Access Management System Account Locking Denial of Service Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access management systems are vulnerable to denial-of-service attacks, where repeated unsuccessful login attempts can lock an account, causing inconvenience and loss of access for legitimate users.
Innovation Solution
An access management system that generates and sends temporary access information via an out-of-band channel when a threshold of unsuccessful attempts is reached, allowing the account owner to bypass account locking and verify their identity using additional security measures like one-time passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the access management system locks an account after a threshold number of unsuccessful login attempts, then security against brute-force attacks is improved, but legitimate users may experience denial of service and loss of access
Solution Approach 1:
The patent introduces a temporary access code as an intermediary mechanism between the locked account and the user. When an account is locked due to multiple failed login attempts, the system generates a temporary access code that can be used to unlock the account. This intermediary allows legitimate users to regain access without permanently locking the account, while still maintaining security against brute-force attacks. The temporary code acts as a mediator that resolves the conflict between security enforcement and user access needs.
Solution Approach 2:
The system dynamically changes the authentication parameters based on the login attempt history. After a threshold number of failed attempts, the system transitions from accepting standard credentials to requiring alternative authentication methods (such as temporary access codes or out-of-band verification). This parameter change allows the system to maintain security while providing a path for legitimate users to regain access, effectively resolving the contradiction between security and accessibility.
2Ease of operation
If the system allows multiple login attempts without locking, then ease of access for legitimate users is improved, but vulnerability to denial-of-service attacks increases
Solution Approach 1:
The system applies preliminary anti-action by proactively locking the account after detecting a threshold number of unsuccessful login attempts, before a denial-of-service attack can fully execute. This preventive measure stops brute-force attacks in their tracks. Simultaneously, the system prepares recovery mechanisms (temporary access codes, admin unlock capabilities) that allow legitimate users to bypass the lock, thus counteracting the potential harm while maintaining security defenses.
Solution Approach 2:
The access management system dynamically adjusts its security posture based on real-time login attempt patterns. The account lock status is not static but changes in response to authentication events. The system transitions between locked and unlocked states based on configurable policies, allowing it to adapt to both attack scenarios and legitimate access needs. This dynamic behavior enables the system to respond appropriately to different situations, balancing security and accessibility.
3Reliability
If temporary access information is sent via out-of-band channel, then security verification is improved, but system complexity increases
Solution Approach 1:
The system verifies user identity by transitioning from a single-dimension verification (checking credentials within the application) to multi-dimensional verification (checking credentials plus sending temporary access codes via out-of-band channels such as SMS, email, or separate authentication services). This dimensional expansion strengthens security verification by adding independent verification layers that are difficult for attackers to compromise simultaneously, while the modular implementation keeps system complexity manageable.
Data Source
AI summary
Techniques are disclosed for protecting a user from denial of service (DOS) to access his/her a user account that has been locked. An access management system can provide features that enable an owner of an account to prevent the account from becoming locked. Specifically, the techniques disclosed herein enable an account holder to circumvent procedures of the access management system that lock an account after several unsuccessful attempts to access the account. The access management system may operate according to a configuration for managing access to account. The access management system can manage access to an account by presenting a user with an interface to received access information (e.g., account information and credential information) for the account to determine whether to unlock the account. The access management system can deny access to an account upon determining that the credential information is not correct for the account.