Credential Verification Using Device Trust for Account Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional account lockout mechanisms due to excessive login attempts can inadvertently lock out legitimate users and allow unauthorized access, as they do not differentiate between user and device credentials, leading to security and usability issues.
Innovation Solution
Implementing a system that uses both customer and device credentials to determine access requests, allowing additional login attempts from trusted devices and varying the number of attempts based on device recognition and circumstances, thereby differentiating lockout policies for trusted and untrusted devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If account lockout is implemented after maximum unsuccessful login attempts, then security against unauthorized access is improved, but legitimate users may be locked out due to application errors or repeated attempts
Solution Approach 1:
The patent segments the credential verification process into two independent components: user credentials (username/password) and device credentials (device identifier, device fingerprint, or device certificate). This segmentation allows the system to evaluate device trustworthiness separately from user authentication, enabling differentiated lockout policies where legitimate users can be excluded from lockout while maintaining security against unauthorized access attempts.
Solution Approach 2:
The patent applies local quality by implementing context-dependent lockout policies based on device characteristics. Trusted devices (those with verified device credentials) receive different treatment compared to untrusted devices. Specifically, users accessing from trusted devices are exempt from lockout even after multiple failed login attempts, while users from untrusted devices remain subject to standard lockout protections. This localized differentiation resolves the contradiction by applying security measures selectively rather than uniformly.
2Adaptability or versatility
If device credentials are incorporated into access determination, then ability to differentiate trusted devices is improved, but system complexity increases
Solution Approach 1:
The patent implements preliminary action by establishing device credentials and determining device trust status before processing user login attempts. The system pre-evaluates whether a device is trusted by verifying device credentials (such as device certificates or registered device identifiers) in advance. This preliminary device authentication creates a foundational trust relationship that simplifies subsequent login processing, as the system can then apply pre-determined lockout policies based on device status rather than having to complexly analyze each login attempt in isolation.
Solution Approach 2:
The patent introduces device credentials as an intermediary element between the user and the authentication system. Rather than directly evaluating user credentials in isolation, the system uses device credentials as a mediating factor that influences the overall access determination. This intermediary layer provides a structured mechanism for incorporating device trustworthiness into the authentication process without requiring fundamental restructuring of the credential verification system, thereby managing complexity while enhancing adaptability.
Data Source
AI summary
Access to resources or data can be managed based at least in part upon a validation of credentials. A customer can have customer credentials, such as a username and password pair, that can be used to obtain access according to terms of a customer account. A computing device used to gain the access can also have device credentials, which can be based upon identifying information from the device or provided to the device upon a successful login. The customer account might be locked for a period of time if a number of unsuccessful login attempts are received over a designated period of time. If, however, a request is received with device credentials for a trusted and/or recognized device, at least one additional login attempt might be granted in order to prevent a customer from being locked out of the account due to actions of other persons and/or devices.