Authentication Module Blackout Periods for DoS and Dictionary Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer networks are vulnerable to dictionary attacks, Denial of Service (DoS) attacks, and other password-based authentication attacks, which can lead to financial losses and system downtime, especially for online businesses, as conventional countermeasures like locking user accounts are costly and ineffective.
Innovation Solution
Implementing a network management module with an authentication module that uses blackout periods to maintain system responsiveness during attacks, blindly failing all authentication requests, thereby eliminating the possibility of simultaneous DoS and dictionary attacks, and protecting against IP spoofing and SYN TCP flooding.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional countermeasures like locking user accounts are used to prevent dictionary attacks, then security against password attacks is improved, but system availability and user productivity deteriorate
Solution Approach 1:
The patent converts the harmful effect of authentication failures into a beneficial security mechanism. By tracking and counting authentication failures, the system identifies attack patterns and implements blackout periods that prevent both legitimate users and attackers from accessing the system during attack detection, thereby transforming the harm of failed logins into a protective measure against DoS attacks while maintaining security
Solution Approach 2:
The system performs preliminary actions by monitoring authentication failure patterns and detecting DoS attack characteristics before they can cause widespread damage. When suspicious patterns are detected, the system proactively implements blackout periods and rate limiting mechanisms to prevent the attack from succeeding, rather than reacting after damage has occurred
2Reliability
If the system implements strict authentication validation to prevent dictionary attacks, then security is improved, but the system becomes more vulnerable to DoS attacks
Solution Approach 1:
The patent introduces an intermediary layer between the authentication validation logic and the external network. This intermediary monitors authentication requests, tracks failure patterns, and implements protective measures like blackout periods and rate limiting. The intermediary absorbs the complexity of attack detection and response, allowing the authentication system to maintain strict validation while being protected from DoS attacks
Solution Approach 2:
The system dynamically changes operational parameters based on detected attack conditions. When authentication failure patterns indicate a DoS attack, the system modifies parameters such as authentication response times, request rate limits, and validation strictness. This dynamic parameter adjustment allows the system to maintain security during normal operation while adapting to prevent DoS attacks
3Ease of operation
If the system maintains continuous authentication processing to ensure availability, then system responsiveness is improved, but the system becomes more susceptible to SYN TCP flooding attacks
Solution Approach 1:
The patent implements periodic action through blackout periods that are activated during detected attacks. Instead of continuous processing, the system alternates between normal authentication processing and protective blackout periods. During blackout periods, all authentication requests are blocked, which prevents SYN TCP flooding attacks from exhausting system resources while maintaining normal responsiveness during attack-free periods
Solution Approach 2:
The system performs preliminary monitoring and detection of attack patterns before implementing full blackout periods. By detecting DoS attack characteristics in advance and implementing progressive rate limiting, the system prepares protective measures ahead of time, preventing SYN TCP flooding from causing system exhaustion while maintaining normal operation during low-threat periods
Data Source
AI summary
Apparatus, system, and method having a first counter to record a number of invalid authentication requests, a first timer to set a first time period based on a value of the first counter, and an authentication module associated with the first counter and the first timer to receive an initial authentication request that includes a username and when said username is invalid, the module is to invalidate any subsequent authentication requests under the username during the first time period regardless of whether the subsequent requests includes a valid username. The system further includes a communication medium. The method includes receiving an authentication request with new information in a first session, validating the new information, and caching the validated new information in the first session.