A method, a system and a computer program for monitoring security threats in an access control system

Abstract

Disclosed is a method for monitoring security threats in an access control system (100, 200). The method comprises receiving authentication attempts from one or more remote clients (102, 202) at a first authentication server (104); providing a remote client score for the one or more remote clients (102, 202); scoring periodically per a predefined time period Tp, by a controller 108 associated with the first authentication server (104), the received authentication attempts made by each remote client of the one or more remote clients (102, 202), based on the type of the authentication attempts; adjusting the remote client score periodically based on the scored authentication attempts by the controller (108); and marking the remote client as malicious (414) by the controller (108) if the adjusted score exceeds a first predefined threshold value (408).

Description

[0001] A METHOD, A SYSTEM AND A COMPUTER. PROGRAM FOR MONITORING SECU ITY THREATS IN AN ACCESS CONTROL SYSTEM

[0002] TECHNICAL FIELD

[0003] The present disclosure relates to the field of cybersecurity, particularly focusing on methods for enhancing the security of access control systems. It involves monitoring security threats in an access control system by employing a secondary authentication server.

[0004] BACKGROUND

[0005] In the field of services available over the internet requiring authentication, ensuring both secure and efficient access control is of critical importance. The evolution of cybersecurity threats and the increasing sophistication of attack methodologies necessitate robust measures to address unauthorised access attempts and enhancement of client security. As the demand for secure connectivity continues to grow, the importance of effectively managing and mitigating these unauthorised access requests has become increasingly critical.

[0006] Typically, authentication services are targeted by automated systems that generate a substantial volume of access requests using false credentials, for example, usernames and passwords. These break-in attempts not only impose considerable load on access management systems but also elevate the risk of successful unauthorised access. Therefore, there is a need for comprehensive information regarding the patterns and frequencies of these break-in attempts. Possessing access to this information allows authentication service providers to make well-informed decisions, ensuring efficient network planning.

[0007] However, current solutions are missing an effective way to mitigate break-in risks and prevent attackers from noticing the attempt being detected. A simple approach to this problem is to deny all access requests after a predefined limit is reached, such as 100 failures per minute. However, this simple method only allows the attackers to finetune their attempts to remain just below the threshold.

[0008] Therefore, in light of the foregoing discussion, there is a need to overcome the aforementioned limitations to enhance the security and efficiency of authentication services against unauthorised access and malicious activities.

[0009] SUMMARY

[0010] The aim of the present disclosure is to provide a method, a system, and a computer program for monitoring security threats in an access control system. This is achieved by the method, the system, and the computer program as defined in the appended independent claims. Advantageous features are set out in the appended dependent claims.

[0011] The embodiments of the present disclosure substantially enable to improve security in authentication services against unauthorised access and malicious activities.

[0012] Additional aspects, advantages, features and objects of the present disclosure would be made apparent from the drawings and the detailed description of the illustrative embodiments constructed in conjunction with the appended claims that follow.

[0013] BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The summary above, as well as the following detailed description of illustrative embodiments, is better understood when read in conjunction with the appended drawings. For the purpose of illustrating the present disclosure, exemplary constructions of the embodiments of the disclosure are shown in the drawings, with references to the following diagrams wherein: FIG. 1 is an illustration of an embodiment of an access control system wherein the access control system is an authentication system for monitoring security threats according to the present disclosure;

[0015] FIG. 2a is an illustration of an embodiment of an access control system wherein the access control system is a Virtual Private Network (VPN) system for monitoring security threats according to the present disclosure;

[0016] FIG. 2b is an illustration of another embodiment of an access control system wherein the access control system comprises a VPN concentrator;

[0017] FIG. 3 is a flowchart illustrating the depicting steps of a method for monitoring security threats in an access control system and

[0018] FIG. 4 is an illustration of a scoring mechanism for known good remote clients and unknown remote clients, implementing predefined threshold values configured to identify and mark the malicious remote clients based on their algorithmically derived scores.

[0019] DETAILED DESCRIPTION OF EMBODIMENTS

[0020] The following detailed description illustrates embodiments of the present disclosure and ways in which they can be implemented. The present disclosure provides a method, a system and a computer program for monitoring security threats in an access control system. The existing disclosure significantly improves the security of access control systems by reducing production system load, making Denial- of-Service (DoS) attacks, timeout exploits, bruteforce username and password authentication attacks and also more sophisticated attacks employing SQL (Structured Query Language) injection, special characters and other non-valid inputs attacks more difficult, and preventing the malicious clients getting access through the authentication servers by a lucky guess. For example, SQL injections can be detected by matching keywords of typical SQL commands from the one or more remote clients', further referred to as the remote client, requests, such as "SELECT'" and "SLEEP". Additionally, for example, shell special characters that are not used in real usernames include: Moreover, by classifying remote clients as malicious, the method prevents attackers from realising they have been detected and adjusting their future attacks to avoid detection. Furthermore, the method simplifies the analysis of the different attacks.

