Power of Union: Federated Honey Password Vaults against Differential Attack

The honey password vault is a promising method for managing user passwords and mitigating
password-guessing attacks by creating plausible-looking decoy password vaults. Recently, various
methods, such as Chatterjee-PCFG (IEEE S&P’15), Golla-Markov (ACM CCS’16), and Cheng-IUV
(USENIX Security’21), have been proposed to construct the cornerstone of honey password vaults,
known as the distribution transforming encoder (DTE). These innovations significantly enhance the
security and functionality of each kind of DTE. However, our findings indicate that when users employ
multiple honey password vaults of distinct DTEs to manage their passwords, a passive attacker can
easily compromise user passwords by exploiting differences among those DTEs. Consequently, we
propose the differential attack targeting existing honey password vaults. The extensive experimental
results confirm the effectiveness of this attack, distinguishing real from decoy password vaults with
accuracy from 99.13% to 100.00%. In response, we design a novel, collaborative approach to train
DTE, called federated DTE model, and construct a secure honey password vault. This strategy
markedly bolsters security, reducing the differential attack’s distinguishing accuracy to approximately
52.41%, nearing the ideal threshold of 50.00%. Our findings emphasize the need for collaborative
strategies to maintain password security to combat advanced cyber threats.