Access Control Using Dual Login Counters for Password Guessing Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for protecting Web applications against online password guessing attacks are inadequate, as they can deny service to legitimate users, allow unlimited guesses through interleaved valid logins, and do not address password reuse or capture from other sites.
Innovation Solution
Implementing a system that uses both short and long counters to track incorrect login attempts, denying access after a selected number of consecutive failures and prompting password changes after a cumulative threshold is reached, while requiring instance names for secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a user account is locked out after a selected number of consecutive failed login attempts, then online password guessing attacks are limited, but legitimate users may be denied service
Solution Approach 1:
The patent segments the countermeasure into two distinct counters: a short counter that tracks consecutive failed attempts and a long counter that tracks total failed attempts. This segmentation allows the system to apply different responses to different types of attack patterns, preventing blanket denials of service while still protecting against brute force attacks.
Solution Approach 2:
The system dynamically adjusts access control based on the state of the counters. The short counter determines immediate access denial after a threshold of consecutive failures, while the long counter triggers password change requirements after a threshold of total failures. This dynamic response adapts to the nature and persistence of the attack.
2Ease of operation
If the lockout counter is reset after a valid login, then legitimate users can continue accessing the application, but attackers can interleave valid logins with invalid guesses to achieve unlimited password attempts
Solution Approach 1:
The patent divides the tracking mechanism into two separate counters with different functions: the short counter resets after valid logins to allow legitimate users continuous access, while the long counter persists across valid logins to track the total number of failed attempts and prevent unlimited guessing through interleaved attacks.
Solution Approach 2:
The system applies partial resetting to the short counter (resetting after valid login) while maintaining the long counter (not resetting). This partial action allows legitimate user convenience while still accumulating evidence of potential attacks over time.
3Reliability
If users are forced to change passwords after a selected time period (password aging), then the likelihood of successful password guessing is reduced, but user convenience is continually degraded
Solution Approach 1:
The system takes preliminary anti-action by implementing counter-based protection that proactively prevents password guessing attacks before they can succeed. The short and long counters detect and respond to attack patterns in real-time, preventing the need for preventive password changes that would degrade user convenience.
Solution Approach 2:
The system changes the parameter for password security from time-based (password aging) to attempt-based (counter thresholds). This parameter change allows the security measure to be triggered only when necessary (when attack patterns are detected) rather than forcing periodic changes regardless of threat level.
Data Source
AI summary
A method of controlling access to an interaction context of a multi-user application includes receiving and tracking over time login requests pertaining to one of a plurality of user accounts of a virtual application instance of the multi-user application, each login request including a login password and each user account including a user password. A login request for the user account is rejected when the login password fails to match the user password of the user account. Access to the user account is denied when a consecutive number of times a login request for the user account is rejected reaches a selected limit. The user is prompted to change the user password of the user account and given limited access to the user account to do so when the user password is a permanent password and a cumulative number of rejected login requests for the user account reaches a selected threshold.