[0021] In a first aspect, the present disclosure provides a method for monitoring security threats in an access control system, the method comprises receiving, at a first authentication server, authentication attempts from one or more remote clients; providing a remote client scores for the one or more remote clients; scoring periodically per a predefined time period Tp, by a controller associated with the first authentication server, the received authentication attempts made by each remote client of the one or more remote clients, based on a type of the authentication attempts; adjusting by the controller the remote client scores periodically based on the scored authentication attempts and marking by the controller the remote client malicious, if the adjusted score exceeds a first predefined threshold value.

[0022] The access control system for processing authentication attempts from remote clients utilises the method in the present disclosure and its different embodiments are an authentication system, such as Remote Authentication Dial-In User Service (RADIUS), and a Virtual Private Network (VPN) system. The authentication attempts are initially forwarded to the first authentication server. A controller detects failed authentication attempts associated with a remote client's end-point identifier, typically Internet Protocol (IP) address or Mobile Station International Subscriber Directory Number (MSISDN), updates the remote client's score based on these attempts, and transfers the remote client's further attempts to a second authentication server, the Jail, if the remote client's score exceeds a first predefined threshold. When the remote client reaches the second predefined threshold value the client will be blocked from all network access to the specific service. Example of a remote client can be a laptop, desktop, a mobile terminal.

[0023] The second authentication server, the Jail, is a separate authentication server that mimics the first authentication server but never really processes the authentication request in any way, nor accepts authentications and has enhanced logging for analysing attack methods. User databases, directories and backend authentication systems are protected by not processing the request and by not forwarding any of the request data to them. The remote clients are scored according to the scoring mechanism based on the use of such techniques and the number of failed attempts, transferring high- scoring remote clients to the second authentication server, the Jail. This reduces production system load, lowers the risk of unauthorised access, avoids detection by attackers, and simplifies attack analysis. In the case of a VPN system, a VPN concentrator is an essential component. It performs frontend tasks, including, for example, interacting with remote clients and managing transport-level traffic following successful authentication. Remote clients transferred to the second authentication server, the Jail, can be released when their scores drop below a predefined limit.

[0024] Throughout the present disclosure, the term "first authentication server" refers to a server first reading the authentication request and deciding how to further process request. It has a real-life analogy to a Doorman who checks the customer's (end-user's) ID card (end-point identifier). After the check the first authentication server, the Doorman, decides where to forward the authentication request. That is, either to the Jail or to the real production system.

[0025] The real production system comprises of a frontend and multiple backends, that verify the identity of clients and systems attempting to access network resources or applications. It validates credentials, like usernames, and passwords, ensuring secure access control in environments such as enterprise networks, and cloud services. In the case of Virtual Private Network (VPN) services, front-end related tasks are done by the VPN concentrator or by an external authentication system in which case the VPN concentrator just blindly forwards all the request to the external system. The first authentication server, the Doorman, can be either the VPN contractor, or the external authentication system.

[0026] To authenticate the remote clients, the frontend queries the backend to determine the required authentication method. This determination is based on a combination of the client's credentials and the necessary VPN service. This query is typically done to user databases and directories. The authentication of the remote clients is then done with the selected access control system which there can be of wide variety. The credentials, and possibly other client's input, are then forwarded to the access control system which can perform further queries to other servers with the provided data, and in addition can return another query to be displayed to the remote clients, or contact for example the client's mobile app or Subscriber Identity Module (SIM) application. For example the requests and responses between the remote client the authentication systems can be done in Remote Authentication Dial-In User Service (RADIUS) format.

[0027] Throughout the present disclosure, the term "remote client score" refers to an algorithmically derived score that is used to detect malicious clients. The calculated score is attached to the remote client's end-point identifier, typically Internet Protocol (IP) address or Mobile Station International Subscriber Directory Number (MSISDN). The remote client scores may be stored in a remote client score database, Throughout the present disclosure, the term "controller" refers to a software component that monitors the authentication traffic either from the authentication server log files or in-line and maintains the scoring or the remote clients.

