Cumulative Login Credit System for Brute-Force Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password security systems are vulnerable to brute-force attacks, as attackers can rapidly try permutations of user names and passwords, with current defenses like password resets and account locking being impractical or ineffective.
Innovation Solution
Implementing a cumulative login credit system that replenishes credits based on legitimate user logins, limiting the frequency of invalid attempts, and providing a uniform notification for both valid and invalid login attempts, thus making the system non-deterministic for attackers while maintaining fast processing for legitimate users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the login processing rate R is increased to improve user response time, then user login efficiency is improved, but the password breaking capability of attackers is also increased
Solution Approach 1:
The system dynamically adjusts the validation behavior based on the credit balance. When credit is available, fast validation is performed; when credit is depleted, validation is slowed down or blocked. This dynamic adjustment allows the system to maintain high processing rates for legitimate users while preventing attackers from exploiting high rates for password breaking.
Solution Approach 2:
The system changes the parameter of validation speed based on credit availability. By controlling the rate parameter dynamically - fast when credits are positive, slow or stopped when credits are negative - the system resolves the contradiction between high processing rate and security.
2Reliability
If account locking is implemented after a certain number of login failures to defend against attacks, then password breaking attempts are limited, but legitimate users may be locked out and user convenience deteriorates
Solution Approach 1:
The system uses credit balance as feedback to control validation. Instead of a fixed lockout threshold, the system continuously monitors credit consumption and adjusts validation availability accordingly. This feedback mechanism prevents both attack exploitation and false locking of legitimate users.
Solution Approach 2:
The validation availability is dynamically adjusted based on real-time credit balance rather than using a static lockout policy. This dynamic approach allows flexible response to different user behaviors - blocking attackers who deplete credits quickly while allowing legitimate users with valid credentials to succeed before credit depletion.
3Reliability
If longer passwords are enforced to increase password breaking time, then security against brute force attacks is improved, but user memory difficulty and system enforcement complexity increase
Solution Approach 1:
The credit system acts as an intermediary mechanism between the password and the attacker. Instead of relying solely on password length to provide security, the credit system mediates the validation process, controlling the rate and availability of validation attempts. This intermediary approach provides security without requiring users to remember longer, more complex passwords.
4Reliability
If frequent password resets are implemented to defend against brute force attacks, then password breaking is thwarted, but user convenience and system practicality deteriorate
Solution Approach 1:
The system performs preliminary credit allocation before any login attempts occur. This preliminary action establishes a budget of validation attempts that prevents attackers from conducting extensive brute force attacks without requiring actual password changes. The credit mechanism proactively limits attack potential before attacks begin.
Data Source
AI summary
Login credit is monitored over a credit time period. Continuous invalid login attempts decrease the login credit for the duration of the credit time period. Login credit accumulates with time. If the login credit is less than a credit threshold, login processing is precluded. A common invalid login notification for presentation to a user is generated if login processing is precluded or if login processing indicates that the login credentials are invalid.