Dynamic Workfactor Authentication for Brute Force Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing brute force attack prevention methods, such as CAPTCHA and lockout mechanisms, are ineffective against increasing computer power and can inadvertently lock out legitimate users, causing server downtime.
Innovation Solution
A system that provides a challenge token and workfactor to clients, requiring them to generate a response token that satisfies a condition, such as a hash with a certain number of leading zero bits, before validating usernames and passwords, thereby increasing the computational burden on attackers and protecting the server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CAPTCHA is used to prevent brute force attacks, then computer automation is blocked, but computer power increases making CAPTCHA easier to solve
Solution Approach 1:
The patent dynamically changes the workfactor parameter based on the username being accessed. Different usernames are assigned different workfactor levels, allowing the system to adjust computational requirements in real-time. This resolves the contradiction by making brute force attacks economically unviable through parameter adaptation rather than relying on static barriers that computers can eventually overcome.
Solution Approach 2:
The system transitions from static defense mechanisms (fixed CAPTCHA or uniform lockout policies) to dynamic adjustment of workfactors based on username-specific risk assessment. The workfactor can change during the login process, increasing computational burden adaptively. This dynamic approach maintains effectiveness against evolving computer power while preserving user convenience.
2Reliability
If lockout mechanism is used after incorrect password attempts, then brute force attacks are stopped, but legitimate users are inadvertently locked out causing server downtime
Solution Approach 1:
The patent applies different workfactor levels to different usernames rather than a uniform lockout policy. Each username can have its own customized workfactor based on risk assessment, allowing legitimate users to experience minimal disruption while attackers face escalating computational barriers. This local differentiation resolves the contradiction between security and accessibility.
Solution Approach 2:
The system performs preliminary validation of the response token against the workfactor requirement before proceeding with password verification. This preliminary check prevents invalid login attempts from consuming server resources and potentially triggering lockout mechanisms, thereby protecting both against brute force attacks and false positives that would lock out legitimate users.
3Reliability
If workfactor is increased to prevent brute force attacks, then attacker computational burden increases, but system complexity increases
Solution Approach 1:
The patent replaces complex mechanical or procedural security systems with cryptographic hash functions and computational workfactors. Instead of implementing sophisticated multi-factor authentication systems or behavioral analysis infrastructure, the solution uses standard cryptographic operations (SHA-256 hashing) with variable difficulty parameters. This substitution maintains high security effectiveness while minimizing system complexity and infrastructure requirements.
Data Source
AI summary
A system for preventing a brute force attack includes an output interface, an input interface, and a processor. An output interface is to provide a workfactor, a challenge token, and a login page to a client. An input interface is to receive a response token, a username, and a password. A processor is to determine whether the response token satisfies a condition based at least in part on the workfactor and determine whether the username and password are valid in the event that it is determined that the response token satisfies the condition based at least in part on the workfactor.