[0028] For example in a log file based approach, the remote client scores are calculated periodically per a predefined time period Tp, that could be for example once per one to three hours, by providing all the remote clients the remote client scores when they enter the system and adding to their remote client scores, for example, points in the range of 1-10 for each failed login attempt, 40-70 points for having a fragment of script in the username, and 5-20 points for using special characters in the username. The first predefined threshold value, for marking the remote clients malicious, could be in the range of 100-200 points. The first predefined threshold value is reached when the remote client's remote client score is equal or larger than the first predefined threshold value. Surpassing the first threshold efficiently Jails the remote client. Calculating the remote client scores can be adjusted to fit the needs of the specific service, for example according to the server's traffic profile to avoid marking clients malicious incorrectly.

[0029] The embodiment of the method according to the present disclosure helps effectively to mitigate unauthorised access attempts and enhance security without overloading the primary authentication server or alerting attackers to detection mechanisms.

[0030] According to the embodiments of the present disclosure, adjusting the remote client scores is one of increasing the score, decreasing the score or resetting the score. Adjustments made by the controller of the system are based on the type of received authentication requests. The remote client score is linked to the remote client's end-point identifier, typically IP address or MSISDN, and updated periodically by the controller of the system. For example the remote client scores can be adjusted by increasing the remote client scores in the range of 10-40 points for each failed login attempt with a username known to be used in dictionary attacks, like "admin" username, 50-90 points for having a fragment of script in username and 5-20 points for using special characters in username, decreased 1-10 points per hour and set to zero after a successful authentication. Score can be increased for example with multiples in the range of 5-10x if the client IP is from known malicious behaving IP range. Also high intensity of failed authentication attempts can be set to increase the score by a factor of 2-7. Authentication attempts are considered to be high intensity if there are detected for example over 100 attempts of authentication per minute to a specific service. Therefore the remote clients can move automatically over the predefined threshold values. Continuous failed authentication attempts done by the remote clients lead to higher remote client scores and to the time period restricting the remote clients access to the specific service being longer. Analogy to real-life is a repeated offence, when the Controller has learned that the remote client is attacking day after day, week after week, it can be Jailed for longer, though not for life as the remote client identifiers can be reassigned after some time. For example MSISDN can be reassigned to a new subscriber after it has been unused for some months.

[0031] The adjustment of remote client scores enhances threat detection by considering the type and frequency of authentication attempts, thereby reducing false positives and improving security. Increased scores for known malicious IPs or high-intensity attacks allow for timely and aggressive responses. Decreasing or resetting scores for legitimate behaviour maintains user satisfaction.

[0032] Optionally, the method further comprises restricting access of the remote client to a frontend of the access control system, the Doorman. When the remote client's score, related to the remote client's IP address or MSISDN, reaches the second predefined threshold value, which is sufficiently high enough, for example in the range of 100-300 points, access to the frontend, which interacts directly with the client and handles the client's transport-level traffic after authentication, is denied. This can be achieved for example through an automated firewall configuration.

[0033] Restricting access to the frontend when a remote client's score reaches a predefined threshold value enhances security by preventing potentially malicious clients from interacting with critical system components. Monitoring and evaluating client scores allows for realtime decision-making and immediate response to threats. This restriction mechanism reduces the risk of unauthorised access, protects sensitive resources, and maintains system integrity.

[0034] According to the embodiments, restricting the access may comprise transferring the remote client to a second authentication server, the Jail, for a predefined restriction time period Tr, wherein the second authentication server is configured to imitate the real production authentication service with no real processing of the request other than logging and rejecting it. The second authentication server, the Jail, refers to a separate server comprising of a frontend only, without any backend system accesses to break-into. Additionally, the redirection of the remote clients to the second authentication server, the Jail, could be implemented higher upstream in the authentication request handling. For example, already in VPN contractor which would in normal case forward the request to the first authentication system, the Doorman. In this scenario, the VPN contractor would be able to utilize the malicious remote client list maintained by the Controller. In essence the authentication requests would be forwarded by the VPN controller directly to the second authentication server, the Jail, without going through the Doorman. In this approach the second scoring threshold (DDoS like behaviour) could also be handled by the VPN concentrator. It would just drop or ignore the requests from the remote client.

