Patent Publication Number: US-2023156008-A1

Title: System and method for controlling login access to computer resource assets

Description:
FIELD OF THE DISCLOSURE 
     The present disclosure relates generally to access of computer resource assets, and, more particularly, to a system and method for controlling login access of computer resource assets. 
     BACKGROUND OF THE DISCLOSURE 
     Access to computer resource assets on a network can be mediated by implementing at least a login name and a password, with such a login name and password associated with an account of a user. However, malicious actors and bots can attempt to access the network and its computer resource assets using a password spraying attack. Such password spraying attacks are brute-force attacks, by which the malicious actor attempts to enter the same password on different number of accounts before moving on to another password and repeating the process. 
     SUMMARY OF THE DISCLOSURE 
     According to an embodiment consistent with the present disclosure, a system and method control login access of computer resource assets. 
     In an embodiment, a system comprises a computer resource asset and a gateway sub-system. The gateway sub-system has a processor configured by software therein to monitor N login failure conditions of a user, in which N is greater than 1, and to control access of the computer resource asset by the user depending on the user meeting the N login failure conditions. The N login failure conditions include a first login failure condition being L 1  login attempts by the user within T 1  seconds without success, and at least an Nth login failure condition being L N  login attempts by the user within T N  seconds without success. 
     The first login failure condition includes 5 login attempts by the user within 15 seconds without success, and the Nth login failure conditions includes a second login failure condition being 7 login attempts by the user within 30 seconds without success, a third login failure condition being 8 login attempts by the user within 45 seconds without success, and a fourth login failure condition being 10 login attempts by the user within 60 seconds without success. Each of the N login failure conditions includes a predetermined number L N  of login attempts by the user over a predetermined period of time T N . When the gateway sub-system detects a successful login attempt by the user at any time, the gateway sub-system grants the user access to the computer resource asset. When the gateway sub-system detects that the user meets the N login failure conditions, the gateway sub-system blocks the user from accessing the computer resource asset. When the gateway sub-system blocks the user, the gateway sub-system sends an alert of the blocking to an administrator. L N  can be greater than L 1 . T N  can be greater than T 1 . 
     In another embodiment, a gateway sub-system comprises a memory, a communication interface, and a processor. The memory is configured to store predetermined login information associated with a user. The communication interface is configured to receive inputted login information from the user. The processor is configured by software therein to evaluate the inputted login information as matching or not matching the predetermined login information, to monitor N login failure conditions of the user, in which N is greater than 1, and to control access of a computer resource asset by the user depending on the user meeting the N login failure conditions. The N login failure conditions include a first login failure condition being L 1  login attempts by the user within T 1  seconds without success, and at least an Nth login failure condition being L N  login attempts by the user within T N  seconds without success. 
     The first login failure condition includes 5 login attempts by the user within 15 seconds without success. The Nth login failure conditions includes a second login failure condition being 7 login attempts by the user within 30 seconds without success, a third login failure condition being 8 login attempts by the user within 45 seconds without success, and a fourth login failure condition being 10 login attempts by the user within 60 seconds without success. When the processor detects a successful login attempt by the user at any time, the processor grants the user access to the computer resource asset. 
     In a further embodiment, a method comprises storing predetermined login information associated with a user in a memory, receiving inputted login information from the user at a communication interface, evaluating the inputted login information by a processor configured by software therein, determining a matching or not matching of the predetermined login information, monitoring N login failure conditions of the user, in which N is greater than 1, and controlling access of a computer resource asset by the user depending on the user meeting the N login failure conditions. The N login failure conditions a first login failure condition being 5 login attempts by the user within 15 seconds without success, a second failure condition being 7 login attempts by the user within 30 seconds without success, a third login failure condition being 8 login attempts by the user within 45 seconds without success, and a fourth login failure condition being 10 login attempts by the user within 60 seconds without success. When the processor detects that the user meets the N login failure conditions, the processor blocks the user from accessing the computer resource asset. When the processor blocks the user, the processor sends an alert of the blocking through the communication interface to an administrator. 
     Any combinations of the various embodiments and implementations disclosed herein can be used in a further embodiment, consistent with the disclosure. These and other aspects and features can be appreciated from the following description of certain embodiments presented herein in accordance with the disclosure and the accompanying drawings and claims. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG.  1    is a schematic of a system, according to an embodiment. 
         FIG.  2    is a flowchart of a method of operation of the system of  FIG.  1   . 
         FIG.  3    is a flowchart of the method of  FIG.  2    applied to a specific embodiment. 
     
    
    
