Smart Lockout with Location-Specific Counters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional password lockout methods suffer from high false-positive rates, causing user friction and inadvertently locking legitimate users out of their accounts, especially due to brute-force attacks from unfamiliar locations and devices with cached passwords.
Innovation Solution
Implementing a smart password system with multiple counters for familiar and unfamiliar locations, and maintaining a list of recent incorrect password hashes to prevent unnecessary lockouts, allowing only the first failed attempt to increment the counter for repeated incorrect passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional counter-based lockout method is used to detect brute-force attacks, then account security is improved, but user friction increases due to high false-positive rates
Solution Approach 1:
The patent segments the single failure counter into multiple location-specific counters (e.g., counter for New York, counter for London, etc.). Each counter independently tracks failed login attempts from its associated location. This segmentation allows the system to distinguish between legitimate users accessing from familiar locations and potential attackers from unfamiliar locations, thereby reducing false positives while maintaining security.
Solution Approach 2:
The patent applies local quality by assigning different lockout thresholds and behaviors to different geographic locations. Familiar locations (where the user has successfully logged in before) have more lenient lockout policies, while unfamiliar locations have stricter policies. This localized approach ensures that legitimate users experience minimal friction while maintaining strong security against brute-force attacks from unknown locations.
2Reliability
If the account is locked after a specified number of incorrect password attempts, then protection against unauthorized access is improved, but legitimate users may be locked out due to cached passwords on devices
Solution Approach 1:
The patent segments the lockout mechanism by location, creating separate counters for different geographic regions. When a user changes their password, the system can selectively reset counters for familiar locations while maintaining locks on unfamiliar locations. This allows legitimate users with cached passwords on their own devices to regain access without compromising security against external attackers.
Solution Approach 2:
The patent implements feedback mechanisms where the system learns from successful login patterns and updates the set of familiar locations. When a user successfully logs in from a new location, that location is added to their familiar locations list. This feedback loop allows the system to adapt to legitimate usage patterns while maintaining protection against brute-force attacks, reducing false positives over time.
3Ease of operation
If successful logins reset incorrect password counters to zero, then user convenience is improved, but malicious actors gain increased opportunities to guess passwords
Solution Approach 1:
The patent segments the counter reset behavior by location. Successful logins reset counters for familiar locations, maintaining user convenience for legitimate access. However, counters for unfamiliar locations are not reset by successful logins from other locations, preventing malicious actors from exploiting successful logins to refresh their attack window. This selective reset approach balances convenience and security.
Solution Approach 2:
The patent makes the counter reset behavior dynamic rather than static. The system dynamically determines whether to reset a counter based on the relationship between the login location and the counter's associated location. If a successful login occurs from the same location as the counter, the counter is reset. If the login is from a different location, the counter behavior depends on whether it's a familiar or unfamiliar location. This dynamic approach adapts to the context of each login attempt.
Data Source
AI summary
Embodiments are directed to having multiple lockout counters that apply to login requests from different origins. More specifically, one counter is associated with a user's familiar locations, another counter is associated with unfamiliar locations. In another embodiment, hashes of incorrect passwords are recorded so that lockout counters are not incremented multiple times when the same incorrect password is entered repeatedly.