Credential Verification System for Malicious Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprises face challenges in differentiating between malicious password guessing attempts and honest mistakes in user authentication, leading to bona fide users being locked out of their accounts unnecessarily, as existing security measures treat both scenarios equally.
Innovation Solution
A system and method that utilize a credentials verification system incorporating a Bloom filter and counters to differentiate between malicious password guessing and honest mistakes by tracking distinct user credential attempts and implementing threshold-based security policies, allowing for more sensitive locking mechanisms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the number of incorrect authentication attempts is limited to prevent malicious guessing, then security against credential guessing attacks is improved, but bona fide users may be frozen out due to honest mistakes
Solution Approach 1:
The patent segments the authentication attempt analysis by dividing credentials into distinct components (username, password, email, etc.) and tracking attempts per credential component rather than treating each full credential pair as a single unit. This allows the system to recognize when multiple attempts use variations of the same base credential (indicating honest mistakes) versus when completely different credentials are attempted (indicating malicious guessing).
Solution Approach 2:
The patent implements dynamic threshold adjustment based on the analysis of authentication patterns. The system adapts the number of allowed attempts dynamically - being more permissive when patterns suggest honest mistakes and more restrictive when patterns suggest malicious guessing. This resolves the contradiction by making the security measure flexible rather than static.
2Device complexity
If security measures treat all authentication failures equally, then implementation simplicity is maintained, but differentiation between malicious attacks and honest mistakes becomes impossible
Solution Approach 1:
The patent performs preliminary analysis of authentication attempts by tracking and storing credential components before making a final security determination. The system pre-processes authentication data to identify patterns of honest mistakes versus malicious guessing, enabling more accurate differentiation without significantly increasing system complexity.
Solution Approach 2:
The patent introduces an intermediary analysis layer that sits between the authentication failure detection and the security response execution. This intermediary layer analyzes the pattern of failures using credential component segmentation and determines whether the pattern indicates honest mistakes or malicious guessing, thereby improving detection accuracy without requiring complete system redesign.
Data Source
AI summary
A first identity claim and a first attempt to prove password possession are received. As a result of determining that the first attempt to prove password possession is a match to a password in a set of passwords, but that the first identity claim is a mismatch to an identity that corresponds to the password, an authentication process that includes incrementing a counter associated with the password is performed. A second identity claim and a second attempt to prove password possession is received. As a result of determining that the second attempt to prove password possession is a match to the password, an authentication process that includes incrementing the counter associated with the password only if the second identity claim is a mismatch to the first identity claim is performed.