Microsoft Technology Licensing, LLC

Jingjing Zhang

Pui-Yin Winfred Wong

Mark A Nikiel

Daniel E Castro

Andrew Numainville

Rohini Goyal

Hardy Wijaya

William Jacob Goldenberg

Lee Reed Burton

Hongyu Sun

Embodiments detect identity attacks by comparing usage of compromised passphrases or other weak credentials in failed sign-in attempts to access restriction conditions. A restriction threshold amount of weak credential failed sign-ins (WCFSI) or a WCFSI increase indicates an identity attack, such as a password spray attack. Going beyond the mere number of failed sign-ins by also considering credential strength allows embodiments to detect attacks sooner than other approaches. An embodiment may also initiate or impose defenses by locking accounts, blocking IP addresses, or requiring additional authentication before access to an account is allowed. Weak credentials may include short passwords, simple passwords, compromised passwords, or wrong usernames, for instance. Password strength testing may be used for attack detection in addition to preventive use on passwords proposed by authorized users. Familiar and unfamiliar traffic source locations may be tracked, as sets or individually.

Identity attack detection and blocking

Knowledge associated with an address of a first IP type may be mapped to an address of a second IP type. In response to receiving, at a first IP endpoint type, a request from a client associated with a first and second IP address type, a first address of the first IP type associated with the client is recorded. A unique identification of the request is generated. The unique identifier and instructions to make a second request to a second IP endpoint type are sent to the client. The second request, that includes the unique identifier and corresponds to the second IP address type associated with the client, is received at the second endpoint. Both the first address and the second address are determined as corresponding to the client by determining that the unique identifier was used in both requests. The first address is mapped to the second address.

Mapping IPv4 knowledge to IPv6

Growing community of inventors

Sammamish, WA, United States of America

Jingjing Zhang