Patent Application
20110107394
Embodiments of the present invention relate generally to computer system technology, and more particularly to authentication techniques related to such systems.
Authentication protocols are commonly used in computer systems to provide a form of access control. If a computer system (or a particular resource or component included therein) is intended by an administrator to be used only by particular authorized users, an authentication protocol is implemented to facilitate such access by detecting and excluding unauthorized users. Such access is typically controlled by the use of an authentication procedure to identify, with some predetermined degree of accuracy, the identity of a potential user. Select privileges can then be granted based on the identity. An example of a common authentication protocol requires that a user submit a username and password to gain access to a computer system. Typically, a query is then performed on a database to verify that the username and password are valid, which determines whether the user should be authenticated and given access to the system.
Due in part to the nature, size, and complexity of modern computer systems, it is often desired to have multiple users authenticated at one time. For example, multiple users may concurrently be authenticated and permitted to join a particular network. Such authentication systems are typically implemented through the use of select system resources (e.g., authentication slots maintained in a memory). However, as with any computer resource, these system resources are limited (e.g., amount of memory available, processing speed, etc.). Therefore, due to these limitations, authentication systems typically have a limit as to the number of concurrent authentications that can be maintained at one time.
The use of a limit for concurrent authentications can lead to a potential problem involving malicious users. Malicious (or “spoofing”) users are unauthorized users, who attempt to gain unauthorized access to a system using various techniques. Common examples of malicious users are those who run username and/or password guessing programs. These programs result in the malicious user making repeated attempts to gain access to a system, by cycling through potential usernames and/or passwords until a valid pair is found. Attacks of this kind are often referred to as “brute-force” attacks, in that they attempt to acquire large quantities of valid usernames and passwords. Such attacks often flood the system and result in a denial of service to valid users wishing to authenticate. Another example of a malicious user is one which creates fictitious MAC addresses to trick a system into believing they represent a valid user. As multiple fictitious users attempt to authenticate themselves, they clog the authentication system, thereby preventing valid users from having the opportunity to authenticate.
One approach to handling malicious users is to use a quiet period as part of the authentication protocol, which prevents a malicious user from making repeated and persistent unsuccessful authentication attempts. Referring now to
However, when the number of malicious users is high, the described quiet period technique is often ineffective. Indeed, even with a quiet period, if there are enough malicious users, there can be a steady stream of malicious users ending their quiet period such that they continually clog the available authentication slots, thereby continually preventing authentication attempts from valid users.
Throughout this disclosure, reference to “a,” “an,” or “the” refers to at least one unless otherwise specified. Embodiments of the invention provide an authentication method and device wherein a “standby” queue is used to promote fairness with respect to authentication slot allocation by ensuring that all users will eventually have an opportunity to be authenticated. Therefore, even if a large number of malicious users make authentication attempts, they will not completely monopolize use of the available authentication slots without affording the valid users the opportunity to authenticate.
Referring now to
The processing engine 128 is configured to monitor the port 122 and the authentication slots 112 such that if an authentication request from a user is received and no authentication slots are available, an identifier associated with the user is added to on the queue 124 (i.e., enqueued). In the example shown, all five slots 112 are in use. Therefore, when a new user (e.g., Client F) attempts to authenticate, an identifier associated with Client F will be enqueued into the queue 124. In this example, the identifier is an IP address of the client, however other identifiers (e.g., MAC address or username) are considered and could be used instead. Consider now two additional users Client G and Client H, which attempt to authenticate, but are rejected because no authentication slots 112 are available.
Concurrently, the processing engine 128 monitors the authentication slots 112 and the queue 124 such that if one of the authentication slots 112 becomes available and the queue 124 is not empty, the processing engine 128 causes an identifier to be removed from the queue 124 (i.e., dequeued) and causes the associated user to be authenticated using one of the available authentication slots. Therefore, when Slot 5112e, previously allocated by Client E, becomes available, Client F is dequeued from the queue 124 and authenticated using authentication Slot 5112e. The revised queue 124 and device 100 after these steps are shown as
Referring now to FIG. 6., the preferred embodiment of the present invention will now be discussed with respect to the steps depicted in flow chart form. To implement the preferred method of user authentication for a device 10, in Step 200, the port 122 on the device 100 receives and authentication request from a user. In Step 204, a query is performed to determine whether the device 100 has an available authentication slot 112. If there is an available authentication slot 112, in Step 206 an authentication attempt is made. If there is no available authentication slot 112, in Step 208, an identifier associated with the user is enqueued on a queue 124 stored in a memory 126 on the device 100. At Step 210, a query is made to determine whether the queue 124 is full. If the queue 124 is full, at Step 212, an alert is generated and sent to the administrator or another designated recipient.
In the preferred embodiment, a concurrent series of steps are also performed as depicted in the flow chart in
Each of the steps described above are preferably carried out by the processing engine 128, which can be implemented using, among other things, hardware, software (i.e., instructions stored on a computer-readable medium), or a combination of both. However, notably the steps can also be performed manually and/or by other components in the authentication system.
In the described embodiments, the use of the queue 124 ensures that all users (whether valid or malicious) are provided with an opportunity to attempt an authorization. This provides an advantage over the quiet period technique in that valid users need not rely on having the appropriate timing to be authenticated. Indeed, consider an authentication system having one remaining available authentication slot 112, with one hundred malicious users and a single valid user competing for the slot. While the malicious users will be placed in a quiet period when they fail the authentication attempt, the sheer number of malicious users makes it likely that they will continually be completing their quiet periods and making new user-initiated authentication attempts such that they effectively blocking the valid user. Indeed, the valid user would only able to authenticate if it were to submit an authentication request at exactly the right time (i.e., as soon as the one slot becomes, but before any of the one-hundred malicious users makes an attempt and temporarily makes the slot unavailable). This results in a timing game, which needs to be played by the valid user in order to successfully authenticate.
However, the above described embodiment avoids this timing game, by ensuring that each user is sequentially given an opportunity to attempt an authentication. As each of the one hundred malicious users and the single valid user attempt authentication, but are denied because the slot is not available, each will be placed into the queue 124. As such, when the slot becomes available, a new user will be dequeued from the queue 124 and submitted for an attempted authentication. While the queue 124 will still maintain several malicious users, each will continually be denied authentication resulting in the valid user being moved up sequentially in the queue 124. Eventually, the valid user will be afforded its turn and will successfully authenticate with the available slot.
Notably, the size of the queue 124 is adjustable and is set by an administrator depending on the conditions of the computer system, its required functionality, and other limitations (e.g., available memory resources). In the example described above, a queue 124 of at least the size one-hundred and one would be required to ensure that each user is guaranteed an authentication request opportunity (for simplicity, the queues shown in
While specific embodiments of the present invention have been shown and described, it should be understood that other modifications, substitutions and alternatives are apparent to one of ordinary skill in the art. Such modifications, substitutions and alternatives can be made without departing from the spirit and scope of the invention, which should be determined from the appended claims.
Various features of the invention are set forth in the appended claims.