[0035] Furthermore, the predefined restriction time period Tr, is determined by the rate of decreasing points, for example 1-3 points per hour, and predefined remote client score limit of providing access back to the first authentication server, for example in the range of 80-90 points. Also, the second authentication server maintains a score for each of the remote clients IPs. By maintaining score for each remote client's IPs, dynamically assigned IP addresses can be prevented to block any legitimate users in the future. This also applies to MSISDNs which could be reassigned after some months following the termination of the subscription.

[0036] Transferring the remote client to a second authentication server, the Jail, upon reaching a predefined threshold value enhances security by isolating potentially malicious clients. The second authentication server, the Jail, configured to imitate the first authentication server without actually processing requests, prevents attackers from impacting the critical infrastructure of the access control system and ensures that the malicious remote clients remain unaware of their detection. Redirection at various stages, such as the initial point of contact or further downstream, ensures flexible integration with existing infrastructure. Maintaining logs on the second authentication server enables analysis of attack patterns without disrupting legitimate traffic. Data analytics can be employed to identify new attack methods and patterns with the help of the logs collected from the malicious remote clients. This knowledge in turn can refined to new algorithms for the Controller to detect these new and possibly more advanced attacks.

[0037] An alternative embodiment of the backend may comprise a security proxy in the backend set up to handle redirection to the second authentication server, the Jail. The security proxy would maintain a local list or database of clients transferred to the second authentication server, allowing it to process attackers using an in-memory checklist without needing external queries. The alternative embodiment significantly reduces resource consumption, including CPU capacity, memory capacity, and logging capacity. By bypassing username queries to databases and directories with attacker-provided input, this proxy solution effectively shields these systems from potential attacks. Optionally, restricting the access comprises adjusting the predefined restriction time period, Tr, according to the behaviour of the remote client. The predefined restriction period, Tr, calculated for the remote clients based on their remote client scores. For example, the remote client scores can be set to decrease 1 point per hour. When the remote clients continue to perform failed authentication attempts can the score be adjusted by increasing the remote client scores. Predefined restriction time period Tr, can be adjusted by a multiplier, for example doubled, if the client has been transferred to the second authentication server in the last 30 days. In real-life term the remote client is considered as a repeated offender. Also, the scoring mechanism can be adjusted to fit the needs of the specific service, for example by changing the amount of points given from different kinds of authentication attempts. This adaptive scoring mechanism allows the system to tailor restrictions to the specific behaviour of each client, ensuring that persistent malicious activity results in longer restriction periods. Adjusting the scoring criteria to fit the needs of the specific service further enhances the system's flexibility and effectiveness in preventing unauthorised access while minimising disruptions for legitimate users.

[0038] Optionally, the method comprises implementing hard limits, when the adjusted score exceeds a second predefined threshold value. The second predefined threshold value is a larger number than the first predefined threshold value. For example, the first predefined threshold value could be 100-300 points and the second predefined threshold value could be 350-650 points. The scoring can be adjusted to fit the needs of the specific server. The already stated scoring can be used also to the remote clients when implementing hard limits.

[0039] Throughout the present disclosure, the term "hard limits" refers to the remote clients identified by IP address or MSISDN being blocked from the service access for a time specified by the authentication attempts made by the remote clients. For example, for regular authentication failures, the client can be blocked for a maximum of 24 hours. If special characters are used, the client can be, for example, blocked for up to 48 hours. In the case of script attacks, the client can be blocked, for example, for a maximum of 100 days.

[0040] Implementing hard limits when the adjusted score exceeds a second predefined threshold value further strengthens the system's security measures. Hard limits allow tailored responses, blocking clients from service access for specific periods based on the nature of their attempts. Also, they ensure that severe and repeated malicious behaviour is effectively mitigated, enhancing overall system security and protecting network resources from unauthorised access.

[0041] According to an embodiment, implementing hard limits may comprise increasing a restriction time. Furthermore, the one or more known good remote clients, for example clients of known VPN services and known office IP addresses, scoreboard will have a different handling adjusted to a specific server's needs. Adjusting of known good remote client scoreboard consists of altering the scoring mechanisms and changing or deleting the first predefined threshold value and the second predefined threshold value. Furthermore, the remote clients can be, for example, blocked initially for 24 hours for regular authentication failures and later on blocked again, for example, for 48 hours for using special characters in the username.

[0042] Implementing hard limits by increasing the restriction time enhances the system's ability to respond to persistent malicious behaviour. This adaptive approach allows for flexible and context-sensitive management of access restrictions, ensuring that both security and user experience are optimised.

