Client-Side Incorrect Password History for Authentication Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional user authentication systems often lead to user account lockouts due to repeated incorrect password submissions, causing inconvenience and requiring complex password-resetting processes, without effectively distinguishing between incorrect and mistyped passwords.
Innovation Solution
Implementing client-side user authentication control using an incorrect password history maintained on the client device, which alerts users when an entered password is likely incorrect and allows override or substitution with a new password, thereby reducing lockouts without compromising security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a lock-out mechanism is implemented to protect against password-guessing attacks, then system security is improved, but user convenience deteriorates due to frequent account lockouts
Solution Approach 1:
The patent divides the authentication system into two independent components: the server-side lock-out mechanism remains unchanged for security, while a client-side incorrect password history mechanism is added to track and warn about repeated incorrect passwords. This segmentation allows both security and user convenience to coexist without compromising either.
Solution Approach 2:
The client device acts as an intermediary between the user and the authentication server. It maintains a local history of incorrect passwords and provides warnings to users before submissions reach the server, preventing unnecessary lockouts while the server maintains its security policies unchanged.
2Extent of automation
If the client device repeatedly submits the same incorrect password, then automated authentication processes can handle password mismatches between systems, but user account lockouts increase
Solution Approach 1:
The client device performs preliminary checking by maintaining a history of previously submitted incorrect passwords and comparing upcoming password submissions against this history. This preliminary action prevents automated processes from repeatedly submitting known incorrect passwords that would cause lockouts.
3Reliability
If user interfaces do not echo typed passwords, then security is improved by preventing shoulder-surfing attacks, but user ability to detect typing errors deteriorates
Solution Approach 1:
The system provides feedback to users by warning them when they attempt to submit a password that matches the incorrect password history. This feedback loop helps users detect potential errors without requiring password echoing, maintaining security while improving error detection capability.
Data Source
AI summary
An apparatus in one embodiment comprises a client configured to perform client-side portions of one or more user authentication protocols carried out between the client and one or more authentication servers over a network. The client stores, for one or more instances of a given one of the user authentication protocols carried out for a particular user, an incorrect password history comprising identifiers of one or more passwords previously entered by the user and indicated as being incorrect passwords by at least one of the authentication servers, and determines, for an additional password entered by the user but not yet submitted by the client to the authentication servers, whether or not the additional password is part of the incorrect password history. Responsive to the additional password being part of the incorrect password history, the client generates an alert for presentation to the user to indicate that the additional password may be an incorrect password.