Credential Change Validation Against Resource Lockout Risk
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems are vulnerable to denial of service attacks due to repeated attempts with incorrect credentials, leading to resource locking and service disruption.
Innovation Solution
An automation tool is configured with logic to validate credential changes by tracking unsuccessful authentication attempts against stored log-on policies, preventing access attempts that would lock resources by comparing the number of attempts with the policy threshold before updating credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the system allows multiple credential validation attempts, then the new credential can be properly verified, but the resource may be locked due to exceeding the threshold lock policy value
Solution Approach 1:
The automation tool performs preliminary validation of the new credential by checking the current tracked attempt count against the threshold lock policy value before actually attempting to validate the credential. This preliminary check prevents the resource from being locked while still allowing proper credential verification to occur.
Solution Approach 2:
The automation tool acts as an intermediary between the credential change request and the resource validation process. It monitors and controls the validation attempts, managing the attempt count and preventing direct interactions that would cause resource locking, thereby mediating between security requirements and resource availability.
2Object-affected harmful factors
If the system strictly enforces the threshold lock policy value, then resource locking is prevented, but legitimate credential changes may be blocked
Solution Approach 1:
The system dynamically adjusts its behavior based on the current state of credential validation attempts. The automation tool monitors the tracked attempt count and adapts its validation process accordingly, allowing legitimate credential changes when the count is below the threshold while preventing resource locking when the threshold is approached, making the system flexible rather than rigid.
Solution Approach 2:
The automation tool implements feedback by continuously monitoring the tracked attempt count and using this information to control subsequent credential validation attempts. The system receives feedback about the current state of attempt tracking and adjusts its behavior to either allow or prevent validation attempts based on whether the threshold lock policy value would be exceeded.
Data Source
AI summary
The present disclosure relates to computer-implemented methods, software, and systems for mitigating risk of denial of services for protected resources, including: receiving a request to change an old log-in credential of an account for authenticating to access a resource to a new log-in credential, wherein the request is received from an entity authenticated at an automation tool that is configured to execute resource management operations over resources; determining, at the automation tool, whether to validate the new log-in credential by determining whether a tracked number of attempts to access the resource by the account has reached a threshold lock policy value for the resource; and in response to invalidating the new log-in credential by determining that the tracked number of attempts to access the resource exceeds the threshold lock policy value, denying, by the automation tool, changing the old log-in credential to the new log-in credential.