[0043] According to another embodiment, implementing hard limits may comprise blocking an access of the remote client from all network access. When the remote clients reach the second predefined threshold value their requests of authentication are no longer directed to the second authentication server, the Jail, hence the remote clients are blocked from all network access. All network access can be denied, for example, by triggering the firewall to deny all traffic from the remote clients IP addresses or MSISDNs. Furthermore, a warning is sent to an administrator or cyber security specialists if a known good IP address or MSISDN source ranges gets blocked from all network access to the service. The warning is sent to an administrator, indicating that the known good client blocked access from all network access may be a result of a misbehaving access control system.

[0044] Implementing hard limits by blocking access of the remote client from all network access provides a robust security measure for dealing with highly persistent threats. To prevent disruption to legitimate users, a warning is sent to an administrator if a known good IP address or MSISDN source range is blocked, indicating a potential issue with the access control system. This ensures that legitimate access is quickly restored if blocked in error while maintaining strong protection against unauthorised access.

[0045] In a second aspect, the present disclosure provides a system for monitoring security threats in an access control system, the system comprises a first authentication server and a controller associated with the first authentication server.

[0046] The access control system refers to a system that is capable of processing the program instructions of the computer-implemented method. The access control system's different possible embodiments are an authentication system, such as Remote Authentication Dial-In User Service (RADIUS), and a VPN system.

[0047] The system provides real-time monitoring and dynamic response to authentication attempts. The inclusion of both an authentication system and a VPN system ensures broad applicability and versatility in different network environments. The system comprises a controller that facilitates precise management of client scores, enabling adaptive security measures.

[0048] Optionally, the presented system for monitoring security threats in an access control system further comprises a second authentication server, the Jail. The second authentication server, the Jail, refers to a server comprising only of frontend without any access to backend systems and it imitates the first authentication server by providing a realistic denial.

[0049] The second authentication server, the Jail, offloads malicious traffic, reducing the real production authentication service's load and enhancing system performance. By imitating the real production authentication service, the second Jail server handles and logs malicious traffic without performing real processing or interactions with the databases, directories or systems, thereby isolating potential threats from the primary system. Also, this reduces the load on the real production authentication service, ensuring that legitimate traffic is processed more efficiently. Additionally, the second authentication server's, the Jail's, detailed logging capabilities provide valuable data for analysing attack patterns and further improving security measures.

[0050] Optionally, the system further comprises a VPN concentrator. The VPN concentrator manages transport level frontend tasks in the VPN system. For authentication in VPN services, the concentrator queries the authentication system, which determines the required authentication method based on the username and the specific VPN service needed. User databases and directories are then queried for this information. The authentication is performed using the chosen access control system. The username and any additional initial input are forwarded to the access control system, which may either return another query to be displayed to the client or contact the client's mobile app or SIM application. Additionally, for VPN services, there could be a list of remote client IPs that are marked as malicious provided to the VPN concentrator. The list enables the VPN concentrator to utilise the second authentication server, the Jail, for these specific authentication requests. Incorporating a VPN concentrator into the system enhances its functionality and efficiency by managing frontend tasks specific to VPN services. The VPN concentrator facilitates the integration between the frontend and backend systems, determining the required authentication method based on user credentials and the specific VPN service. By querying user databases and directories, it ensures accurate and secure authentication processes. Additionally, the ability to utilise a list of malicious remote client IPs enables the VPN concentrator to redirect these clients to the second authentication server, effectively isolating potential threats. The VPN concentrator improves the overall security, efficiency, and adaptability of the system, ensuring robust protection and optimal performance in VPN environments.

[0051] In a third aspect, the present disclosure provides a computer program for monitoring security threats in an access control system, comprising instructions which, when the program is executed by a system according to any of the embodiments of the present disclosure, cause the system to carry out the method for monitoring security threats in an access control system.

[0052] The term "computer program" refers to a software product containing executable instructions that implement the steps of the computer- implemented method described in this disclosure. These steps include monitoring security threats, analysing potential risks, and taking appropriate actions to mitigate any identified threats within an access control system.

[0053] By executing the instructions of this computer program, the system can automatically carry out the method for monitoring security threats, ensuring consistent and precise implementation of security protocols. This automation reduces the need for manual intervention, increasing efficiency and reliability. The program's ability to continuously monitor and analyse threats allows for real-time responses to identified risks, improving overall system security.

[0054] EXAMPLES

[0055] As an example of the presented disclosure a scenario could be described where a large enterprise employs the disclosed method and system to monitor and manage security threats within its authentication framework. The enterprise has an extensive user base accessing its network resources, including remote employees using Virtual Private Network (VPN) services. The access control system comprises a first authentication server, the Doorman, a second authentication server, the Jail, the Controller, the real production authentication service and in case of remote clients using VPN services, a VPN concentrator.

