Domain Controller MFA Handling with Cached Authentication Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing domain controller systems in computer networks rely solely on a single authentication factor, which can be compromised, and lack efficient mechanisms for implementing additional authentication factors without requiring additional hardware or servers.
Innovation Solution
A method and system that modifies the domain controller to integrate a sub-authentication routine, allowing for additional authentication factors, such as SMS notifications or device-based verification, without needing extra servers, and includes caching to manage delays in two-factor authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single authentication factor is used in the domain controller, then the authentication process is simple and fast, but the security is compromised
Solution Approach 1:
The authentication process is segmented into multiple independent factors (knowledge factor, possession factor, inherence factor). Each factor is evaluated separately by the domain controller, allowing the system to require only certain factors based on policy rather than always requiring all factors. This segmentation enables flexible security levels without requiring a complete redesign of the authentication system.
Solution Approach 2:
The authentication factor requirements are made dynamic through policy-based control. The domain controller dynamically determines which authentication factors are required based on the user account, resource being accessed, and security policies. This allows the system to adapt the authentication complexity in real-time, requiring more factors only when necessary, thus balancing security with usability.
2Reliability
If additional authentication factors are implemented, then security is enhanced, but hardware requirements and system complexity increase
Solution Approach 1:
The domain controller is enhanced to perform multiple authentication factor evaluations (knowledge, possession, inherence) using its existing processing capabilities. Rather than requiring separate hardware devices for each authentication factor, the domain controller universally handles all factor types through software-based policies, eliminating the need for additional authentication servers or specialized hardware.
Solution Approach 2:
The system uses resources that users already possess for authentication factors. For example, mobile devices that users already carry are utilized for possession factor authentication through SMS or push notifications. Biometric data stored on the user's own device is used for inherence factor authentication. This approach eliminates the need for the organization to provide additional hardware while still implementing multi-factor authentication.
3Speed
If authentication requests are processed immediately, then the response time is fast, but authentication failures occur due to delays in second factor delivery
Solution Approach 1:
The domain controller initiates the second factor authentication process immediately upon receiving the first factor, without waiting for the user to complete the second factor. SMS messages or push notifications are sent out preliminarily while the user is still completing the authentication. This preliminary action ensures that even if there are delays in second factor delivery, the authentication process has already been initiated and can be completed without timeout errors.
Data Source
AI summary
A method for managing an authentication request in a computer network comprising a domain controller. The method comprising the steps of: capturing an authentication request received from a client computer after the authentication request is treated by the domain controller but before any final decision is generated by the domain controller; piling the authentication request in a cache; determining whether the authentication request is a background refresh call or an interactive logon request by inspecting a log of the client computer from which the authentication request has been received; sending a notification to an electronic device associated with a user account indicated in the authentication request; applying a policy to the authentication request based on at least one of the user account identifier and an identification of the client computer; and generating a final decision based on the policy applied to the authentication request.