Selective Query Authentication via Dynamic Threshold Adjustment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication schemes in computer systems require significant computational effort to validate requests, leading to performance degradation when handling high volumes of queries, and fail to effectively prevent malicious activities such as database scraping and whitelisting attacks, especially with network address translation (NAT) devices and small IP address ranges.
Innovation Solution
Implementing a method to selectively authenticate requests based on an authentication policy, where an authentication threshold is applied to determine which requests to authenticate, and dynamically modifying this threshold based on successful or unsuccessful authentication attempts, including the use of authentication tokens, blacklists, and probability values to optimize server performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication is performed on all requests, then security is improved, but server performance deteriorates
Solution Approach 1:
The patent applies partial authentication by selecting only a subset of requests for authentication based on probability values and thresholds. Instead of authenticating all requests, the system randomly selects requests for authentication, reducing the computational burden on the server while maintaining security through statistical sampling. This resolves the contradiction by performing authentication on fewer requests (improving performance) while still providing security coverage (maintaining reliability).
Solution Approach 2:
The system dynamically adjusts the authentication probability parameter based on observed request patterns, client behavior, and security threats. By changing the authentication probability parameter, the system can balance security and performance - increasing authentication rates when threats are detected and decreasing them during normal operation to maintain server performance. This resolves the contradiction by making authentication intensity adaptive rather than fixed.
2Reliability
If authentication probability is increased, then security is improved, but server load increases
Solution Approach 1:
The patent implements dynamic adjustment of authentication probability based on real-time server conditions, request characteristics, and security metrics. The system monitors server load and automatically adjusts the authentication probability parameter - increasing it when security threats are detected and decreasing it when server load is high. This resolves the contradiction by making the authentication rate adaptive, allowing the system to maintain security while responding to changing server capacity conditions.
Solution Approach 2:
The system uses feedback from authentication outcomes, server performance metrics, and request patterns to continuously adjust authentication probability. Successful authentications and detected attack patterns feed back into the system to modify future authentication decisions. This feedback mechanism allows the system to improve security through learning while avoiding unnecessary authentication of benign requests, thereby managing server load effectively.
3Reliability
If authentication threshold is lowered, then more requests are authenticated improving security, but processing time increases
Solution Approach 1:
The system applies authentication selectively to a portion of requests rather than all requests, using probability-based sampling to determine which requests undergo authentication. This partial application of authentication reduces the total processing time while maintaining security coverage through statistical sampling. The threshold determines what fraction of requests are authenticated, balancing security coverage against processing time.
Data Source
AI summary
A computer-implemented method for selectively authenticating a request based on an authentication policy is described. A request is received from a client. A determination is made as to which authentication threshold is applied to the request based on an authentication policy. The request is authenticated if the authentication threshold is satisfied. The authentication threshold is modified if the request is not successfully authenticated.