[0056] Upon implementation, the first authentication server, the Doorman, is configured to receive authentication attempts from multiple remote clients. If the remote client score is below the thresholds, the first authentication server, the Doorman, forwards the query to the real production authentication service, which determines the necessary authentication method based on the combination of the client's credentials and the required VPN service.

[0057] The Controller calculates score for a remote clients uniquely identified by their IP address or Mobile Station International Subscriber Directory Number (MSISDN). The controller periodically scores the authentication attempts based on predefined criteria. For instance, failed login attempts might increase the one or more remote client scores by 1-10 points, while the presence of script fragments in usernames could add 40-70 points. Special characters not typically used in usernames, such as &, $, [ ], #, and others, might contribute an additional 5-20 points. These one or more remote client scores are accumulated periodically, for example, every one to three hours.

[0058] If the one or more remote client scores exceeds the first predefined threshold value, set for example between 100-200 points, the controller marks the client as malicious. Consequently, access to the frontend of the first authentication server is restricted. The restriction involves transferring the one or more remote clients to a second authentication server, the Jail, which is designed to mimic the first authentication server without performing any actual processing beyond rejecting requests. This redirection allows the malicious client to continue its attempts without affecting functionality of the primary system.

[0059] The scoring mechanism is dynamic and adjusts based on the type and frequency of authentication attempts. For example, repeated failed attempts using a username known to be used in dictionary attacks, like "admin" username might result in an additional 10-40 points per attempt. High-intensity attacks, characterised by over 100 authentication attempts per minute, could cause the score to increase by a factor of 2-7. Conversely, scores might decrease gradually, by 1- 10 points per hour, or reset to zero following a successful authentication.

[0060] In scenarios where the remote client persists in malicious behaviour, the access control system implements hard limits. If the remote client score reaches a second predefined threshold value, which could be between 350-650 points, the client is subjected to harder restrictions. These hard limits involve blocking all the remote client's access to specific network service for time periods depending on the nature of their attempts. Regular authentication failures result in for example a 24-hour block, while the use of special characters or script attacks could lead to blocks of 48 hours and up to 100 days, respectively.

[0061] The access control system is designed to be adaptive, allowing for the adjustment of scoring parameters to meet the specific needs of the service. For instance, the scoring for known good clients, such as those from recognized VPN services or office IP addresses, can be tailored differently to avoid incorrect malicious classification. Moreover, if a client's behaviour improves, their restriction time period, Tr, decreases automatically.

[0062] When the remote client score reaches the second predefined threshold value, all network access is blocked. This action can be enforced by configuring the firewall to deny all traffic from the offending IP address or MSISDN. In cases where a known good IP address or MSISDN source range gets blocked, an administrator receives a warning, ensuring that legitimate clients are promptly addressed.

[0063] In another example a method for monitoring security threats in an access control system, wherein the security threats are risks of access break-in attempts. In the embodiment, the method for monitoring risks of access break-in attempts is carried out by marking the one or more remote clients malicious by calculating the one or more remote client scores and directing them from the first authentication server to the second authentication server. Firstly, a first authentication server, the Doorman, receives authentication attempts from the one or more remote clients. Secondly, the one or more remote clients are given remote client scores based on their Internet Protocol (IP) address or Mobile Station International Subscriber Directory Number (MSISDN). Then, the received authentication attempts made by the one or more remote clients are scored periodically per a predefined time period based on a type of the authentication attempts, by the controller in the case of another authentication system than VPN and at the VPN concentrator in the case of VPN system. The controller adjusts the one or more remote clients scores based on the scored authentication attempts. When the one or more remote clients make a successful login, they are considered to be legit and the scores are set to zero. Furthermore, when the one or more remote clients' scores reach a predetermined limit, user requests are directed to the second authentication server. In the second authentication server the one or more remote clients scores are adjusted based on the authentication attempts and decreased per predetermined time period. The one or more remote clients are released from the second authentication server to the first authentication server automatically when their scores are below a predetermined limit.

