Dynamic Authentication Window for Trojan Login Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication systems are vulnerable to Trojan attacks, where stolen login information can be used to gain unauthorized access due to the large window allowing subsequent token codes, even if the initial code is out of synchronization.
Innovation Solution
Implementing a stricter authentication procedure by selectively disabling the large window after a successful login, requiring a normal authentication if the user has not logged in recently, and a more demanding procedure if the user has logged in recently, rejecting login attempts if the initial token code is not within the small window.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the large window is enabled to accept subsequent token codes, then users with clock drift can be conditionally authenticated, but the system becomes vulnerable to Trojan attacks where stolen login information can be used for unauthorized access
Solution Approach 1:
The system dynamically adjusts the authentication window size based on the time since the user's last login. For recent logins (within threshold period), only the small window is accepted. For older logins, the large window is enabled to accommodate clock drift. This dynamic adaptation resolves the contradiction by applying strict security recently while maintaining usability for legitimate users with drift over time.
Solution Approach 2:
The authentication parameters (window size) are changed based on the time parameter. The system transitions between two operational modes: a strict mode with small window for recent logins and a lenient mode with large window for older logins. This parameter change allows the system to balance security and reliability based on temporal context.
2Object-affected harmful factors
If the small window is used for recent logins to prevent Trojan attacks, then security is improved, but legitimate users with clock drift may be rejected
Solution Approach 1:
The system dynamically switches between strict and lenient authentication modes based on the time since last login. This ensures that legitimate users experiencing clock drift are not unfairly penalized, while recent login attempts remain secure against Trojan attacks.
Solution Approach 2:
The system performs a preliminary check of the login timestamp to determine which authentication mode to apply. This preliminary action allows the system to prepare the appropriate authentication parameters before validating the token code, ensuring both security and user convenience.
3Adaptability or versatility
If the system accepts subsequent token codes for users with clock drift, then authentication flexibility is improved, but the system cannot distinguish between legitimate users and fraudsters
Solution Approach 1:
The authentication process is segmented into two distinct paths based on login recency. One path for recent logins with strict validation, and another path for older logins with flexible validation. This segmentation allows the system to maintain flexibility for legitimate users while improving fraud detection precision through temporal distinction.
Solution Approach 2:
The system uses feedback from the login timestamp to adjust authentication behavior. By monitoring when the user last logged in, the system can adapt its acceptance criteria for token codes, improving both flexibility and fraud detection through context-aware decision making.
Data Source
AI summary
A method of detecting a fraudulent login attempt across a network is provided. The method includes (a) receiving, at some time, a login request from a client, the login request including (1) a username associated with a user account, (2) a static password associated with the user account, and (3) a one-time password provided by a token, (b) calculating whether the time is more than a predetermined amount of time after a most-recent login to the account, (c) when the time is more than the predetermined time since the most-recent login, accepting the login request according to a first mode, and (d) when the first time is not more than the predetermined time since the most-recent login, accepting the login request according to a second mode, the second mode rejecting a greater proportion of login attempts than the first mode rejects. An apparatus and computer program product are also provided.