Endpoint Security via Hashing and Modulo Redirection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing server systems face security vulnerabilities due to enumeration attacks, where attackers use brute force techniques to find valid user identifiers by attempting multiple entries, and existing authentication mechanisms fail to distinguish between valid and invalid identifiers effectively.
Innovation Solution
Implementing a hashing algorithm and modulo operation to redirect all invalid user identifiers to the same decoy or real endpoint URL, making it impossible for attackers to determine the validity of the identifier, and ensuring that both valid and invalid attempts result in the same endpoint URL presentation, thus preventing timing attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate authentication screens are used for user identifier and password entry, then authentication security is improved, but vulnerability to enumeration attacks increases
Solution Approach 1:
The patent applies homogeneity by making the response to both valid and invalid user identifiers identical - both redirect to the same endpoint URL format. This eliminates the differential response that attackers exploit in enumeration attacks, while maintaining the separate authentication screen structure for security.
Solution Approach 2:
The endpoint URL acts as an intermediary that masks the actual validation outcome. Instead of directly indicating whether a user identifier is valid or invalid, the system redirects to an endpoint URL that appears valid in both cases, preventing attackers from using response analysis to enumerate valid identifiers.
2Ease of operation
If endpoint URLs are displayed to users after user identifier entry, then user experience is improved, but information leakage to attackers increases
Solution Approach 1:
The patent creates a copy or facade of the endpoint URL that is presented to users regardless of validation outcome. The displayed endpoint URL appears legitimate and functional, but in reality redirects to the same authenticated endpoint, preventing information leakage while maintaining user experience.
3Reliability
If timing variations are introduced in authentication responses, then attack detection capability is improved, but vulnerability to timing attacks increases
Solution Approach 1:
The patent applies equipotentiality by ensuring that the authentication process takes the same amount of time regardless of whether the user identifier is valid or invalid. Both paths go through the same endpoint URL and authentication flow, eliminating timing differences that could be exploited by attackers.
Data Source
AI summary
Systems, devices, and techniques are disclosed for endpoint security. A user identifier entered into a first authentication screen used to access endpoints hosted on a server system may be received from a user computing device. The user identifier may be determined to be an invalid user identifier for the server system. The user identifier may be hashed to generate a hashed user identifier. An endpoint number may be determined as the hashed user identifier modulo a number of endpoint records assigned numbers on the server system. An endpoint URL may be retrieved from an endpoint record of the server system that is associated with a number equal to the endpoint number. The endpoint URL and data for a second authentication screen including a control for password entry may be sent to the user computing device. The endpoint URL may be displayed on the second authentication screen.