NTLM Token Protection via Server-Side Challenge Response
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing single sign-on (SSO) authentication protocols, such as NTLM, are vulnerable to Pass-the-Hash attacks where stolen authentication tokens can be used to access domain services without the underlying authentication factor, compromising security even with secure authentication factors like smartcards.
Innovation Solution
Implementing an intelligent authentication server that stores and manages NTLM authentication tokens, preventing clients from storing these tokens, and instead using them to compute and forward responses to challenges, thereby protecting against token theft and misuse.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the client stores the NTLM authentication token for single sign-on access, then authentication convenience is improved, but security is worsened due to vulnerability to Pass-the-Hash attacks
Solution Approach 1:
The patent extracts the authentication token from the client device and stores it exclusively on the authentication server. The client no longer possesses or stores the NTLM hash, eliminating the security vulnerability while maintaining SSO functionality through server-side token management and challenge-response computation.
Solution Approach 2:
The authentication server acts as an intermediary between the client and domain services. It holds the authentication token securely, receives challenges from services, computes responses using the stored token, and returns responses to clients without exposing the token itself, thus mediating authentication while preserving security.
2Reliability
If the authentication server stores and manages NTLM tokens centrally, then security is improved by preventing token theft, but system complexity is worsened
Solution Approach 1:
The authentication server performs multiple functions: it stores authentication tokens, receives service challenges, computes challenge responses using stored tokens, validates authentication, and manages token lifecycle. This multi-functionality consolidates security operations in a single system rather than distributing complexity across multiple components.
Solution Approach 2:
The authentication server autonomously manages the authentication token lifecycle including secure storage, retrieval for challenge response computation, validation, and rotation. The system self-manages security operations without requiring complex client-side security implementations or additional security infrastructure.
3Speed
If the client computes challenge responses using stored authentication tokens, then authentication speed is improved, but security is worsened due to token exposure risk
Solution Approach 1:
The authentication server mediates the challenge-response process by receiving challenges from services, computing responses using securely stored tokens, and returning responses to clients. This eliminates the need for clients to store or process authentication tokens while maintaining fast authentication through pre-computed or quickly computable responses.
Solution Approach 2:
The authentication token is extracted from the client environment and relocated to the secure server environment. The client only handles challenge-response communication without possessing the token, eliminating security risks while preserving authentication performance through server-side token management.
Data Source
AI summary
Described embodiments include an apparatus, comprising a communication interface and a processor. The processor is configured to obtain an NT Local Area Network Manager (NTLM) authentication token, which authenticates a client device to a service using an NTLM authentication protocol. The processor is further configured to, subsequently to obtaining the NTLM authentication token, receive, via the communication interface, from another processor that belongs to the client device, a challenge that was sent to the client device by the service in response to a request, from the client device, to access the service. The processor is further configured to, using the NTLM authentication token, compute a response to the received challenge, and to communicate the computed response to the client device, without exposing the NTLM authentication token to the client device. Other embodiments are also described.