Authentication Server Cookie-Specific Counter Lockout Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information processing systems are vulnerable to denial of service (DOS) attacks that cause malicious lockouts of user accounts due to repeated incorrect password submissions, forcing legitimate users to undergo complex password-resetting processes.
Innovation Solution
Implementing server-side user authentication control using cookie-specific counters maintained by an authentication server, which increments counters for unsuccessful logins and locks accounts only when reaching a specified value, thereby differentiating between legitimate and malicious login attempts without undermining system security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a lock-out mechanism is implemented to protect against password-guessing attacks, then system security is improved, but legitimate users may be maliciously locked out due to repeated incorrect password submissions
Solution Approach 1:
The patent segments the lock-out mechanism by creating separate counters for different authentication methods: a cookie-specific counter for cookie-based logins and a non-cookie counter for password-based logins. This segmentation allows the system to apply different lock-out rules to different authentication paths, preventing attackers from maliciously locking out users through password-guessing attacks while still maintaining security through cookie validation
Solution Approach 2:
The patent introduces cookies as an intermediary authentication mechanism. Instead of directly locking out accounts based on password failure attempts, the system uses cookies to mediate the authentication process. The cookie-specific counter tracks failures separately, and successful cookie-based authentication can reset the non-cookie counter, allowing legitimate users to bypass malicious lockouts while maintaining overall system security
2Reliability
If a lock-out mechanism is implemented to protect against password-guessing attacks, then system security is improved, but the password-resetting process becomes more complex
Solution Approach 1:
By segmenting the authentication system into cookie-based and password-based paths with separate counters, the patent simplifies the password-resetting process. When a user is locked out via the non-cookie counter, they can use a previously issued cookie to authenticate, which automatically resets the counter. This segmentation provides a straightforward reset mechanism without requiring complex password recovery procedures
Solution Approach 2:
The system performs preliminary action by issuing cookies to legitimate users before they potentially encounter lockout scenarios. These pre-issued cookies serve as backup authentication credentials that can be used to reset counters and regain access if malicious lockouts occur, eliminating the need for complex password-resetting processes
3Object-affected harmful factors
If cookie-specific counters are maintained for respective login cookies, then malicious lockouts are reduced, but system complexity increases
Solution Approach 1:
The patent applies segmentation by dividing the authentication control into distinct components: cookie-specific counters for cookie-based authentication and non-cookie counters for password-based authentication. This segmentation isolates the complexity of cookie management to specific parts of the system while keeping other authentication paths simpler, making the overall system more manageable despite the added functionality
Solution Approach 2:
The authentication server is designed with multi-functionality to handle both cookie-based and password-based authentication with unified lock-out prevention logic. The same server infrastructure and basic authentication mechanisms serve both authentication methods, with the only difference being the separate counter tracking. This universality prevents the system from becoming overly complex by reusing existing components rather than creating separate systems
Data Source
AI summary
An authentication server in an illustrative embodiment is configured to communicate with one or more client devices over a network. Responsive to a successful login to a user account by a client device, the authentication server provides the client device with a login cookie for the user account for potential utilization in one or more subsequent logins to the user account. The authentication server initializes a cookie-specific counter for the login cookie, and increments the cookie-specific counter for each of one or more unsuccessful logins to the user account made utilizing the login cookie. Responsive to the cookie-specific counter reaching a specified value, the authentication server locks the user account for any subsequent logins to the user account made utilizing the login cookie. The authentication server resets the cookie-specific counter responsive to a successful login to the user account made utilizing the login cookie. The authentication server also maintains a non-cookie counter for counting failed logins made without utilizing a valid login cookie.