Authentication System Detecting Horizontal Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Horizontal attacks, where attackers use common credentials to authenticate to remote servers, compromise internet communications and transactions, as existing security measures are often circumvented by attackers, leading to security breaches and financial losses.
Innovation Solution
A method and system that receive user credentials during authentication, compare them to a list of common credentials, and increase a score associated with matching credentials, allowing for security determinations and measures to be taken, such as account lockouts or increased security protocols, to detect and mitigate horizontal attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security measures (such as account lockouts after failed authentication attempts) are implemented, then security against horizontal attacks is improved, but usability deteriorates because legitimate users who make authentication mistakes are unfairly punished
Solution Approach 1:
The system applies different authentication policies to different users based on their authentication history and behavior patterns. Frequent authenticators receive stricter security measures (lower attempt limits), while less frequent users receive more lenient treatment. This local differentiation allows the system to maintain high security for targeted accounts while preserving usability for legitimate users who may occasionally make mistakes.
Solution Approach 2:
The system continuously monitors authentication attempts and adjusts the allowed number of attempts dynamically based on feedback from previous interactions. Users who successfully authenticate multiple times in a row have their attempt limits increased, while users with multiple failures see their limits decreased. This feedback mechanism enables the system to adapt to individual user behavior patterns and distinguish between legitimate users and attackers in real-time.
2Reliability
If the number of authentication attempts is limited for all users, then security is improved by preventing brute-force attacks, but productivity deteriorates because legitimate users experience increased authentication friction
Solution Approach 1:
The authentication policy is made dynamic rather than static. The system adjusts the number of allowed authentication attempts based on real-time analysis of user behavior, authentication success rates, and temporal patterns. This dynamic adaptation allows the system to maintain low attempt limits for suspicious accounts while allowing multiple attempts for legitimate users, thereby preserving both security and productivity.
Solution Approach 2:
The system changes the parameter of allowed authentication attempts based on user-specific criteria such as authentication frequency, success rate, and time-based patterns. By modifying this critical security parameter dynamically for different user segments, the system achieves both strong security for targeted accounts and high productivity for legitimate users without unnecessary friction.
3Difficulty of detecting and measuring
If common credentials are blocked during authentication, then detection of horizontal attacks is improved, but false positives increase affecting legitimate users with common password choices
Solution Approach 1:
The system uses feedback from authentication outcomes to distinguish between attackers and legitimate users. When a user with a common credential successfully authenticates and maintains normal usage patterns, the system updates its understanding and allows continued access. Conversely, when authentication failures occur in a pattern consistent with horizontal attack behavior, the system triggers blocking. This feedback loop reduces false positives by continuously validating user behavior against attack patterns.
Solution Approach 2:
The system performs preliminary analysis of authentication patterns before implementing blocking actions. By analyzing the context, frequency, and pattern of authentication attempts against a user's historical behavior profile, the system can preliminarily determine whether a common credential usage represents legitimate access or an attack, thereby reducing false positives before any restrictive action is taken.
Data Source
AI summary
Horizontal attacks may be detected in an authentication system by comparing entered credentials to a list of common credentials, increasing a score if the entered credential matches a credential on the list of common credentials, and then making a security determination based on the score. The score increase may be weighted based on factors including a recentness of a previous authentication, a similarity of the credential to a correct or common credential, a commonality of the entered credential, and whether or not additional security precautions are being taken. The score may be associated with a credential, an authentication attempt, or may be a system-wide score that, when it reaches a threshold may be indicative of a system-wide attack.