Authentication Integrity Challenge for Cloud Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems are vulnerable to brute force attacks, where attackers use ethically gray third-party vendors to collect and sell challenge solutions, enabling large-scale automated attacks and account takeovers.
Innovation Solution
The authentication integrity challenge (AIC) mechanism separates the challenge operations from the authentication operations using a third-party challenge provider, tying them together with a unique proof (nonce) to prevent exposure of user credentials and inhibit challenge solution farming.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a challenge provider service is used to issue authentication challenges, then authentication security is improved, but system complexity increases due to integration with third-party services
Solution Approach 1:
The patent introduces a challenge provider service as an intermediary component that sits between the authentication service and the client device. This mediator handles challenge generation and validation, allowing the authentication service to focus on credential verification while improving overall security through specialized challenge management.
Solution Approach 2:
The authentication system is segmented into distinct functional components: the authentication service handles credential verification, the challenge provider service manages challenge generation and validation, and the client device performs user interaction. This segmentation improves security by separating concerns and reducing the attack surface of each component.
2Ease of operation
If challenge solutions can be collected and sold by third-party vendors, then ease of operation is improved for legitimate users, but security deteriorates due to brute force attacks
Solution Approach 1:
The system performs preliminary validation of challenge solutions by the challenge provider service before they can be used for authentication. Challenges are pre-bound to specific authentication requests using unique identifiers, and the challenge provider service validates solutions against the original challenge parameters, preventing pre-collected solutions from being reused in attacks.
Solution Approach 2:
The challenge provider service provides feedback to the authentication service about the validity of challenge solutions. This feedback mechanism ensures that only properly validated solutions are accepted, and the system can detect and reject attempts to use previously collected or invalid solutions, thereby preventing brute force attacks.
3Reliability
If proof validation is performed for each authentication request, then security against credential exposure is improved, but processing time increases
Solution Approach 1:
The proof is generated and validated in advance as part of the challenge-response process before the actual credential verification occurs. The challenge provider service validates the proof against the challenge parameters beforehand, so that during the main authentication flow, the system only needs to verify the validation indication rather than performing complex cryptographic validation, reducing processing time.
Data Source
AI summary
Techniques for providing a computer-implemented authentication integrity challenge (AIC) service are described. According to some examples, a computer-implemented method includes receiving, at a cloud provider network, a first request from an end customer device to log into an end customer account of the cloud provider network; sending, in response to the first request, a second request that does not include login credentials for the end customer account from the cloud provider network to a challenge provider service separate from the cloud provider network for the first request; receiving, by the cloud provider network, a validation indication from the challenge provider service that indicates the second request is validated by an integrity challenge of the challenge provider service; generating, by the cloud provider network, a proof based on the validation indication; sending the proof by the cloud provider network to the end customer device; receiving, by the cloud provider network, a third request from the end customer device that comprises the login credentials and the proof sent by the cloud provider network; and logging the end customer device into the end customer account in response to the proof provided in the third request being validated by the proof generated by the cloud provider network and the login credentials provided in the third request matching corresponding login credentials for the end customer account.