable a “cracker” program, a computer program used for breaking security on a computer system, to quickly determine a user&#39;s password. As a result, software programs that incorporate proactive password checkers, such as Microsoft&#39;s Passport, Mozilla&#39;s Personal Security Manager, John the Ripper and Pretty Good Privacy (PGP), have been developed to predetermine whether a user&#39;s proposed password will be vulnerable to cracking. Some of the methods used by proactive password checkers to determine a password&#39;s susceptibility to cracking include verifying if the password exists in a dictionary, checking the length of the password, and comparing the password to a permutation of the letters in the user&#39;s name. 
     As is well known, PGP uses public-key cryptography to encrypt and decrypt e-mails and files in order to prevent unauthorized access. Public-key cryptography uses two keys, a private key and a public key, for encrypting and decrypting data. When creating a private key, a password specified by the user is assigned to protect the key. An example of a “New Key” screen is shown in  FIG. 1 . The user can enter a password for the private key in the field  101 . As each character is entered, the “Passphrase Quality” meter  102  proactively indicates to the user the level of quality of the password. However, PGP does not indicate to the user why the quality of their proposed password is high or low. In addition, PGP does not indicate to the user how to improve the quality of their proposed password without increasing the length of the password. 
     Examples such as these show that a need exists for an apparatus and a method to indicate to the user how to improve the quality a password. 
     3. SUMMARY OF THE INVENTION 
     One embodiment of the invention is a method of presenting password information to a user, the method including: receiving a password; determining the number of unique character sets utilized in the password; and displaying the number of unique character sets that are contained within the password. In some embodiments of the invention, the number of unique character sets is displayed as the user enters his password. In other embodiments of the invention, the number of unique character sets is displayed after the user has completely entered his password. 
     Another embodiment of the invention is a method of presenting password information to a user, the method including: receiving a password; identifying each unique character set utilized in the password; determining the total number of characters included in the identified character sets; and displaying the total number of characters to a user. In some embodiments of the invention, the total number of characters is displayed as the user enters his password. In other embodiments of the invention, the total number of characters is displayed after the user has completely entered his password. 
     Another embodiment of the invention is a program storage device containing instructions that when executed by a computer perform the following acts: receiving a password; determining the number of unique character sets utilized in the password; and displaying the number of unique character sets that are contained within the password. 
     Yet another embodiment of the invention is a program storage device containing instructions that when executed by a computer perform the following acts: receiving a password; identifying each unique character set utilized in the password; determining the total number of characters included in the identified character sets; and displaying the total number of characters to a user. 
    
    
     
       4. BRIEF DESCRIPTION OF THE FIGURES 
         FIG. 1  presents a (prior art) New Key screen. 
         FIG. 2  presents a Change Password screen. 
         FIG. 3  presents another Change Password screen. 
         FIG. 4  presents a flow chart of one embodiment of the invention 
         FIG. 5  presents a flow chart of another embodiment of the invention. 
         FIG. 6  presents a flow chart of still another embodiment of the invention. 
     
    
    
     5. DETAILED DESCRIPTION 
     The following description is presented to enable any person skilled in the art to make and use the invention, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present invention. Thus, the present invention is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein. 
     One embodiment of the invention is a computer program that allows a user to enter a password and then presents information to the user as each character is specified for the password. As discussed in detail below, the computer program can indicate to the user how to improve the quality of the entered password. 
     5.1 DISPLAYING THE CHANGE PASSWORD SCREEN 
     In one embodiment of the invention, a computer program could display a “Change Password” screen  200  such as shown in  FIG. 2 . The Change Password screen  200  could allow the user to add or change a password that grants access to a computer system, web page, e-mail, file, software program, or any other computer resource. 
     The Change Password screen  200  may contain a field  201  for entering or selecting a user, a field  202  for entering the user&#39;s original password and a field  203  for entering the user&#39;s new password. In some embodiments of the invention, the Change Password screen  200  may include a field to verify the user&#39;s new password or may include a field to create the user&#39;s original password. 
     The Change Password screen  200  may include a Password Assistant icon  204 . If the user selects the Password Assistant icon  204 , then the computer program could display on the Change Password screen  200  information to the user regarding how to improve the quality and/or variety of the password specified. In some embodiments of the invention, if the user selects the Password Assistant icon  204 , the computer program could either hide or display the information located between line  214  and line  215 . In other embodiments of the invention, if the user selects the Password Assistant icon  204 , then the computer program could display a separate screen or computer program providing information to the user regarding how to improve the quality and/or variety of the password specified. 
     5.2 DISPLAYING PASSWORD ASSISTANT INFORMATION 
     In some embodiments of the invention, the computer program could display information to the user regarding the length of the new password. As the user enters the new password in field  203 , the computer program could update the current length text field  205  to indicate the length of the new password. In addition, the computer program could display the minimum length required for a password in the minimum length text field  206 . In addition, the computer program could display the maximum length allowed for a password in the maximum length text field  207 . The minimum and maximum lengths could be specified by the computer program, by external parameters available to the computer program or by other methods known in the art. 
     In some embodiments of the invention, the computer program could display information to the user regarding how to improve the quality of the password. The computer program could display a Quality meter  208 . As each character for the new password is entered in field  203 , the Quality meter  208  could indicate to the user the quality of the password. As the quality of the password increases, the progress bar on the Quality meter  208  could correspondingly increase in length. In addition, the computer program could display the quality of the password in the Quality text field  209 . 
     Several methods can be utilized to calculate the quality of the password. In some embodiments of the invention, the quality of the password is determined by the length of the password and the size of the character set used to form the password. The quality of the password could be calculated as follows:
 
Quality of password=5*log 10 (number of passwords(length of password))
 
where the number of passwords for length N and character set size sz is calculated as:
 
number of passwords ( N )=( sz   N   +sz   (N-1)   + . . . +sz ).
 
