DALock: Password Distribution-Aware Throttling
DALock: Password Distribution-Aware Throttling
复制标题
DOI：
10.56553/popets-2022-0084
复制
发表时间：
2022-07
期刊：
影响因子：
--
通讯作者：
Jeremiah Blocki;Wuwei Zhang
中科院分区：
文献类型：
--
作者：
Jeremiah Blocki;Wuwei Zhang
大规模的在线密码猜测攻击是广泛的，对用户构成了持续的隐私和安全威胁K的价值会导致经典的安全性权衡。烦人的用户在几个错误后锁定了他们，这是因为诚实的用户错误通常与在线攻击者的密码猜测完全不同，我们介绍了Dalock，Dalock是一种发行的密码锁定机制，以降低用户的烦恼，同时降低用户的风险顾名思义，达洛克（Dalock）旨在了解用于登录攻击的密码的频率和普及时间，标准的节流机制（例如，k-strikes）尤其是密码分发，Dalock除了基于（估计）与传统的K-Strikes相比，我们对该特定帐户的所有登录概率尝试使用大量仿真来评估Dalock。机制，我们的模拟表明，达洛克提供了出色的模拟安全/可用性权衡，例如，在我们的一个模拟中，我们能够将攻击者的成功率降低到0.05％（相比之下，三个刺激机制为1％ ）尽管仅将不受攻击的帐户的不需要锁定率降低到0.08％（相比之下为3击中机制4％），而虽然只需将不需要的锁定率降低到0.08％。
Large-scale online password guessing attacks are widespread and pose a persistant privacy and security threat to users. The common method for mitigating the risk of online cracking is to lock out the user after a fixed number (K) of consecutive incorrect login attempts. Selecting the value of K induces a classic security-usability trade-off. When K is too large, a hacker can (quickly) break into a significant fraction of user accounts, but when K is too low, we will start to annoy honest users by locking them out after a few mistakes. Motivated by the observation that honest user mistakes typically look quite different from an online attacker’s password guesses, we introduce DALock, a distribution-aware password lockout mechanism to reduce user annoyance while minimizing user risk. As the name suggests, DALock is designed to be aware of the frequency and popularity of the password used for login attacks. At the same time, standard throttling mechanisms (e.g., K-strikes) are oblivious to the password distribution. In particular, DALock maintains an extra “hit count" in addition to “strike count" for each user, which is based on (estimates of) the cumulative probability of all login attempts for that particular account. We empirically evaluate DALock with an extensive battery of simulations using real-world password datasets. In comparison with the traditional K-strikes mechanism, our simulations indicate that DALock offers a superior simulated security/usability trade-off. For example, in one of our simulations, we are able to reduce the success rate of an attacker to 0.05% (compared to 1% for the 3strikes mechanism) whilst simultaneously reducing the unwanted lockout rate for accounts that are not under attack to just 0.08% (compared to 4% for the 3-strikes mechanism).