     It is noted that the drawings are illustrative and are not necessarily to scale. 
     DETAILED DESCRIPTION OF CERTAIN EMBODIMENTS OF THE DISCLOSURE 
     Example embodiments consistent with the teachings included in the present disclosure are directed to a system and method for controlling login access of computer resource assets. 
     Referring to  FIG.  1   , a computer system  10  controls access of an external user  12  to a computer resource asset  14 . The computer resource asset  14  can be a computer file, a computer directory, computing software, computing hardware, a computer-based service, etc. The computer resource asset  14  can be stored and maintained on a network. The network can be an external network of a company accessible through a dedicated network environment. The access to the computer resource asset  14  is controlled by a gateway sub-system  16 . The gateway sub-system  16  allows or blocks access of the external user  12  to the computer resource asset  14 . The gateway sub-system  16  includes a communication interface  18 , a hardware processor  20 , and a memory  22 . The hardware processor  20  has code therein configured to monitor access or login attempts by the external user  12 . The memory  22  is configured to store predetermined login information associated with all authorized users. 
     The hardware processor  20  generates a log of activity which is stored in the memory  22  and which is accessible by an administrator  24 . The administrator  24  can access and view the log of activity through the communication interface  18  using any known type of input/output device. For example, the input/output device can include a keyboard, a mouse, a display, and a graphical user interface (GUI). In one embodiment, the log of activity includes a record of attempts by specific external users  12  to login and access specific computer resource assets  14 . The record of attempts can include the number of attempts, the duration of time in which the number of attempts occur, the success of the attempts, and the failure of the attempts. The hardware processor  20  generates an alert of a specific external user  12  being blocked from access to a specific computer resource asset  14 . The alert is stored and available to various resources within the computer system  10 . The computing system  10  sends the alert to the administrator  24 . The administrator  24  receives the alert through the output device, such as a display. 
     As shown in  FIG.  2   , a method  100  of operation of the system  10  includes the step  110  of receiving login attempts from a user. The login attempts can include entry by the user of a login name and a password through an input device. The method  100  then checks if there have been L 1  login attempts within T 1  seconds without success in step  120 . If not, the method  100  allows access by the user in step  130 . Otherwise, the method  100  then checks if there have been L 2  login attempts within T 2  seconds without success in step  140 . If not, the method  100  allows access by the user in step  130 . Otherwise, the method  100  then checks if there have been L N  login attempts within T N  seconds without success in step  150 , in which N is greater than or equal to 2 and is a value which is stored securely within the computer system  10 . If not, the method  100  allows access by the user in step  130 . Otherwise, the method  100  blocks access by the user in step  160 , and generates and sends an alert to the administrator  24  in step  170 . 
     The administrator  24  can customize the stored value of N, with N greater than or equal to 2. In addition, the administrator  24  can customize the values of L 1 , L 2 , . . . L N , in which L 1 &lt;L 2 &lt; . . . &lt;L N , all of which are stored on a resource within eh computer system  10 . The administrator  24  can further customize the values of T 1 , T 2 , . . . T N , in which T 1 &lt;T 2 &lt; . . . &lt;T N , all of which are likewise stored on a resource within eh computer system  10 . For example, the administrator  24  can enter the various values through an input device, such as a keyboard, a mouse, and a GUI, as described above, with that value saved in a memory, record, or a database, as three non-limiting examples. 
     As shown in  FIG.  3   , in a specific embodiment, a method  200  of operation of the system  10  includes the step  210  of receiving login attempts from an external user  12 . The login attempts can include entry by the external user  12  of a login name and a password through an input device. The method  200  then checks if there have been 5 login attempts within 15 seconds without success in step  220  by examining the content of the log of activity. If not, the method  200  allows access by the user in step  230 . Otherwise, the method  200  then checks if there have been 7 login attempts within 30 seconds without success in step  240 , again, by checking the log of activity (and in this way for each time a check is made). If not, the method  100  allows access by the user in step  230 . Otherwise, the method  200  then checks if there have been 8 login attempts within 45 seconds without success in step  250 . If not, the method  200  allows access by the user in step  230 . Otherwise, the method  200  then checks if there have been 10 login attempts within 60 seconds without success in step  260 . If not, the method  200  allows access by the user in step  230 . Otherwise, the method  200  blocks access by the external user  12  in step  270 , and generates and sends an alert to the administrator  24  in step  280 . 
     Portions of the methods described herein can be performed by software or firmware in machine readable form on a tangible (e.g., non-transitory) storage medium. For example, the software or firmware can be in the form of a computer program including computer program code adapted to cause the system  10  to perform various actions described herein when the program is run on a computer or suitable hardware device, and where the computer program can be embodied on a computer readable medium. Examples of tangible storage media include computer storage devices having computer-readable media such as disks, thumb drives, flash memory, and the like, and do not include propagated signals. Propagated signals can be present in a tangible storage media. The software can be suitable for execution on a parallel processor or a serial processor such that various actions described herein can be carried out in any suitable order, or simultaneously. 
     It is to be further understood that like or similar numerals in the drawings represent like or similar elements through the several figures, and that not all components or steps described and illustrated with reference to the figures are required for all embodiments or arrangements. 
     The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a,” “an,” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “contains”, “containing”, “includes”, “including,” “comprises”, and/or “comprising,” and variations thereof, when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof. 
     Terms of orientation are used herein merely for purposes of convention and referencing and are not to be construed as limiting. However, it is recognized these terms could be used with reference to an operator or user. Accordingly, no limitations are implied or to be inferred. In addition, the use of ordinal numbers (e.g., first, second, third) is for distinction and not counting. For example, the use of “third” does not imply there is a corresponding “first” or “second.” Also, the phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting. The use of “including,” “comprising,” “having,” “containing,” “involving,” and variations thereof herein, is meant to encompass the items listed thereafter and equivalents thereof as well as additional items. 
     While the disclosure has described several exemplary embodiments, it will be understood by those skilled in the art that various changes can be made, and equivalents can be substituted for elements thereof, without departing from the spirit and scope of the invention. In addition, many modifications will be appreciated by those skilled in the art to adapt a particular instrument, situation, or material to embodiments of the disclosure without departing from the essential scope thereof. Therefore, it is intended that the invention not be limited to the particular embodiments disclosed, or to the best mode contemplated for carrying out this invention, but that the invention will include all embodiments falling within the scope of the appended claims. 
     The subject matter described above is provided by way of illustration only and should not be construed as limiting. Various modifications and changes can be made to the subject matter described herein without following the example embodiments and applications illustrated and described, and without departing from the true spirit and scope of the invention encompassed by the present disclosure, which is defined by the set of recitations in the following claims and by structures and functions or steps which are equivalent to these recitations.