[0064] DETAILED DESCRIPTION OF THE DRAWINGS

[0065] Referring to FIG. 1, illustrated is an embodiment of an access control system 100 wherein the access control system 100 is an authentication system, its components and its relations for monitoring security threats in an access control system 100 of the presented invention. Moreover, the one or more remote clients 102 using an authentication service requests authentication to a first authentication server 104. When the one or more remote clients 102 using an authentication service are defined as malicious they are transferred to a separate second authentication server 106 that imitates the first authentication server 104, by a controller 108, from the earliest possible point to avoid unnecessary processing. The controller 108 detects the requests of authentication and updates remote client 102 using an authentication service score based on the type of authentication attempts. In the second authentication server 106 the one or more remote clients 102 using an authentication service score is decreased per predetermined time period and adjusted based on the type of authentication attempts. So that when the one or more remote clients 102 using an authentication service are not acting malicious anymore they are released from the second authentication server 106 back to the first authentication server 104 automatically. When the one or more remote clients 102 makes a successful authentication, access to an endpoint real production authentication service 112 is provided.

[0066] Referring to FIG. 2a, illustrated is an embodiment of an access control 200 system wherein the access control system 200 is a Virtual Private Network (VPN) system, its components and its relations for monitoring security threats in an access control system of the presented invention. Moreover, the one or more remote clients 202 using VPN services send requests of authentication to a first authentication server 104. When the one or more remote clients 202 using VPN services are defined as malicious they are transferred to a separate second authentication server 106 that imitates the first authentication server 104, at the VPN concentrator 204. The VPN concentrator 204 also handles the frontend tasks of the first authentication server 104 and of the second authentication server 106. Frontend tasks include interacting with the backend and handling the client's transport level traffic after the authentication is passed. The controller 108 detects the requests of authentication and updates the one or more remote clients 202 using VPN services scores based on the type of authentication attempts. In the second authentication server 106 the one or more remote clients 202 using VPN services score is decreased per predetermined time period and adjusted based on the type of authentication attempts. So that when the one or more remote clients 202 using VPN services are not acting malicious anymore they are released from the second authentication server 106 back to the first authentication server 104 automatically. Malicious remote client's authentication requests are directed from the earliest point to avoid unnecessary processing, by providing the VPN concentrator 204 Internet Protocol (IP) list of malicious clients. When the one or more remote clients 202 using VPN services makes a successful authentication, access to an endpoint real production authentication service 112 is provided.

[0067] Referring to FIG. 2b, illustrated is another embodiment of an access control 200 system wherein the access control system 200 is a Virtual Private Network (VPN) system for monitoring security threats according to the present disclosure. The access control system 200 comprises a VPN concentrator 204, a first authentication server 104 configured to act as a Doorman, a controller 108, a remote client score database 206, a controller 108, a second authentication server 106.

[0068] The first authentication server 104 is configured handle the authentication requests, check scores or jail statuses from the remote client score database 206, forward the queries to the real production authentication service 112 for utilizing databases, directories, auth systems, and other.

[0069] The controller 108 is configured to collect periodically logs and events from authentication servers for scoring purposes and to calculate scoring, to increase score after bad behaviour, to decrease scoring periodically, to clear scoring to zero if successful authentication identified.

[0070] The second authentication server 106 is configured to act as a Jail, a fake authentication server, which is not processing the malicious requests, just logging them and always responds with reject.

[0071] The one or more remote clients 202, using VPN services and servers protected with a VPN 208, send requests of authentication to a first authentication server 104. When the one or more remote clients 202 using VPN services 208 are defined as malicious they are transferred to a separate second authentication server 106 that imitates the first authentication server 104, at the VPN concentrator 204. The VPN concentrator 204 also handles the frontend tasks of the first authentication server 104 and of the second authentication server 106. Frontend tasks include interacting with the backend and handling the client's transport level traffic after the authentication is passed. The controller 108 detects the requests of authentication and updates the one or more remote clients 202 using VPN services scores based on the type of authentication attempts. In the second authentication server 106 the one or more remote clients 202 using VPN services score is decreased per predetermined time period and adjusted based on the type of authentication attempts. So that when the one or more remote clients 202 using VPN services are not acting malicious anymore they are released from the second authentication server 106 back to the first authentication server 104 automatically. Malicious remote client's authentication requests are directed from the earliest point to avoid unnecessary processing, by providing the VPN concentrator 204 Internet Protocol (IP) list of malicious clients. When the one or more remote clients 202 using VPN services makes a successful authentication, access to an endpoint real production authentication service 112 is provided. The real production authentication service comprising a frontend and multiple backends 212 to be protected from the malicious requests

