Honeywords

Honeywords are false passwords associated with each user account. Using a honeyword to login sets off an alarm as a data breach has been detected. Existing approaches for detecting data breaches using honeywords suffer from the need of a trusted component to tell honey-words from the valid password. In this paper, we present Lethe, a honeywords-based data-breach detection system that requires no trusted component, other than a trusted bootstrap, and keeps limited transient state for verifying login attempts. Lethe is based on two fundamental principles. First, Lethe generates honeywords using a Machine Learning (ML) model, which constantly evolves. This means that an attacker that compromises the Honeyword Generation Technique (HGT) cannot reproduce the same set of honeywords, and thus cannot tell which password was used as the initial generator. Second, Lethe is not aware of the valid password. Lethe is the first system that allows an attacker to fully compromise the HGT without affecting the security of already generated honeywords.

Honeywords are applied by integrating them into the authentication layer of applications. The implementation involves three key steps: first, the Honeyword Generation Technique (HGT) creates a set of false passwords for each user; second, these Honeywords are stored alongside or within the user profile in the database; third, the application's login logic is programmed to trigger an alert whenever a Honeyword is used for authentication. This allows enterprises to detect data breaches in real-time even without a trusted component. For example, a company using Lethe could be alerted within seconds of an attacker using a leaked Honeyword, enabling them to reset credentials and notify authorities before significant damage occurs. This directly supports the requirements of GDPR Article 33 and Taiwan's Personal Data Protection Act Article 27 regarding timely breach-related measures.

Taiwan enterprises face three primary challenges: technical integration, false positive management, and regulatory interpretation. Many legacy systems in Taiwan's manufacturing and finance sectors cannot easily be modified to support Honeywords, so the solution is to implement a-sidecar or API-gateway-based authentication layer. Secondly, the risk of legitimate users accidentally using a Honeyword must be managed through clear-turnover policies and user-friendly-interfaces. Finally, since Honeywords is a relatively new concept in the eyes of Taiwan's regulators, enterprises must be able to justify the technology's use during audits. The best way to overcome this is to map Honeywords implementation directly to ISO/IEC 27701 controls and NIST cybersecurity frameworks, providing a clear compliance narrative for auditors and regulators.

Winners Consulting Services Co., Ltd. specializes in Honeywords for Taiwan enterprises, delivering compliant management systems within 90 days. Free consultation: https://winners.com.tw/contact