EFFICIENTLY THROTTLING USER AUTHENTICATION

• US 20130198819A1
• Filed: 02/01/2012
• Published: 08/01/2013
• Est. Priority Date: 02/01/2012
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Gordon, Ariel, Lundeen, Richard Allen
• Granted Patent: US 8,898,752 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/082 using revocation of authorisation

Abstract

In an embodiment, an administrative computer system receives user login credentials from a user and makes at least one of the following determinations: that the user identifier does not match any existing user account, that the user identifier matches at least one existing user account, but that the user'"'"'s account is in a locked state, or that the user identifier matches at least one existing user account, but the user'"'"'s password does not match the user identifier. The administrative computer system then returns to the user the same response message regardless of which determination is made. The response indicates that the user'"'"'s login credentials are invalid. The response also prevents the user from determining which of the credentials was invalid, as the response message is the same for each determination and is sent to the user after a measured response time that is the same for each determination.

Claims

1. At an authentication server computer system including at least one processor and a memory, in a computer networking environment including a plurality of computing systems, a computer-implemented method for efficiently authenticating users while preventing enumeration attacks, the method comprising:

an act of receiving user login credentials from a user, the user login credentials including a user identifier and a password;

an act of making at least one of the following determinations;

determining that the user identifier does not match any existing user account;

determining that the user identifier matches at least one existing user account, but the user'"'"'s account is in a locked state; and

determining that the user identifier matches at least one existing user account, but the user'"'"'s password does not match the user identifier; and

an act of returning to the user the same response message regardless of which determination is made, the response message indicating that the user'"'"'s login credentials are invalid, wherein the response message prevents the user from determining which of the credentials was invalid, as the response message is the same for each determination and is sent to the user after a measured response time that is the same for each determination.

2. The method of claim 1, wherein the response messages are stored without storing state information for non-existing accounts.

3. The method of claim 1, further comprising tracking the number of failed login attempts for each user.

4. The method of claim 3, further comprising:

an act of determining that the number of failed login attempts is greater than a predefined maximum number; and

an act of placing the user'"'"'s account in a locked state for a specified amount of time, wherein the user is prevented from logging in while the user'"'"'s account is in the locked state.

5. The method of claim 3, further comprising:

an act of determining that the number of failed login attempts is not greater than a predefined maximum number; and

an act of incrementing a failed login attempt counter associated with the user by one, wherein the user is not informed of the incremented counter and wherein the user'"'"'s account is locked upon the failed login attempt counter reaching a predefined maximum value.

6. The method of claim 1, wherein a delay is generated and applied to ensure that each response message is sent to the user after the same amount of time has elapsed since the user'"'"'s login credentials were received.

7. The method of claim 6, wherein the length of the delay is variable and is dynamically generated for each login attempt to ensure that each response is sent after the same amount of time has elapsed since the user'"'"'s login credentials were received.

8. At a client computer system including at least one processor and a memory, in a computer networking environment including a plurality of computing systems, a computer-implemented method for providing login error messages while preventing enumeration attacks, the method comprising:

an act of sending user login credentials from a user to an authentication server, the user login credentials including a user identifier and a password, the authentication server making at least one of the following determinations;

determining that the user identifier does not match any existing user account;

determining that the user identifier matches at least one existing user account, but the user'"'"'s account is in a locked state; and

determining that the user identifier matches at least one existing user account, but the user'"'"'s password does not match the user identifier; and

an act of receiving a response message from the authentication server indicating that the user'"'"'s credentials are invalid, wherein the response message prevents the user from determining which of the credentials was invalid as the response message is the same for each determination and is received by the user after a measured response time that is the same for each determination.

9. The method of claim 8, wherein a cookie is created on the client computer system to track one or more portions of information associated with the user'"'"'s login attempts.

10. The method of claim 9, wherein at least one of the portions of information associated with the user'"'"'s login attempts comprises a failed login attempt counter.

11. The method of claim 10, further comprising:

an act of accessing the cookie on the client computer system to determine whether the number of failed login attempts is greater than a predefined maximum number; and

upon determining that the number of failed login attempts is not greater than a predefined maximum number, an act of incrementing the failed login attempt counter by one.

12. The method of claim 11, wherein the processing of the cookie on the client computer system prevents the user from gaining knowledge that the account has been locked out by looking at the cookie in the response message.

13. The method of claim 10, further comprising:

an act of accessing the cookie on the client computer system to determine whether the number of failed login attempts is greater than a predefined maximum number; and

upon determining that the number of failed login attempts is greater than a predefined maximum number, an act of displaying a message to the user indicating that the user'"'"'s account has been locked out.

14. The method of claim 8, wherein a failed login attempt counter is stored in hypertext markup language (HTML) local storage on the client computer system.

15. The method of claim 14, further comprising:

an act of accessing the failed login attempt counter in the HTML local storage to determine whether the number of failed login attempts is greater than a predefined maximum number; and

upon determining that the number of failed login attempts is not greater than a predefined maximum number, an act of incrementing the failed login attempt counter in the HTML local storage by one.

16. The method of claim 14, further comprising:

an act of accessing the failed login attempt counter in the HTML local storage to determine whether the number of failed login attempts is greater than a predefined maximum number; and

upon determining that the number of failed login attempts is greater than a predefined maximum number, an act of displaying a message to the user indicating that the user'"'"'s account has been locked out.

17. A computer system comprising the following:

one or more processors;

system memory;

one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, causes the computing system to perform a method for efficiently authenticating users while preventing enumeration attacks, the method comprising the following;

an act of receiving user login credentials from a user, the user login credentials including a user identifier and a password;

an act of making at least one of the following determinations;

determining that the user identifier does not match any existing user account;

determining that the user identifier matches at least one existing user account, but the user'"'"'s account is in a locked state; and

determining that the user identifier matches at least one existing user account, but the user'"'"'s password does not match the user identifier; and

an act of returning to the user the same response message regardless of which determination is made, the response indicating that the user'"'"'s login credentials are invalid, wherein the response message prevents the user from determining which of the credentials was invalid as the response message is the same for each determination and is sent to the user after a measured response time that is the same for each determination.

18. The computer system of claim 17, further comprising:

an act of tracking the number of failed login attempts for each user;

an act of determining that the number of failed login attempts is greater than a predefined maximum number; and

an act of placing the user'"'"'s account in a locked state for a specified amount of time, wherein the user is prevented from logging in while the user'"'"'s account is in the locked state.

19. The computer system of claim 17, further comprising:

an act of tracking the number of failed login attempts for each user;

an act of determining that the number of failed login attempts is not greater than a predefined maximum number; and

an act of incrementing a failed login attempt counter associated with the user by one.

20. The computer system of 18, wherein a dynamically generated, variable delay is applied to each login attempt to ensure that each response is sent after the same amount of time has elapsed since the user'"'"'s login credentials were received.