Authentication Module Activator Mitigates Brute-Force Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer end-points are vulnerable to network-based attacks, such as brute-force attempts and denial-of-service, which can lead to unauthorized access and disruption of services, affecting both legitimate and malicious users.
Innovation Solution
An authentication module that requires a key activator to activate before authenticating security credentials, implementing a two-step authentication process to prevent unauthorized access and mitigate the impact of network attacks without locking out legitimate users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication mechanisms are used, then ease of operation is maintained, but security against network-based attacks deteriorates
Solution Approach 1:
The system performs preliminary actions by generating and storing hashed versions of security credentials before they are needed for authentication. When a user submits credentials, the system hashes them and compares against pre-stored hashed values, enabling rapid authentication without complex real-time verification processes.
Solution Approach 2:
The patent replaces traditional mechanical credential verification with a cryptographic hash-based system. Instead of directly comparing plain-text credentials or using complex multi-factor authentication mechanisms, the system substitutes this with efficient hash comparison operations that are both secure and computationally lightweight.
2Reliability
If brute-force attack prevention measures are implemented, then security is improved, but legitimate user access may be disrupted
Solution Approach 1:
The system changes the parameter of credential representation from plain-text or simple encrypted forms to cryptographic hash values with specific properties (one-way function, fixed length, deterministic). This parameter change makes brute-force attacks computationally infeasible while maintaining fast verification for legitimate users through deterministic hash comparison.
Solution Approach 2:
The patent employs disposable, single-use cryptographic hash values that are computationally inexpensive to generate and verify. Each authentication attempt uses a fresh hash comparison operation that consumes minimal computational resources, allowing rapid authentication of legitimate users while making large-scale automated attacks economically unviable.
Data Source
AI summary
Techniques are disclosed for mitigating network-based attacks, brute-force attacks, enumeration account takeover type attacks, and generally attacks that might result in unauthorized access to user accounts, denial-of-service, loss of functionality to users, etc. Authenticating a user at an end-point of a network may occur using an activator. In some instances, an authentication module (e.g. on a server) receives and validates a key activator. If the key activator is valid, the authentication module is activated. After the authentication module is activated, the authentication module may receive and authenticate a security credential, such as a password, that is associated with the user. If the authentication module receives the security credential without being activated, the authentication module may not authenticate the security credential, even if the security credential is a valid credential. A same user interface may be provided that receives both the key activator and the security credential, in some embodiments.