Centralized Authentication System for Credential Stuffing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems are inadequate in detecting and mitigating credential stuffing attacks, as they rely on pre-defined lists of compromised credentials and fail to recognize reused or modified credentials, allowing attackers to attempt logins across multiple sites without raising alarms, leading to potential data breaches.
Innovation Solution
A centralized authentication system monitors login attempts across a network of websites, incrementing a failure count for credentials that fail to authenticate, and initiates protective actions when a threshold is exceeded, including adding credentials to a blacklist and notifying users, without requiring a published list of compromised credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pre-defined lists of compromised credentials are used for detection, then known credential attacks can be identified, but reused or modified credentials cannot be detected and attackers can attempt logins across multiple sites without raising alarms
Solution Approach 1:
The system implements feedback by monitoring failed login attempts and using this information to update the compromised credential list dynamically. When credentials fail authentication at any site, they are added to the list, allowing the system to adapt to new attack patterns and detect reused or modified credentials across multiple sites without requiring pre-defined lists.
Solution Approach 2:
The authentication system performs self-service by automatically detecting and learning from failed login attempts. The system monitors its own authentication failures and uses this feedback to build and update the compromised credential list, eliminating the need for external manual updates and enabling real-time adaptation to credential stuffing attacks.
2Reliability
If real-time monitoring of login attempts across multiple websites is implemented, then credential stuffing attacks can be detected and prevented, but system complexity and computational resources increase
Solution Approach 1:
The patent merges the authentication monitoring function with the credential storage function by integrating the failed login attempt monitoring into the existing authentication system. The authentication server that normally verifies credentials also monitors for failures and maintains the compromised credential list, combining multiple functions into a single system rather than requiring separate complex monitoring infrastructure.
Solution Approach 2:
The authentication server performs multiple functions: it authenticates user credentials, monitors for failed login attempts, detects credential stuffing attacks, and maintains the compromised credential list. This multi-functionality reduces overall system complexity by consolidating security monitoring within the existing authentication infrastructure rather than requiring separate dedicated systems.
Data Source
AI summary
The present disclosure relates to computer-implemented methods, software, and systems for identifying potential attacks through monitoring of user credential login attempts across a network of websites. One example method includes monitoring login attempts associated with a plurality of websites and identifying a first login attempt at a first website associated with a set of user credentials. In response to determining that the set of user credentials do not correspond to a valid set of credentials, a count value associated with an entry in a failed credential log associated with the user credentials is incremented. If the count threshold associated with a compromised user credential rule is exceeded by the current count value, then the first set of credentials is identified as a set of compromised credentials and at least one protective action is initiated.