Uniform Authentication Response to Prevent Enumeration Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems are vulnerable to enumeration attacks, where malicious users can determine the validity of user accounts by differentiating between incorrect user identifiers and passwords through varying response times and messages.
Innovation Solution
An administrative or authentication server returns the same response message for invalid login credentials, regardless of whether the user identifier does not match, the account is locked, or the password is incorrect, with the response sent after a consistent measured time, preventing users from determining which credential was invalid and mitigating enumeration attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If different response messages are returned for different types of invalid credentials (user identifier vs. password), then users receive specific feedback about their login errors, but attackers can perform enumeration attacks to determine valid user accounts
Solution Approach 1:
The patent applies local quality by providing different information to different entities: legitimate users receive generic error messages to prevent enumeration, while administrators receive detailed logs with specific error types for troubleshooting. This selective information distribution resolves the contradiction between user feedback clarity and security.
Solution Approach 2:
The patent introduces an intermediary layer (the authentication server's response mechanism) that transforms detailed authentication failures into uniform generic error messages. This intermediary prevents direct exposure of system internals to users while maintaining security, effectively blocking enumeration attacks without compromising user experience.
2Speed
If the system returns different response times for different authentication outcomes, then users receive immediate feedback, but attackers can use timing analysis to determine account validity
Solution Approach 1:
The patent applies equipotentiality by ensuring all authentication responses (whether for valid users, invalid users, or locked accounts) are returned with the same delay time. This equalizes the response characteristics across different authentication outcomes, making timing analysis ineffective for enumeration attacks while maintaining consistent user experience.
Solution Approach 2:
The patent implements preliminary action by introducing a standardized delay before returning authentication responses. This pre-delay is applied uniformly to all authentication attempts, preventing attackers from using response timing to infer account validity, while still providing timely feedback to legitimate users.
3Reliability
If throttling mechanisms are implemented to limit failed login attempts, then brute force attacks are prevented, but legitimate users may experience false lockouts and service disruption
Solution Approach 1:
The patent extracts the enumeration prevention function from the authentication response mechanism itself, separating it from the throttling mechanism. By preventing information leakage through uniform error messages and timing, the system eliminates the need for aggressive throttling, thereby preventing attacks without causing false lockouts of legitimate users.
Solution Approach 2:
The patent converts the potential harm of detailed error messages (which could aid attackers) into a benefit by using generic messages that actually protect against enumeration attacks. This approach prevents attacks without requiring restrictive throttling, thereby maintaining user accessibility while ensuring security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In an embodiment, an administrative computer system receives user login credentials from a user and makes at least one of the following determinations: that the user identifier does not match any existing user account, that the user identifier matches at least one existing user account, but that the user's account is in a locked state, or that the user identifier matches at least one existing user account, but the user's password does not match the user identifier. The administrative computer system then returns to the user the same response message regardless of which determination is made. The response indicates that the user's login credentials are invalid. The response also prevents the user from determining which of the credentials was invalid, as the response message is the same for each determination and is sent to the user after a measured response time that is the same for each determination.