Authentication System Risk Scoring for Brute Force Prevention

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing authentication methods are vulnerable to brute force attacks, especially when low-quality or low-entropy information such as common passwords or PINs are used, as they fail to prevent vertical attacks where attackers try common passwords with multiple usernames or vice versa.

Innovation Solution

A system and method that includes a network interface to receive authentication information, a processor to calculate a score based on the received information, and a threshold comparison to authenticate users and devices, with the option to request additional low-quality information if the score is below the threshold, providing an additional layer of security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If traditional username and password authentication is used, then ease of operation is improved, but security is worsened due to vulnerability to brute force attacks

Engineering Contradiction:
Improveease of operationVSAvoidsecurity
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The patent transitions from traditional single-factor authentication to multi-factor authentication by adding device information and behavioral biometrics as additional dimensions. This creates a multi-dimensional authentication space where attackers must compromise multiple factors simultaneously, dramatically increasing security while maintaining user convenience through automatic device recognition.

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

Solution Approach 2:

The system dynamically adjusts authentication parameters such as score thresholds and required factors based on risk assessment. Low-quality or low-entropy information is combined with high-quality factors, and the weighting of each authentication parameter is adjusted according to the calculated risk score, allowing flexible security adaptation without compromising ease of operation.

Inventive Principle:
Principle #35Parameter changes

2Reliability

If rate limiting is applied to prevent brute force attacks, then security is improved, but productivity is worsened due to account disabling

Engineering Contradiction:
ImprovesecurityVSAvoidproductivity
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The authentication system dynamically adjusts security measures based on real-time risk assessment rather than applying static rate limiting. The processor calculates a risk score for each authentication attempt and dynamically determines the appropriate authentication factors required, allowing legitimate users to authenticate smoothly while dynamically blocking only the specific attempts that pose genuine threats.

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The system implements continuous feedback loops where authentication attempts, device information, and behavioral patterns are analyzed to update risk scores in real-time. This feedback mechanism allows the system to learn from attack patterns and adjust authentication requirements dynamically, preventing brute force attacks without unnecessarily disabling accounts for legitimate users.

Inventive Principle:
Principle #23Feedback

3Reliability

If multi-factor authentication is implemented, then security is improved, but device complexity is worsened

Engineering Contradiction:
ImprovesecurityVSAvoiddevice complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system automatically collects and processes device information, behavioral biometrics, and risk assessments without requiring user intervention. The processor automatically evaluates multiple authentication factors and makes real-time decisions about authentication requirements, eliminating the need for users to manually configure complex security settings or understand authentication protocols.

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The authentication system is designed to work across multiple devices and platforms universally. The device information and behavioral biometrics are collected and processed in a standardized manner that adapts to different device types, operating systems, and input methods, allowing the same authentication framework to serve multiple functions and devices without increasing complexity for end users.

Inventive Principle:
Principle #6Universality (Multi-functionality)

4Reliability

If additional authentication factors are required, then security is improved, but ease of operation is worsened

Engineering Contradiction:
ImprovesecurityVSAvoidease of operation
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The system dynamically determines which authentication factors are required based on real-time risk assessment. Rather than always requiring multiple factors, the processor calculates a risk score and adjusts the authentication requirements accordingly, requiring additional factors only when the risk warrants it, thereby maintaining ease of operation for low-risk situations while ensuring security when needed.

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The system uses transient, easily collected device information and behavioral data as authentication factors that do not burden the user. These factors such as device identifiers, input patterns, and timing information are automatically captured without requiring users to remember additional credentials or carry physical tokens, providing enhanced security while maintaining ease of operation.

Inventive Principle:
Principle #27Cheap short-living objects (Disposable)

Data Source

PatentUS9396317B2Systems and methods for authenticating a user and device
Publication Date: 2016.07.19 PAYPAL INC
  • US9396317B2 patent drawing
  • US9396317B2 patent drawing
  • US9396317B2 patent drawing

AI summary

Systems and methods for authenticating a user request for authentication are provided. An authentication device that may be part of such a system includes a network interface component coupled to a network and configured to receive at least one data packet having authentication information including at least a username of a user and user credentials. The device also includes a memory coupled to the network interface component and configured to store the received authentication information, one or more instructions for authenticating the user, and account information of the user. The device further includes one or more processors configured to analyze the received information, calculate a score based on the received information, determine a threshold, compare the calculated score with the determined threshold, and authenticate the user and a device from which the data packet is received if the calculated score is greater than or equal to the determined threshold.