Server-Side PIN Verification to Block Brute Force Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing device-based authentication systems are vulnerable to brute force attacks, as attackers can manipulate local counter mechanisms to bypass PIN or password verification, allowing unauthorized access to secure resources.
Innovation Solution
Implement a server-side lock mechanism that verifies PIN or password attempts remotely, generating OTPs or cryptographic operations only if the input is correct, and using server-generated secrets to protect private keys, thereby preventing attackers from determining the correct credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a local counter mechanism is used to lock the application after a certain number of wrong PIN attempts, then brute force attacks are mitigated, but the counter can be manipulated or reset by attackers who hack the device database
Solution Approach 1:
The patent introduces an authentication server as an intermediary between the user device and the secure resource. The server maintains the lock counter and verification logic, acting as a trusted mediator that prevents local manipulation. The device application no longer performs local verification but instead sends credentials to the server, which enforces the lock mechanism remotely, eliminating the vulnerability to local counter manipulation.
Solution Approach 2:
The verification logic and lock counter are extracted from the device application and relocated to the authentication server. By removing the vulnerable local counter mechanism and replacing it with server-side enforcement, the system eliminates the security weakness while maintaining the brute force protection functionality.
2Ease of operation
If PIN or password verification is performed locally on the device, then authentication is fast and convenient, but the device becomes vulnerable to offline brute force attacks
Solution Approach 1:
The authentication server serves as an intermediary that performs the verification remotely. The device application quickly submits credentials to the server, and the server responds with authentication results. This maintains ease of operation while eliminating offline attack vulnerability, as the actual verification occurs on the secure server rather than the potentially compromised device.
Solution Approach 2:
The patent replaces the local mechanical verification system (device-based PIN checking) with a remote cryptographic verification system. Instead of performing cryptographic operations locally that could be attacked offline, the system uses server-based verification that requires online communication, substituting the vulnerable local mechanism with a secure remote one.
3Device complexity
If the application stores the counter locally in the device database, then the lock mechanism is simple to implement, but attackers can restore the database to an older state to bypass the lock
Solution Approach 1:
The authentication server acts as an intermediary that maintains the authoritative copy of the lock counter. Instead of storing the counter locally in the device database, the server stores and manages the counter state remotely. This eliminates the vulnerability to database restoration attacks while maintaining implementation simplicity, as the server handles all counter management operations centrally.
Solution Approach 2:
The counter storage and management functionality is extracted from the local device database and relocated to the authentication server. By removing the counter from the vulnerable local storage and placing it on the secure server, the system eliminates the database restoration vulnerability while keeping the overall system simple through centralized management.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of device authentication comprises receiving a password into an application of a user device; transmitting verification information of the password from the application to an authentication device; verifying, by the authentication device, validity of the password using the verification information; granting, by the authentication device, access by the user device to a secure resource when the password is valid; sending no indication of an invalid password to the user device when the authentication device determines the password is invalid; and blocking access of the user device to the secure resource when a predetermined number of passwords are determined to be invalid by the authentication device.