Preventing user enumeration by an authentication server

1. A method of prompting a user to authenticate to an authentication server, the method comprising:

receiving, by processing circuitry, an authentication session request which includes a validation result indicating whether a user identifier supplied by the user identifies a valid user entry in a user database;

when the validation result indicates that the user identifier does identify a valid user entry in the user database, providing a genuine authentication session response which includes (i) a user-expected set of artifacts to confirm authenticity of the authentication server to the user and (ii) a prompt for the user to enter a password to confirm authenticity of the user to the authentication server;

when the validation result indicates that the user identifier does not identify a valid user entry in the user database, providing, by the processing circuitry, a faux authentication session response which includes (i) a server-selected set of artifacts and (ii) a prompt for the user to enter a password enabling the faux authentication session response to resemble a genuine authentication session response; and

prior to receiving the authentication session request, acquiring a user-provided set of artifact choices, the user-provided set of artifact choices identifying, as the user-expected set of artifacts of the genuine authentication session response, user-chosen graphical content;

wherein providing the faux authentication session response includes:

outputting, as the server-selected set of artifacts, an artifact from an entry of an artifact database which is separate from the user database, and

outputting, as the prompt for the user to enter a password, a password query which encourages a potential attacker to guess a password that would provide access to a protected resource; and

wherein outputting the password query includes:

inviting the user to guess a password to prevent revealing whether the user identifier supplied by the user identifies a valid user entry in the user database.

2. A method as in claim 1 wherein acquiring the user-provided set of artifact choices includes:

providing a pool of selectable pictures for display on a user device and obtaining, as an artifact choice, a picture selection which identifies a particular picture from the pool of selectable pictures; and

wherein the user-expected set of artifacts of the genuine authentication session response includes the particular picture identified by the picture selection.

3. A method as in claim 1 wherein acquiring the user-provided set of artifact choices includes:

obtaining, as an artifact choice, a particular pass phrase; and

wherein the user-expected set of artifacts of the genuine authentication session response includes the particular pass phrase.

4. A method as in claim 1 wherein acquiring the user-provided set of artifact choices includes:

providing a pool of selectable pictures for display on a user device; obtaining from the user device (i) a picture selection which identifies a particular picture from the pool of selectable pictures as a first artifact choice, and (ii) a particular pass phrase as a second artifact choice;

wherein the user-expected set of artifacts of the genuine authentication session response includes both the particular picture identified by the picture selection and the particular pass phrase.

5. A method as in claim 1 wherein acquiring the user-provided set of artifact choices includes:

obtaining, as an artifact choice, a particular secret question;

wherein the user-expected set of artifacts of the genuine authentication session response includes the particular secret question.

6. A method as in claim 1 wherein providing the genuine authentication session response includes:

outputting, as the user-expected set of artifacts, viewable content which the user is able to render on a user device to confirm earlier selection of that viewable content.

7. A method as in claim 1 wherein the user database resides within a third-party server which is disposed between a user device of the user and the authentication server; and wherein receiving the authentication session request which includes the validation result includes:

obtaining the authentication session request from the third-party server in response to the third-party server (i) receiving an access request from the user device, the access request including the user identifier, (ii) searching the user database based on the user identifier, and (ii) generating the validation result indicating whether the user identifier identifies a user entry in the user database.

8. A method as in claim 1 wherein a third-party server is disposed between the user and the authentication server; wherein the authentication server includes a front-end portion and a back-end portion; wherein the method further comprises:

receiving, by the front-end portion, an access request from the user through the third-party server, the access request including the user identifier,

searching, by the front-end portion, the user database based on the user identifier,

generating, by the front-end portion, the validation result indicating whether the user identifier identifies a user entry in the user database, and

providing, by the front-end portion, the authentication session request which includes the validation result to the back-end portion; and

wherein the back-end portion is constructed and arranged to process the authentication session request and provide one of the genuine authentication session response and the faux authentication session response to the user through the third-party server.

9. A method as in claim 1 wherein providing the faux authentication session response includes:

inputting the user identifier into a hash algorithm to generate a repeatable hash result, and

selecting, from a pool of machine-selectable sets of artifacts, the server-selected set of artifacts based on the repeatable hash result.

10. A method as in claim 9 wherein providing the faux authentication session response further includes:

inputting a date value into the hash algorithm to effectuate (i) generation of the repeatable hash result for a predefined period of time and (ii) generation of different repeatable hash result after the predefined period of time to simulate user selection of a different set of artifacts over time.

11. A method as in claim 1 wherein the user initially supplies the user identifier from a user device; and wherein the method further comprises:

after providing the faux authentication session response, counting a number of subsequent authentication session requests caused by a user device to provide a velocity measurement, and

outputting an alert message indicating a possible enumeration attack when the velocity measurement exceeds a predetermined threshold.

12. A method as in claim 11 wherein the authentication server includes a risk engine which is constructed and arranged to perform risk-based authentication in which multiple risk-based factors are evaluated to form a risk score indicating a level of risk; and wherein the method further comprises:

in response to the alert message, providing a user device identifier of the user device as an input to the risk engine to indicate increased risk in future risk-based authentication operations involving the user device.

13. A method as in claim 11 , further comprising:

providing diagnostic content transparently to the user device in response to the alert message, the diagnostic content facilitating further collection of identification information from the user device.

