Mitigation of application-level distributed denial-of-service attacks
A system and method, implementable using an authenticating device, are provided for authenticating requesting devices such as mobile devices and other communication devices over a network. At least one group shared secret is provisioned on a plurality of requesting devices, which are further provided with other authentication credentials such as a shared secret for full authentication by the authenticating device. When authentication is sought, the requesting device transmits a pre-authentication request comprising one of the group shared secrets to the authenticating device, which verifies that group shared secret. The group shared secrets may be stored in volatile memory at the authenticating device. If the group shared secret is verified, the authenticating device will authenticate that same device in response to a subsequent authentication request.
1. A method implemented at an authenticating device, the method comprising:
storing, prior to receiving any authorization requests, a plurality of group shared secrets in memory accessible to the authenticating device, the plurality of group shared secrets comprising at least a first group shared secret and a second group shared secret,
the first group shared secret being also stored in memory of each of a first plurality of requesting devices prior to transmission of any authorization request by any of the first plurality of requesting devices to the authenticating device;
the second group shared secret being also stored in memory of each of a second plurality of requesting devices prior to transmission of any authorization request by any of the second plurality of requesting devices to the authenticating device,
the first plurality of requesting devices and the second plurality of requesting devices each comprising different subsets of a set of requesting devices while also including at least one common requesting device from the set of requesting devices;
receiving a pre-authentication request comprising at least a reference for the first group shared secret of the plurality of group shared secrets, the pre-authentication request being transmitted from a first requesting device of the first plurality of requesting devices;
verifying, at the authenticating device, the received pre-authentication request using said first group shared secret;
receiving an authentication request comprising proof of knowledge of a secret shared exclusively between the authenticating device and the first requesting device; and
when the authentication request is determined to have been transmitted from said first requesting device, authenticating the first requesting device in response to the authentication request.
2. The method of claim 1 , further comprising, if the authentication request is determined not to have been transmitted from any requesting device from which any verified pre-authentication request was transmitted, discarding the authentication request.
3. The method of claim 1 , further comprising determining that the authentication request was transmitted from said first requesting device by determining that said authentication request and said pre-authentication request were transmitted from a same IP address.
4. The method of claim 1 , wherein the pre-authentication request and the authentication request are comprised in a single message.
5. The method of claim 1 , further comprising determining that the authentication request was transmitted from said first requesting device by determining that said authentication request comprises a token, the token previously being provided to said first requesting device in response to said verifying and being distinct from the exclusively shared secret.
6. The method of claim 1 , further comprising determining that the authentication request was transmitted from said first requesting device by determining that said authentication request and said pre-authentication request comprise a same identifier.
7. The method of claim 1 , further comprising:
establishing a secure channel between the authenticating device and the first requesting device in response to said pre-authentication request, the pre-authentication request comprising credentials from the first requesting device for initiating the secure channel; and
determining that the authentication request was transmitted from said first requesting device by determining that said authentication request was transmitted over the secure channel.
8. The method of claim 1 , wherein the pre-authentication request comprises an index of the first group shared secret and a hash comprising the first group shared secret.
9. The method of claim 1 , wherein the pre-authentication request comprises a payload and a signature, the payload comprising an index of the first group shared secret, a time interval number and a random number derived from the time interval number, and the signature comprising a hash of the first group shared secret and said payload.
10. The method of claim 1 , wherein receiving the pre-authentication request or receiving the authentication request comprises receiving the pre-authentication request or the authentication request from a web server in communication with the authenticating device.
11. The method of claim 1 , further comprising, prior to said receiving any pre-authentication request:
providing each of the first plurality of requesting devices with said first group shared secret; and
providing each of the second plurality of requesting devices with said second group shared secret.
12. The method of claim 1 , further comprising:
receiving, at the authenticating device, a further pre-authentication request comprising at least a reference for the second group shared secret, the further pre-authentication request being transmitted from a further requesting device of the second plurality of requesting devices;
determining that the second group shared secret is invalid;
indicating to said further requesting device that the further pre-authentication request has failed when the second group shared secret is determined to be invalid;
receiving a subsequent pre-authentication request from said further requesting device, said subsequent pre-authentication request comprising at least a reference for a further group shared secret selected from said plurality of group shared secrets;
verifying the subsequent pre-authentication request using said further group shared secret, the further group shared secret being valid;
receiving a further authentication request comprising proof of knowledge of the secret shared exclusively between the authenticating device and the further requesting device; and
when the further authentication request is determined to have been transmitted from the further requesting device, authenticating the further requesting device in response to the authentication request.
