A Penalty-Based Entropy Driven Universal Password Strength for Lightweight Devices

In real-life applications, many systems such as email, social websites and some financial organizations, use the password-based approach for user authentication. Thus, password strength plays a vital role in protecting sensitive information of users from potential security breaches. The most important metrics to measure password strength includes minimum length, randomness, and not easily guessable patterns. The conventional entropy-based approach measures the uncertainty, but it will not consider the pattern-based approaches that are easily guessable. Instead, some approaches provided the improved versions by maintaining the list of common guessable patterns such as keyboard patterns and sequential/repeated patterns. Recently Machine Learning (ML) models are also being used for password strength measurement. However, ML models are dataset specific and might fail to measure the strength of user chosen passwords, because it may be language or location specific. Hence, in this paper, we propose an efficient penalty-based entropy driven universal approach for assessing password strength. In order to analyze our approach, we use the Password Strength Classifier Dataset that contains three classes namely weak, moderate and strong passwords. Our approach achieves an accuracy of 99.94% which is comparatively more than the existing approaches. In addition, the proposed approach is not language/location specific, lightweight and universally implementable, making it more suitable for resource constrained client devices.