Remote Monotonic Counter for Login Rollback Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures are vulnerable to replay attacks, where attackers can restore a device to a previous state to bypass login attempts and guess passwords repeatedly, compromising sensitive data.
Innovation Solution
The implementation of a remote counter and a protected module, combined with encryption and monotonic counter mechanisms, to securely manage login attempts and prevent rollback attacks by incrementing a counter and enforcing cooling periods between attempts, thereby making repeated guessing costly in time and reducing the risk of unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a security policy executes a wipe after maximum unsuccessful login attempts, then data protection is improved, but the system becomes vulnerable to replay attacks where attackers restore the disk to previous states to bypass the wipe
Solution Approach 1:
The patent applies preliminary action by establishing a monotonic counter that continuously increments with each login attempt before the wipe occurs. This counter state is preserved in secure storage and used to detect rollback attempts. The counter prevents replay attacks by ensuring that the login attempt number always increases, making it impossible for attackers to restore to previous states and retry failed attempts.
Solution Approach 2:
The patent implements feedback by monitoring the monotonic counter state and using it to determine whether to allow or block login attempts. The system continuously checks the counter reading to verify that each attempt is more recent than the previous one, providing real-time feedback that prevents rollback attacks while maintaining the security wipe policy.
2Ease of operation
If the system allows multiple login attempts, then ease of operation is improved, but the risk of unauthorized access increases
Solution Approach 1:
The patent applies dynamics by making the login policy adaptive rather than static. The system dynamically adjusts its behavior based on the monotonic counter state, allowing a certain number of attempts when the counter indicates legitimate usage patterns while blocking attempts that would constitute replay attacks. This dynamic policy maintains ease of operation for legitimate users while preventing unauthorized access.
Solution Approach 2:
The patent changes the parameter of login attempt allowance based on the monotonic counter reading. Instead of a fixed limit, the system uses the counter state to determine the current policy state, allowing flexibility in the number of permitted attempts while maintaining security. This parameter change enables the system to balance accessibility and security based on actual usage conditions.
3Reliability
If a monotonic counter is used to track login attempts, then security against replay attacks is improved, but device complexity increases
Solution Approach 1:
The patent extracts the critical security function into a separate, dedicated monotonic counter mechanism that operates independently from the main login processing logic. This extracted counter is stored in secure storage and managed by a dedicated driver, isolating the complexity of replay attack protection from the rest of the system while maintaining its security function.
Solution Approach 2:
The patent introduces a monotonic counter driver as an intermediary component between the login processing logic and the security policy enforcement. This driver manages the counter state, reads from secure storage, and provides the necessary information to determine policy actions, simplifying the overall system architecture by centralizing counter management functionality.
Data Source
AI summary
In one embodiment, an encryption system may protect user login metadata from hammering attacks. A data storage may store an integrity protected data set for an operating system in a storage location. A processor may register a counter reading from a remote counter in a secure location separate from the storage location. The processor may determine a lockout state of the integrity protected data set based on the counter reading.