[0072] Referring to FIG. 3, illustrated is a flowchart depicting steps of a method 300 for monitoring security threats in an access control system, wherein the security threats are risks of access break-in attempts. In the embodiment, the method 300 for monitoring risks of access break-in attempts. At step 302, a first authentication server receives authentication attempts from the one or more remote clients. At step 304, the one or more remote clients are given a remote client score linked on their Internet Protocol (IP) address or Mobile Station International Subscriber Directory Number (MSISDN). At step 306, the received authentication attempts made by the one or more remote clients are scored periodically per a predefined time period based on a type of the authentication attempts, by the controller in the case of other authentication system than VPN, such as Remote Authentication Dial-In User Service (RADIUS), or at the VPN concentrator in the case of VPN system. At step 308, the controller adjusts remote client scores based on the scored authentication attempts. At step 310, when the one or more remote clients makes a successful login, they are considered to be legit and the scores are set to zero. At step 312, when the one or more remote client scores reach a first predefined threshold value the one or more remote clients are marked as malicious, by the controller and user requests are directed to the second authentication server. At step 314, in the second authentication server the one or more remote client scores are adjusted based on the authentication attempts and decreased per predetermined time period. At step 316, the one or more remote clients are released from the second authentication server to the first authentication server automatically when their score is below a predetermined limit.

[0073] Referring to FIG. 4, illustrated is a scoring mechanism 400 for known good remote clients and unknown remote clients to identify malicious remote clients attempting to enter the access control system. If the one or more remote clients using an authentication service other than VPN and the one or more remote clients using VPN services has a high score 402 they are more likely malicious. If they have a low scores 404, they are more likely to be legitimate. Moreover, the scoreboard for unknown remote clients 406 comprises the first predefined threshold value 408, and the second predefined threshold value 410. Both the first predefined threshold value 408, and the second predefined threshold value 410 can be adjusted for a specific service's needs. When the one or more remote clients have relatively low score 404, and do not reach the first predefined threshold value 408 they are identified as real valid remote clients 412. After the one or more remote clients reach the first predefined threshold value they are identified as malicious remote clients 414 and their further authentication attempts are forwarded to the second authentication server. If the one or more remote clients reach the second predefined threshold value 410 they are blocked from all network access to the specific service 416 for a predetermined time period by implementing hard limits. If the one or more remote clients have a relatively high scores 402 and they have been placed in the scoreboard of known good clients 418, they are identified as good remote clients with issues 420. These issues could be a result of multiple failed authentication attempts made by the client.

Claims

1. CLAIMS1. A method for monitoring security threats in an access control system (100, 200), the method comprises- receiving, at a first authentication server (104), authentication attempts from one or more remote clients (102, 202);- providing a remote client score for the one or more remote clients (102, 202);- scoring periodically per a predefined time period Tp, by a controller (108) associated with the first authentication server (104), the received authentication attempts made by each remote client of the one or more remote clients (102, 202), based on a type of the authentication attempts;- adjusting by the controller (108) the remote client score periodically based on the scored authentication attempts and- marking by the controller (108) the remote client malicious (414), if the adjusted score exceeds a first predefined threshold value (408).

2. The method according to claim 1, wherein adjusting the remote client score is one of increasing the score, decreasing the score or resetting the score.

3. The method according to claim 1 or 2, wherein the method further comprises restricting access of the remote client (102, 202) to a frontend of the access control system.

4. The method according to any of the preceding claims, wherein restricting access comprises transferring the remote client (102, 202) to a second authentication server (106) for a predefined restriction time period Tr, wherein the second authentication server (106) is configured to imitate the first authentication server (104) with no real processing of the request other than rejecting it.

5. The method according to claim 4, wherein restricting access comprises adjusting the predefined restriction time period Tr according to behaviour of the remote client (102, 202).

6. The method according to any of the preceding claims, wherein the method further comprises implementing hard limits, when the adjusted score exceeds a second predefined threshold value (410).

7. The method according to claim 6, wherein implementing hard limits comprises increasing a restriction time.

8. The method according to claim 6, wherein implementing hard limits comprises blocking an access of the remote client (102, 202) from all network access (416).

9. A system for monitoring security threats in an access control system, the system comprises a first authentication server (104) and a controller (108) associated with the first authentication server (104).

10. The system according to claim 9, wherein the system further comprises a second authentication server (106).

11. The system according to claim 9 or 10, wherein the system further comprises a VPN concentrator (204).

12. A computer program for monitoring security threats in an access control system, comprising instructions which, when the program is executed by a system according to any of claims 9-11, cause the system to carry out the method of any one of claims 1-8.

Images