Challenge Response Authentication with Unique Incorrect Response Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing challenge-based authentication protocols, such as CHAP, often lock user accounts unnecessarily due to repeated incorrect password guesses, leading to user annoyance and increased password reset costs, while also being susceptible to eavesdropping attacks from challenge reuse.
Innovation Solution
The server stores the most recent challenge and unique incorrect responses, allowing reuse of the challenge for k-1 incorrect guesses without counting them towards the lockout limit, and discarding the challenge after a correct response, thus distinguishing between unique and non-unique incorrect responses to prevent unnecessary lockouts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server locks accounts after too many wrong password guesses, then security is improved, but legitimate users who mistype passwords are unnecessarily locked out, reducing usability
Solution Approach 1:
The patent segments incorrect responses into two categories: unique incorrect responses and non-unique (repeated) incorrect responses. The server tracks and compares each incorrect response against previously received responses to determine uniqueness. This segmentation allows the system to apply different handling rules: unique incorrect responses count toward the lockout threshold, while non-unique incorrect responses do not, thereby preventing unnecessary lockouts of legitimate users who repeatedly mistype the same password.
2Ease of operation
If the server reuses challenges for incorrect responses, then usability is improved by allowing retry attempts, but security is compromised due to susceptibility to eavesdropping attacks
Solution Approach 1:
The patent applies local quality by differentiating challenge reuse policy based on the type of response received. Challenges are reused for non-unique incorrect responses to allow users to retry, but challenges are never reused for correct responses. This localized differentiation maintains security for successful authentications while providing usability benefits for failed authentication attempts.
Solution Approach 2:
The server implements feedback by tracking and comparing each received response against previously received responses. This feedback mechanism enables the server to identify non-unique incorrect responses and adjust its behavior accordingly, allowing challenge reuse only in safe contexts where it does not compromise security.
3Ease of operation
If the server stores and compares each response to detect non-unique incorrect responses, then unnecessary lockouts are prevented, but system complexity increases
Solution Approach 1:
The server performs preliminary action by pre-allocation and tracking of response history in memory. Rather than implementing complex real-time analysis, the system maintains a simple storage structure that records recent responses and enables straightforward comparison operations. This preliminary preparation simplifies the detection logic and reduces computational complexity during authentication operations.
Data Source
AI summary
A challenge/response authentication procedure determines whether a response is a correct response, a unique incorrect response, or a non-unique incorrect response, the unique incorrect response and non-unique incorrect response being differentiated by comparing the response value with a store of unique incorrect response values. For the correct response, client access to protected computer system resources is allowed, and the challenge value is discarded so as not to be used again. For the unique incorrect response, (1) when a predetermined limit of unique incorrect responses has not been reached, then the response value is added to the store of unique incorrect response values and the process is repeated with reuse of the challenge value, and (2) when the predetermined limit has been reached, then the client is locked out. For the non-unique incorrect response, the process is repeated with reuse of the challenge value.