Randomized Resource Limits for Multi-Passcode Account Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing account management systems are vulnerable to advanced persistent threats, as attackers can deduce the existence of additional passcodes by analyzing configuration information or resource usage, allowing them to continue attacking until they obtain all passcodes.
Innovation Solution
Implementing a computing system with randomized resource limits for accounts with multiple passcodes, where each passcode has different access levels, and using a limit generation component to randomly generate or assign limits, making it unpredictable for attackers to determine the existence of additional passcodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If account management systems store multiple passcodes with different access levels, then account security is improved, but attackers can deduce the existence of additional passcodes by analyzing configuration information or resource usage
Solution Approach 1:
The patent applies parameter changes by randomizing resource limits (such as storage capacity, bandwidth, or processing power) associated with each passcode. Instead of using fixed or predictable resource allocations, the system assigns random limits to each passcode, making it impossible for attackers to infer the existence of additional passcodes by analyzing resource usage patterns. This directly addresses the vulnerability where predictable resource allocation would reveal the presence of multiple passcodes.
2Object-affected harmful factors
If attackers can determine the maximum number of passcodes through analysis, then they can continue attacking until obtaining all passcodes, but implementing randomized resource limits makes the number of passcodes unpredictable
Solution Approach 1:
The patent introduces randomized resource limits as an intermediary layer between the passcode system and the attacker's analysis. These random limits act as a mediator that decouples the relationship between resource usage and passcode quantity, preventing attackers from using resource analysis to infer the number of passcodes. The randomized limits serve as a protective barrier that masks the true structure of the passcode system.
Solution Approach 2:
By changing the resource limit parameter from fixed to randomized values, the system eliminates the information leakage that would otherwise allow attackers to determine the maximum number of passcodes. Each passcode is associated with random resource constraints, making the total resource consumption unpredictable and unrelated to the actual number of passcodes in the system.
3Ease of operation
If all passcodes provide full access to resources, then ease of operation is improved, but security is reduced because compromised passcodes give attackers complete access
Solution Approach 1:
The patent applies local quality by assigning different resource limits to different passcodes based on their security requirements. Instead of giving all passcodes identical full access, each passcode receives customized resource allocation that matches its intended use case and security level. This allows frequently used passcodes to have appropriate resource access while limiting the potential damage from compromised passcodes.
Solution Approach 2:
The system segments resource access by passcode, dividing the previously monolithic full-access model into multiple differentiated access levels. Each passcode is segmented with its own specific resource limits, creating a hierarchy where no single passcode has unrestricted access to all resources. This segmentation ensures that compromise of one passcode does not expose the entire resource system.
Data Source
AI summary
Systems and methods for enhancing the security of an account by reducing the ability of an attacker to determine that an account includes multiple passcodes for accessing the account. An example method may comprise: accessing an account that comprises a first passcode providing constrained access to a set of computing resources and a second passcode providing unconstrained access to the set of computing resources; associating the account with a randomized resource limit that restricts a quantity of passcodes associated with the account; receiving a request to create a third passcode for the account; and denying the creation of the third passcode for the account in view of the randomized resource limit.