13. The method of claim 1 , wherein the first requesting device comprises a mobile device.
14. An authenticating device, comprising:
a network communication subsystem; and
at least one processor configured to enable:
storing, prior to receiving any authorization requests, a plurality of group shared secrets in memory accessible to the authenticating device, the plurality of group shared secrets comprising at least a first group shared secret and a second group shared secret,
the first group shared secret being also stored in memory of each of a first plurality of requesting devices prior to transmission of any authorization request by any of the first plurality of requesting devices to the authenticating device;
the second group shared secret being also stored in memory of each of a second plurality of requesting devices prior to transmission of any authorization request by any of the second plurality of requesting devices to the authenticating device,
the first plurality of requesting devices and the second plurality of requesting devices each comprising different subsets of a set of requesting devices while also including at least one common requesting device from the set of requesting devices;
receiving a pre-authentication request comprising at least a reference for the first group shared secret of the plurality of group shared secrets, the pre-authentication request being transmitted form a first requesting device of the first plurality of requesting devices;
verifying the received pre-authentication request using said first group shared secret;
receiving an authentication request comprising proof of knowledge of a secret shared exclusively between the authenticating device and the first requesting device; and
when the authentication request is determined to have been transmitted from said first requesting device, authenticating the first requesting device in response to the authentication request.
15. The authenticating device of claim 14 , wherein the at least one processor is further configured to enable, if the authentication request is determined not to have been transmitted from any requesting device from which any verified pre-authentication request was transmitted, discarding the authentication request.
16. The authenticating device of claim 14 , wherein the at least one processor is further configured to enable determining that the authentication request was transmitted from said first requesting device by determining that said authentication request and said pre-authentication request were transmitted from a same IP address.
17. The authenticating device of claim 14 , wherein the pre-authentication request and the authentication request are comprised in a single message.
18. The authenticating device of claim 14 , wherein the at least one processor is further configured to enable determining that the authentication request was transmitted from said first requesting device by determining that said authentication request comprises a token, the token previously being provided to said first requesting device in response to said verifying and being distinct from the exclusively shared secret.
19. The authenticating device of claim 14 , wherein the at least one processor is further configured to enable determining that the authentication request was transmitted from said first requesting device by determining that said authentication request and said pre-authentication request comprise a same identifier.
20. The authenticating device of claim 14 , wherein the at least one processor is further configured to enable:
establishing a secure channel between the authenticating device and the first requesting device in response to said pre-authentication request, the pre-authentication request comprising credentials from the first requesting device for initiating the secure channel; and
determining that the authentication request is received from said first requesting device by determining that said authentication request was transmitted over the secure channel.
21. The authenticating device of claim 14 , wherein the pre-authentication request comprises an index of the first group shared secret and a hash comprising the first group shared secret.
22. The authenticating device of claim 14 , wherein the pre-authentication request comprises a payload and a signature, the payload comprising an index of the first group shared secret, a time interval number and a random number derived from the time interval number, and the signature comprising a hash of the first group shared secret and said payload.
23. The authenticating device of claim 14 , wherein the at least one processor is further configured to enable:
receiving a further pre-authentication request comprising at least a reference for the second group shared secret, the further pre-authentication request being transmitted from a further requesting device of the second plurality of requesting devices;
determining that the second group shared secret is invalid;
indicating to said further requesting device that the further pre-authentication request has failed when the second group shared secret is determined to be invalid;
receiving a subsequent pre-authentication request from said further requesting device, said subsequent pre-authentication request comprising at least a reference for a further group shared secret selected from said plurality of group shared secrets;
verifying the subsequent pre-authentication request using said further group shared secret, the further group shared secret being valid;
receiving a further authentication request comprising proof of knowledge of the secret shared exclusively between the authenticating device and the further requesting device; and
when the further authentication request is determined to have been transmitted from the further requesting device, authenticating the further requesting device in response to the authentication request.
24. A computer program product comprising a non-transitory computer readable medium bearing program code which, when executed by a processor of an authenticating device, causes the authenticating device to carry out the method of:
storing, prior to receiving any authorization requests, a plurality of group shared secrets in memory accessible to the authenticating device, the plurality of group shared secrets comprising at least a first group shared secret and a second group shared secret,
the first group shared secret being also stored in memory of each of a first plurality of requesting devices prior to transmission of any authorization request by any of the first plurality of requesting devices to the authenticating device;
the second group shared secret being also stored in memory of each of a second plurality of requesting devices prior to transmission of any authorization request by any of the second plurality of requesting devices to the authenticating device,
the first plurality of requesting devices and the second plurality of requesting devices each comprising different subsets of a set of requesting devices while also including at least one common requesting device from the set of requesting devices;
receiving a pre-authentication request comprising at least a reference for the first group shared secret of the plurality of group shared secrets, the pre-authentication request being transmitted from a first requesting device of the first plurality of requesting devices;
verifying, at the authenticating device, the received pre-authentication request using said first group shared secret;
receiving an authentication request comprising proof of knowledge of a secret shared exclusively between the authenticating device and the first requesting device; and
when the authentication request is determined to have been transmitted from said first requesting device, authenticating the first requesting device in response to the authentication request.