System and method for preventing well behaving clients from causing account lockouts in a group
Methods and systems for account authentication in a distributed computing node group may involve sending a message to a member, the message having a first timestamp, increasing an authentication failure count, receiving a first key-exchange message from the member, the first key-exchange message having a second timestamp, evaluating the second timestamp, and determining whether to ignore the first key-exchange message based on an evaluation of the second timestamp. The first timestamp may be associated with a message received from the member prior to sending the message with the first timestamp to the member. The first key-exchange message may include a value computed by the member based on a group passcode shared with the member. The evaluation of the second timestamp may be based on at least one of a default value, the authentication failure count, or a timestamp associated with the group passcode.
1. A method for account authentication in a distributed computing node group, comprising:
sending a message to a member, the message including a first timestamp associated with a message received from the member prior to sending the message;
increasing an authentication failure count;
receiving a first key-exchange message from the member, the first key-exchange message including a value computed by the member based on a group passcode shared with the member and a second timestamp;
evaluating the second timestamp based on at least one of: a default value, the authentication failure count, or a timestamp associated with the group passcode;
determining whether to ignore the first key-exchange message based on an evaluation of the second timestamp;
sending a second key-exchange message to the member based on a determination not to ignore the first key-exchange message, the second key-exchange message including a first secret based on a group passcode shared with the member and a master timestamp;
receiving a third key-exchange message from the second node, third key-exchange message including a second secret in response to the second key-exchange message;
validating the second secret and generating an encryption key;
sending another message to the member, the other message encrypted with the encryption key and including a group session transport encryption key; and
receiving an encrypted message from the member, the encrypted message encrypted with a message key, the message key derived based on the group session transport encryption key.
2. The method of claim 1 , further comprising:
determining whether the authentication failure count is greater than an authentication lockout threshold; and
locking out an account associated with the first key-exchange message based on a determination that the authentication failure count is greater than the authentication lockout threshold.
3. The method of claim 1 , further comprising:
determining whether the member has validated the first secret; and
increasing the authentication failure count based on a determination that the member failed to validate the first secret.
4. The method of claim 1 , wherein increasing the authentication failure count is based on a determination that an amount of time to respond to the message exceeds a timeout threshold.
5. The method in claim 1 , wherein the evaluation of the second timestamp further comprises:
determining that the second timestamp is not the default value; and
comparing the second timestamp to the timestamp associated with associated with the group passcode to determine that the second timestamp is more recent than the timestamp associated with the group passcode.
6. An information handling system, comprising:
a processor subsystem having access to a first memory;
a management controller comprising a secondary processor having access to a second memory, the second memory including an embedded storage partition and the second memory storing instructions executable by the secondary processor to:
send a message to a member, the message having a first timestamp associated with a message received from the member prior to sending the message;
increase an authentication failure count;
receive a first key-exchange message from the member, the first key-exchange message having a value computed by the member based on a group passcode shared with the member and a second timestamp;
evaluate the second timestamp based on at least one of: a default value, the authentication failure count, or a timestamp associated with the group passcode;
determine whether to ignore the first key-exchange message based on the evaluation of the second timestamp;
send a second key-exchange message to the member based on a determination not to ignore the first key-exchange message, the second key-exchange message including a first secret based on a group passcode shared with the member and a master timestamp;
receive a third key-exchange message from the second node, third key-exchange message including a second secret in response to the second key-exchange message;
validate the second secret and generate an encryption key;
send another message to the member, the other message encrypted with the encryption key and including a group session transport encryption key; and
receive an encrypted message from the member, the encrypted message encrypted with a message key, the message key derived based on the group session transport encryption key.
7. The information handling system of claim 6 , further comprising instructions executable by the secondary processor to:
determine whether the authentication failure count is greater than an authentication lockout threshold; and
lock out an account associated with the first key-exchange message based on a determination that the authentication failure count is greater than the authentication lockout threshold.
8. The information handling system of claim 6 , further comprising instructions executable by the secondary processor to:
determine whether the member has validated the first secret; and
increase the authentication failure count based on a determination that the member failed to validate the first secret.
9. The information handling system of claim 6 , wherein the increase of the authentication failure count is based on a determination that an amount of time to respond to the first message exceeds a timeout threshold.
10. The information handling system of claim 6 , wherein the evaluation of the second timestamp further comprises:
a determination that the second timestamp is not the default value;
a comparison between the second timestamp and the timestamp associated with the group passcode; and
a determination that the second timestamp is more recent than the timestamp associated with the group passcode based on the comparison between the second timestamp and the timestamp associated with the group passcode.
11. The information handling system of claim 6 , wherein the timestamp associated with the group passcode indicates when the group passcode was changed.
12. A management controller for an information handling system having a primary processor and a primary memory, the management controller comprising a secondary processor having access to a secondary memory, the secondary memory including an embedded storage partition and the secondary memory storing instructions executable by the secondary processor to:
send a message to a member, the message having a first timestamp associated with a message received from the member prior to sending the message;
increase an authentication failure count;
receive a first key-exchange message from the member, the first key-exchange message having a value computed by the member based on a group passcode shared with the member and a second timestamp;
evaluate the second timestamp based on at least one of: a default value, the authentication failure count, or a timestamp associated with the group passcode;
determine whether to ignore the first key-exchange message based on the evaluation of the second timestamp;
send a second key-exchange message to the member based on a determination not to ignore the first key-exchange message, the second key-exchange message including a first secret based on a group passcode shared with the member and a master timestamp;
receive a third key-exchange message from the second node, third key-exchange message including a second secret in response to the second key-exchange message;
validate the second secret and generate an encryption key;
send another message to the member, the other message encrypted with the encryption key and including a group session transport encryption key; and
receive an encrypted message from the member, the encrypted message encrypted with a message key, the message key derived based on the group session transport encryption key.
13. The management controller of claim 12 , further comprising instructions executable by the secondary processor to:
determine whether the authentication failure count is greater than an authentication lockout threshold; and
lock out an account associated with the second message based on a determination that the authentication failure count is greater than the authentication lockout threshold.
14. The management controller of claim 12 , further comprising instructions executable by the secondary processor to:
determine whether the member has validated the first secret; and
increase the authentication failure count based on a determination that the member failed to validate the first secret.
15. The management controller of claim 12 , wherein the increase of the authentication failure count is based on a determination that an amount of time to respond to the first message exceeds a timeout threshold.
16. The management controller of claim 12 , wherein the evaluation of the second timestamp further comprises:
a determination that the second timestamp is not the default value;
a comparison between the second timestamp and the timestamp associated with the group passcode; and
a determination that the second timestamp is more recent than the timestamp associated with the group passcode based on the comparison between the second timestamp and the timestamp associated with the group passcode.
17. The management controller of claim 12 , wherein the timestamp associated with the group passcode indicates when the group passcode was changed.