Using this formula, the quality calculated for a four character password composed of characters from the full printable 8 bit character set (223 characters) is roughly equivalent to the quality calculated for a seven character password composed of only lower case letters. Thus, a significant improvement in password quality can be obtained by increasing the size of the character set from which the password characters are chosen.
 
     In some embodiments of the invention, the computer program could display information to the user regarding how to improve the variety of the password. The computer program could indicate to the user the number of unique character sets that is contained within the password. A password can consist of a sequence of letters, numbers, and special characters. Character sets for a password can consist of lower case letters [a . . . z], upper case letters [A . . . Z], digits [0 . . . 9], punctuation marks [! . . . ˜] or other 8 bit printable characters. In some embodiments of the invention, the computer program could display a Variety circle  210  that contains a wedge for each unique character set utilized within the password. Each wedge in the Variety circle  210  could be displayed with a distinct fill pattern using color, grids, graphical images, or a combination of these fill patterns. In some embodiments of the invention, the size of the wedge could indicate the total number of unique characters in the character set. In such embodiments, the computer program could calculate the total number of characters available when specifying a password. Then, the computer program could display a Variety circle  210  containing a wedge for each unique character set sized in proportion to the total number of characters available. 
     In some embodiments of the invention, the computer program could display a Variety text field  211  that indicates the total number of characters included in the character sets contained within the password. For example, a password containing at least one lower case letter [a . . . z] out of 26 possible values, at least one upper case letter [A . . . Z] out of 26 possible values, at least one punctuation mark [! . . . ˜] out of 33 possible values, at least one digit [0.9] out of 10 possible values, and at least one non-Latin upper case letter out of 34 possible values could display a value of “129” (26+26+33+10+34) in the Variety text field  211 . Other character sets could include non-Latin lower case letters and symbols. 
     In some embodiments of the invention, the computer program could display information to the user regarding why a password does not meet specific quality criteria. The quality criteria could be specified by the computer program, by external parameters available to the computer program or by other methods known in the art. For example, the computer program could display the information in a Message text field  212 . Thus, if the password entered in field  203  is shorter in length than the minimum length criteria, then a message could be displayed to the user indicating such. Similarly, if the quality of the password entered in field  203  is lower than the minimum quality criteria, then another message could be displayed to the user indicating such. In addition, if the variety of the password entered in field  203  is lower than the minimum variety criteria, then another message could be displayed to the user indicating such. In other embodiments of the invention, the computer program could utilize other password strength checkers, such as cracklib, to determine the quality of the password and then display the resulting messages from the password strength checker in a Message text field  212 . 
     In some embodiments of the invention, the computer program could validate whether the password exists or is similar to a word located in a dictionary. If the password entered in field  203  is a dictionary word or similar to a dictionary word, then a message could be displayed in the Message text field  212  indicating such. In other embodiments of the invention, the computer program could validate whether the password is a permutation of the letters in the user&#39;s name. If the password entered in field  203  is a permutation of the letters in the user&#39;s name, then a message could be displayed in the Message text field  212  indicating such. 
     In still other embodiments of the invention, the computer program could include a Character Set icon  213 . If the user selects the Character Set icon  213 , then the computer program could display character sets that can be used to improve the quality of a password. For example, character sets that are utilized in a password could be displayed in one color while unused character sets could be displayed in another color. Alternatively, only unused character sets could be displayed. 
     In still other embodiments of the invention, the computer program could display a “Change Password” screen  300  such as shown in  FIG. 3 . The Change Password screen  300  is similar to the Change Password screen  200  except that the Change Password screen  300  includes information for the user regarding the minimum allowed quality for a password. The computer program could display a Quality meter  308  and a Minimum Allowed Quality Mark  316 . As each character for the new password is entered in field  303 , the Quality meter  308  could indicate to the user the quality of the password. As the quality of the password increases, the progress bar on the Quality meter  308  could correspondingly increase in length and indicate whether it is below, equal, or above the Minimum Allowed Quality Mark  316  for a password. The minimum allowed quality could be specified by the computer program, by external parameters available to the computer program or by other methods known in the art. 
     5.3 CONCLUSION 
     The foregoing descriptions of embodiments of the present invention have been presented for purposes of illustration and description only. They are not intended to be exhaustive or to limit the present invention to the forms disclosed. Accordingly, many modifications and variations will be apparent to practitioners skilled in the art. For example, one embodiment of the invention is shown in  FIG. 4 . Another embodiment of the invention is shown in  FIG. 5 . Still another embodiment of the invention is shown in  FIG. 6 . Other embodiments of the invention would include program storage devices containing instructions that when executed by a computer, perform all or portions of the methods discussed above. Examples of such program storage devices include random access memory, read only memory, hard disk drives, CDs, DVDs, floppy disks, and similar devices. Additionally, the above disclosure is not intended to limit the present invention. The scope of the present invention is defined by the appended claims.

Metadata:
Filing Date: 20071115
Publication Date: 20120131
Grant Date: 20120131
Priority Date: 20030423
Inventors: HURLEY JOHN C.
Assignee: APPLE INC
CPC Classifications: [{"code": "G06F21/46", "inventive": true, "first": true, "tree": "[]"}, {"code": "G06F21/46", "inventive": true, "first": true, "tree": "[]"}]
Family ID: 33489262