Adaptive Strike Count Policy for Authentication Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional strike count policies in authentication systems are ineffective in distinguishing between legitimate and malicious access attempts, leading to user inconvenience and vulnerability to Denial Of Service (DoS) attacks, as they impose equal penalties for all incorrect attempts without considering the risk level.
Innovation Solution
An adaptive strike count policy that increments a strike counter based on risk levels assessed from factors like location, device, and access frequency, allowing more attempts for minimal risk and disabling access for elevated or serious risks, thereby differentiating between legitimate and malicious attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a conventional strike count policy is implemented with equal penalties for all incorrect attempts, then security against brute-force attacks is improved, but user convenience deteriorates due to false positives on legitimate attempts
Solution Approach 1:
The patent applies local quality by differentiating the penalty applied to each failed authentication attempt based on its specific characteristics. Instead of a uniform strike count increment, the system assigns different weights (e.g., 1 strike for low-risk attempts, 3 strikes for medium-risk, 5 strikes for high-risk) based on factors like latency, time of day, and geographic location. This resolves the contradiction by making the security response locally adapted to each attempt's risk profile rather than applying a blanket penalty.
Solution Approach 2:
The patent changes the parameter of strike count increment from a fixed value to a variable value based on risk assessment parameters. The system evaluates multiple parameters (latency between attempts, time of day, geographic location) and adjusts the strike count increment accordingly. This allows legitimate users with normal patterns to experience minimal penalties while attackers with suspicious patterns face severe penalties, resolving the contradiction between security and user convenience.
2Reliability
If a strict strike count policy is enforced to prevent DoS attacks, then system security is improved, but vulnerability to DoS attacks worsens because attackers can intentionally trigger account locks
Solution Approach 1:
The patent converts the harmful effect of failed authentication attempts into a beneficial security mechanism by using the pattern of attempts themselves as evidence of malicious intent. Instead of treating all failed attempts equally, the system analyzes the characteristics (latency, location, time) to identify attacker behavior patterns. This transforms the DoS attack vector into a detection opportunity, where the very attempts meant to lock the account instead reveal the attacker's presence and trigger adaptive countermeasures.
Solution Approach 2:
The patent introduces dynamics by making the strike count policy adaptive rather than static. The system continuously monitors authentication patterns and adjusts the strike count increments in real-time based on assessed risk levels. This dynamic response allows the system to withstand DoS attacks by absorbing low-risk attempts while severely penalizing high-risk attempts, preventing attackers from successfully triggering account locks through intentional failed attempts.
3Measurement precision
If risk-based adaptive strike count is implemented, then differentiation between legitimate and malicious attempts is improved, but system complexity worsens due to multiple assessment factors
Solution Approach 1:
The patent applies segmentation by dividing the risk assessment process into distinct, modular components. Each factor (latency analysis, time-of-day evaluation, geographic location checking) is handled as a separate assessment module that independently evaluates its specific parameter and contributes to the overall risk score. This segmentation makes the complex system more manageable and maintainable while achieving high measurement precision through the combined output of specialized sub-systems.
Data Source
AI summary
An adaptive strike count management is implemented for securing resources. The method authorizes access to a resource if a security credential matches pre-stored security data. However, when the security credential does not match the pre-stored security data, the adaptive strike count management method denies access to the resource; assesses the risk level based on the security credential; increments a strike counter by a predetermined value based on the risk level; and disables further access attempts to the resource if the strike counter exceeds a threshold. The strike counter is incremented by a first value when the risk level is assessed to be a first level, a second value when the risk level is assessed to be a second level, and a third value when the risk level is assessed to be a third level.