Home Authentication Server Replay Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Systems with multiple authenticating functions are vulnerable to replay attacks, and disseminating high water mark (HWM) information across all authenticating functions becomes unwieldy as the number of tokens increases, affecting scalability and ensuring all functions have the most up-to-date information.
Innovation Solution
Each token is associated with a home authentication server that maintains its current HWM, and authenticating servers verify this information before allowing or denying authentication, reducing the need for all servers to have real-time HWM updates, thereby preventing replay attacks and improving system scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the flooding technique is used to propagate HWM information to all authenticating functions, then replay attacks are prevented, but system scalability is adversely affected and performance deteriorates as the number of tokens increases
Solution Approach 1:
The system segments the HWM propagation responsibility by assigning each token to a specific home authenticating function. Instead of flooding all HWM information to every authenticating function, only the home function maintains and propagates HWM information for its assigned tokens. This segmentation reduces the communication burden on the system while maintaining effective replay prevention.
Solution Approach 2:
The home authenticating function acts as an intermediary between the token and the authentication process. It maintains the HWM information and mediates the authentication decisions, eliminating the need for all authenticating functions to maintain up-to-date HWM information for all tokens. This intermediary approach reduces system-wide communication requirements.
2Reliability
If the flooding technique is used to disseminate HWM information, then replay attacks are thwarted, but it becomes difficult to ensure all authenticating functions have the most up-to-date HWM information
Solution Approach 1:
The system divides HWM information management into segmented domains where each home authenticating function is responsible for its assigned tokens. This ensures that HWM information remains fresh and accurate for each token without requiring system-wide propagation, as each home function independently maintains current information for its tokens.
Solution Approach 2:
The home authenticating function receives feedback from authentication attempts and updates HWM information accordingly. This feedback mechanism ensures that HWM information remains current and accurate, allowing the system to reliably detect replay attacks without requiring all authenticating functions to maintain up-to-date information.
3Productivity
If multiple authenticating functions are deployed to improve scalability and availability, then system performance improves, but vulnerability to replay attacks increases
Solution Approach 1:
The system segments authentication functions into multiple independent authenticating functions, each capable of serving different user populations. By assigning tokens to specific home functions, the system maintains replay prevention capabilities while allowing multiple functions to operate in parallel, improving overall system availability and scalability.
Solution Approach 2:
Each authenticating function maintains local HWM information for tokens assigned to it, rather than requiring global synchronization. This local quality approach allows multiple authenticating functions to operate independently with replay protection, improving system scalability while maintaining security.
Data Source
AI summary
A system for detecting and preventing replay attacks includes a plurality of interconnected authentication servers, and one or more tokens for generating a one-time passcode and providing the one-time passcode to one of the authentication servers for authentication. The system includes an adjudicator function associated with each authentication server. The adjudicator evaluates a high water mark value associated with a token seeking authentication, allows authentication to proceed for the token if the high water mark evaluation indicates that the one-time passcode was not used in a previous authentication, and prevents authentication if the high water mark evaluation indicates that the one-time passcode was used in a previous authentication. The token is associated with a home authentication server that maintains a current high water mark of the token. The home authentication server validates the current high water mark on behalf of the adjudicator function evaluating the token for authentication.