Authentication System Timestamp Map for False Lockout Prevention

Solution Overview

Problem

Account lockout functionality in distributed computing node groups often incorrectly disables well-behavioring clients due to repeated login failures, leading to false positives and authentication disruptions, especially when credentials have lapsed or are expired.

Innovation Solution

Implementing a method that uses a master timestamp map to differentiate between legitimate and malicious authentication attempts by ignoring requests with recent prior failure timestamps, incrementing authentication failure counts only when necessary, and locking out accounts based on a threshold, while allowing well-behavioring clients to rejoin after a group passcode change.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If account lockout functionality is implemented to prevent malicious access attempts, then system security is improved, but well-behaved clients with lapsed credentials are incorrectly locked out causing authentication disruptions

Engineering Contradiction:

Improvesystem securityVSAvoidauthentication continuity

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system performs preliminary actions by sending a message to the member before processing authentication failure, and by maintaining a map of prior failure timestamps. This preliminary tracking allows the system to distinguish between malicious brute force attempts and legitimate authentication retries, preventing false lockouts of well-behaved clients while maintaining security against actual attacks

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback mechanisms by evaluating timestamps from incoming messages against stored prior failure timestamps. This feedback loop allows the system to dynamically adjust its response to authentication attempts based on historical patterns, enabling it to differentiate between malicious actors and legitimate users experiencing credential issues

Inventive Principle:

Principle #23Feedback

2Reliability

If authentication failure counting is implemented to detect malicious actors, then security against brute force attacks is improved, but false positives occur when legitimate users experience credential issues

Engineering Contradiction:

Improvemalicious actor detectionVSAvoidauthentication failure detection accuracy

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The system performs preliminary actions by sending a message to the member before processing authentication failure, and by maintaining a map of prior failure timestamps. This preliminary tracking allows the system to distinguish between malicious brute force attempts and legitimate authentication retries, preventing false lockouts of well-behaved clients while maintaining security against actual attacks

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system changes parameters by evaluating the timestamp of incoming messages against stored prior failure timestamps and group passcode change timestamps. By dynamically comparing these temporal parameters, the system can adjust its interpretation of authentication failures, recognizing when failures are part of legitimate credential renewal processes versus malicious attack patterns

Inventive Principle:

Principle #35Parameter changes

3Speed

If account lockout threshold is set low to quickly block malicious actors, then response time to security threats is improved, but legitimate users with expired credentials are locked out causing service disruption

Engineering Contradiction:

Improveresponse time to security threatsVSAvoidauthentication success rate

Core Design Contradiction:

SpeedVSProductivity

Solution Approach 1:

The system performs preliminary actions by sending a message to the member before processing authentication failure, and by maintaining a map of prior failure timestamps. This preliminary tracking allows the system to distinguish between malicious brute force attempts and legitimate authentication retries, preventing false lockouts of well-behaved clients while maintaining security against actual attacks

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback mechanisms by evaluating timestamps from incoming messages against stored prior failure timestamps. This feedback loop allows the system to dynamically adjust its response to authentication attempts based on historical patterns, enabling it to differentiate between malicious actors and legitimate users experiencing credential issues

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS10798074B2System and method for preventing well behaving clients from causing account lockouts in a group

Publication Date: 2020.10.06 DELL PROD LP

AI summary

Methods and systems for account authentication in a distributed computing node group may involve sending a message to a member, the message having a first timestamp, increasing an authentication failure count, receiving a first key-exchange message from the member, the first key-exchange message having a second timestamp, evaluating the second timestamp, and determining whether to ignore the first key-exchange message based on an evaluation of the second timestamp. The first timestamp may be associated with a message received from the member prior to sending the message with the first timestamp to the member. The first key-exchange message may include a value computed by the member based on a group passcode shared with the member. The evaluation of the second timestamp may be based on at least one of a default value, the authentication failure count, or a timestamp associated with the group passcode.