MFP Authentication Counter Logic Against Brute-Force Lockout Bypass
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems fail to effectively prevent lockout mechanisms from being bypassed by malicious attacks, such as brute force password attempts, due to the reset of authentication failure counts when authorized users periodically authenticate, thereby compromising security.
Innovation Solution
Implement a controller in the image processing apparatus that maintains authentication failure counts unless a specific condition is met, such as a status request command, to prevent unauthorized access and enhance lockout effectiveness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the authentication failure count is reset when authentication succeeds, then authorized users can continue accessing the system normally, but the lockout function becomes ineffective against brute force attacks
Solution Approach 1:
The patent applies local quality by differentiating the treatment of authentication failures based on the source. Authorized user failures are treated differently from unauthorized user failures. The system identifies the user type and applies selective reset logic: reset for authorized users, maintain count for unauthorized users, thereby achieving localized quality in failure count management
Solution Approach 2:
The patent inverts the conventional approach by not resetting the failure count for authorized users under certain conditions. Instead of universally resetting on successful authentication, the system inverts the logic to conditionally maintain the count, thereby strengthening lockout effectiveness while preserving legitimate access
2Reliability
If the authentication failure count is maintained without reset, then brute force attacks are effectively blocked, but legitimate authorized users may be incorrectly locked out
Solution Approach 1:
The patent applies preliminary action by identifying and authenticating authorized users before the lockout threshold is reached. The system performs preliminary verification of user authorization status and takes preventive action to reset the failure count for legitimate users before they would be locked out, thereby protecting both security and legitimate access
Solution Approach 2:
The patent implements feedback mechanisms where the system continuously monitors authentication patterns and user identity. Based on feedback about whether the user is authorized and whether polling behavior is detected, the system dynamically adjusts the failure count reset decision, enabling adaptive response to different authentication scenarios
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Every time authentication in steps using user information fails, a controller 210 of a multifunction peripheral 200 counts the cumulative failures N. In a case where the count of the cumulative failures N equals or exceeds a predetermined threshold, the controller 210 restricts the successful authentication. On the other hand, in a case where authentication is successful after the cumulative failures N has been incremented, the controller 210 initializes the cumulative failures N in a case where a specific condition is not satisfied, whereas the controller 210 maintains the cumulative failures N without initializing the cumulative failures N, in a case where the specific condition is satisfied.