Authentication System Using Dynamic Risk Score Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for authenticating users often lock out or wipe data when a password with errors is entered, failing to accommodate legitimate errors such as typos or forgotten password variations, while not adequately securing against unauthorized access.
Innovation Solution
A system that assigns metadata and password risk scores based on user device location, MAC ID, login time, and password errors, aggregating these scores to determine access permission, allowing access with one or more errors if the aggregated score meets a predetermined threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the system denies access when password errors are detected, then security is improved, but user accessibility deteriorates
Solution Approach 1:
The system changes the parameter of password matching from exact match to fuzzy match with error tolerance. It introduces a password error threshold parameter that allows a certain number of errors while still authenticating the user, thereby improving accessibility without completely sacrificing security
Solution Approach 2:
The system dynamically adjusts the password verification process based on the number of errors detected. Instead of a static all-or-nothing approach, it progressively evaluates errors against a threshold and can adaptively request additional verification only when necessary, balancing security and accessibility
2Reliability
If the system locks out users after multiple failed login attempts, then security is improved, but user convenience deteriorates
Solution Approach 1:
The system dynamically adjusts the lockout policy based on the nature of password errors. If errors are within the acceptable threshold and pattern matches legitimate user behavior, no lockout occurs. Lockout is triggered only when error patterns suggest unauthorized access attempts, thereby maintaining security while reducing unnecessary time loss for legitimate users
Solution Approach 2:
The system changes the parameter of failed login attempts from a simple counter to a nuanced evaluation that considers error patterns, thresholds, and user behavior. This allows the system to distinguish between legitimate mistakes and malicious attempts, applying lockout selectively rather than universally
3Reliability
If the system requires exact password matching, then security is improved, but adaptability deteriorates
Solution Approach 1:
The system changes the password matching parameter from exact equality to a configurable threshold-based comparison. It introduces parameters such as maximum allowed errors, error position weights, and error type classifications, enabling the system to adapt to different security requirements and user needs
Solution Approach 2:
The password verification process becomes dynamic, adjusting its strictness based on the evaluated risk level. For low-risk scenarios with minor errors, the system is more adaptable and permissive. For high-risk scenarios with multiple or suspicious errors, it becomes stricter, thereby achieving both adaptability and security
Data Source
AI summary
In an example embodiment, a system for allowing one or more password errors may store a correct password for a user and receive an attempted login from a user device. The attempted login may include (1) an attempted password with one or more errors and (2) metadata. The system may assign a metadata risk score to the metadata, assign a password risk score to the attempted password, aggregate the scores, and grant or deny access to the user based on the aggregated score and a predetermined threshold.