14. An authentication apparatus, comprising:

a communications interface;

memory which stores sets of artifacts; and

control circuitry coupled to the communications interface and the memory, the control circuitry being constructed and arranged to:

receive, through the communications interface, an authentication session request which includes a validation result indicating whether a user identifier supplied by a user identifies a valid user entry in a user database,

when the validation result indicates that the user identifier does identify a valid user entry in the user database, provide, through the communications interface, a genuine authentication session response which includes (i) a user-expected set of artifacts from the memory to confirm authenticity of the authentication server to the user and (ii) a prompt for the user to enter a password to confirm authenticity of the user to the authentication server,

when the validation result indicates that the user identifier does not identify a valid user entry in the user database, provide, through the communications interface, a faux authentication session response which includes (i) a server-selected set of artifacts from the memory and (ii) a prompt for the user to enter a password enabling the faux authentication session response to resemble a genuine authentication session response; and

prior to receiving the authentication session request, acquire a user-provided set of artifact choices, the user-provided set of artifact choices identifying, as the user-expected set of artifacts of the genuine authentication session response, user-chosen graphical content;

wherein the control circuitry, when providing the faux authentication session response, is constructed and arranged to:

output, as the server-selected set of artifacts, an artifact from an entry of an artifact database which is separate from the user database, and

output, as the prompt for the user to enter a password, a password query which encourages a potential attacker to guess a password that would provide access to a protected resource; and

wherein the control circuitry, when outputting the password query, is constructed and arranged to:

invite the user to guess a password to prevent revealing whether the user identifier supplied by the user identifies a valid user entry in the user database.

15. An authentication apparatus as in claim 14 wherein the control circuitry, when providing the faux authentication session response, is constructed and arranged to:

input the user identifier into a hash algorithm to generate a repeatable hash result, and

select, from a pool of machine-selectable sets of artifacts in the memory, the server-selected set of artifacts based on the repeatable hash result.

16. An authentication apparatus as in claim 15 wherein the control circuitry, when providing the faux authentication session response, is further constructed and arranged to:

input a date value into the hash algorithm to effectuate (i) generation of the repeatable hash result for a predefined period of time and (ii) generation of different repeatable hash result after the predefined period of time to simulate user selection of a different set of artifacts over time.

17. A computer program product having a non-transitory computer readable medium which stores a set of instructions to prompt a user to authenticate to an authentication server, the set of instructions, when carried out by the authentication server, causing the authentication server to perform a method of:

receiving an authentication session request which includes a validation result indicating whether a user identifier supplied by the user identifies a valid user entry in a user database;

when the validation result indicates that the user identifier does identify a valid user entry in the user database, providing a genuine authentication session response which includes (i) a user-expected set of artifacts to confirm authenticity of the authentication server to the user and (ii) a prompt for the user to enter a password to confirm authenticity of the user to the authentication server;

when the validation result indicates that the user identifier does not identify a valid user entry in the user database, providing a faux authentication session response which includes (i) a server-selected set of artifacts and (ii) a prompt for the user to enter a password enabling the faux authentication session response to resemble a genuine authentication session response; and

prior to receiving the authentication session request, acquiring a user-provided set of artifact choices, the user-provided set of artifact choices identifying, as the user-expected set of artifacts of the genuine authentication session response, user-chosen graphical content;

wherein providing the faux authentication session response includes:

outputting, as the server-selected set of artifacts, an artifact from an entry of an artifact database which is separate from the user database, and

outputting, as the prompt for the user to enter a password, a password query which encourages a potential attacker to guess a password that would provide access to a protected resource; and

wherein outputting the password query includes:

inviting the user to guess a password to prevent revealing whether the user identifier supplied by the user identifies a valid user entry in the user database.

18. A computer program product as in claim 17 wherein providing the faux authentication session response includes:

inputting the user identifier into a hash algorithm to generate a repeatable hash result, and

selecting, from a pool of machine-selectable sets of artifacts, the server-selected set of artifacts based on the repeatable hash result.

19. A computer program product as in claim 18 wherein providing the faux authentication session response further includes:

inputting a date value into the hash algorithm to effectuate (i) generation of the repeatable hash result for a predefined period of time and (ii) generation of different repeatable hash result after the predefined period of time to simulate user selection of a different set of artifacts over time.

20. An authentication apparatus as in claim 14 wherein the control circuitry, when acquiring the user-provided set of artifact choices, is constructed and arranged to:

provide a pool of selectable pictures for display on a user device and obtain, as an artifact choice, a picture selection which identifies a particular picture from the pool of selectable pictures; and

wherein the user-expected set of artifacts of the genuine authentication session response includes the particular picture identified by the picture selection.

21. An authentication apparatus as in claim 14 wherein the control circuitry, when acquiring the user-provided set of artifact choices, is constructed and arranged to:

obtain, as an artifact choice, a particular pass phrase; and

wherein the user-expected set of artifacts of the genuine authentication session response includes the particular pass phrase.

22. A computer program product as in claim 17 wherein acquiring the user-provided set of artifact choices includes:

providing a pool of selectable pictures for display on a user device and obtaining, as an artifact choice, a picture selection which identifies a particular picture from the pool of selectable pictures; and

wherein the user-expected set of artifacts of the genuine authentication session response includes the particular picture identified by the picture selection.

23. A computer program product as in claim 17 wherein acquiring the user-provided set of artifact choices includes:

obtaining, as an artifact choice, a particular pass phrase; and

wherein the user-expected set of artifacts of the genuine authentication session response includes the particular pass phrase.