Authentication Server Faux Response Prevents User Enumeration

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional two-way authentication methods disclose whether a username is valid or not, allowing malicious users to perform enumeration attacks by distinguishing between genuine and faux responses, which is a security weakness.

Innovation Solution

Providing artificial or faux authentication session responses that resemble genuine responses, including machine-selected artifacts and password prompts, regardless of the username's validity, to prevent malicious users from determining the actual usage of usernames.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the authentication device provides evidence to confirm legitimacy when a username is found in the database, then the user can be convinced the authentication device is legitimate, but the authentication device discloses that the username is valid, enabling enumeration attacks

Engineering Contradiction:

Improveauthentication legitimacy confirmationVSAvoiduser enumeration vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies homogeneity by making the authentication response structure identical regardless of username validity. Both valid and invalid usernames receive the same type of response with artifacts and legitimacy confirmation, eliminating the informational difference that attackers exploit for enumeration. The response format, timing, and content structure are standardized to appear uniform from the user's perspective.

Inventive Principle:

Principle #33Homogeneity

Solution Approach 2:

The patent uses copying by generating artificial authentication responses that mimic genuine authentication responses. When a username is not found, the system creates a faux response that copies the structure, artifacts, and legitimacy confirmation of a real authentication response, making it indistinguishable from a genuine successful authentication to prevent enumeration attacks.

Inventive Principle:

Principle #26Copying

2Ease of operation

If the authentication device informs the user that a username is incorrect, then the user can correct the username, but the authentication device discloses that the username is not in the database, enabling enumeration attacks

Engineering Contradiction:

Improveusername correction capabilityVSAvoiduser enumeration vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent applies homogeneity by eliminating different response types based on username validity. Instead of providing different feedback for valid versus invalid usernames, the system provides a uniform response structure that includes legitimacy confirmation and artifact display for all usernames, preventing attackers from determining validity through response analysis while still allowing users to correct typos.

Inventive Principle:

Principle #33Homogeneity

Solution Approach 2:

The patent converts the harmful information disclosure about username validity into a benefit by using the same legitimacy confirmation mechanism for both valid and invalid usernames. The artificial responses for invalid usernames benefit from the same structure and artifacts as valid ones, which prevents enumeration while the system can still internally track and handle username corrections through other means.

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

3Productivity

If the authentication device provides different responses based on username validity, then the authentication process can be optimized for valid users, but security is weakened by enabling attackers to distinguish between valid and invalid usernames

Engineering Contradiction:

Improveauthentication processing efficiencyVSAvoidsecurity against enumeration attacks

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent applies homogeneity by standardizing the authentication response structure for all users regardless of username validity. The same types of artifacts, legitimacy confirmations, and response formats are provided uniformly, preventing security vulnerabilities while the system maintains internal efficiency through optimized processing paths that are invisible to the user.

Inventive Principle:

Principle #33Homogeneity

Solution Approach 2:

The patent uses copying to create artificial response templates that replicate genuine authentication responses. These copied response structures are used for both valid and invalid usernames, ensuring security against enumeration while allowing the system to process different username types through efficient internal logic that produces identical external response formats.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS8875255B1Preventing user enumeration by an authentication server

Publication Date: 2014.10.28 RSA SECURITY USA LLC

AI summary

An enumeration prevention technique involves receiving an authentication session request which includes a validation result indicating whether a user identifier supplied by the user identifies a valid user entry in a user database. The technique further involves providing a genuine authentication session response when the validation result indicates that the user identifier does identify a valid user entry in the user database. The genuine authentication session response includes a user-expected set of artifacts to confirm authenticity of the authentication server to the user. The technique further involves providing a faux authentication session response when the validation result indicates that the user identifier does not identify a valid user entry in the user database. The faux authentication session response includes a machine-selected set of artifacts enabling the faux authentication session response to resemble a genuine authentication session response.