Client-side user authentication control based on stored history of incorrect passwords
An apparatus in one embodiment comprises a client configured to perform client-side portions of one or more user authentication protocols carried out between the client and one or more authentication servers over a network. The client stores, for one or more instances of a given one of the user authentication protocols carried out for a particular user, an incorrect password history comprising identifiers of one or more passwords previously entered by the user and indicated as being incorrect passwords by at least one of the authentication servers, and determines, for an additional password entered by the user but not yet submitted by the client to the authentication servers, whether or not the additional password is part of the incorrect password history. Responsive to the additional password being part of the incorrect password history, the client generates an alert for presentation to the user to indicate that the additional password may be an incorrect password.
1. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
the processing device implementing a client configured to communicate with one or more authentication servers over a network;
the client being configured to perform client-side portions of one or more user authentication protocols carried out between the client and at least one of the one or more authentication servers;
wherein the client is further configured:
to store, for one or more instances of a given one of the user authentication protocols carried out for a particular user, an incorrect password history comprising identifiers of one or more passwords previously entered by the user and indicated as being incorrect passwords by at least one of the one or more authentication servers;
to determine, for an additional password entered by the user but not yet submitted by the client to the one or more authentication servers, whether or not the additional password is part of the incorrect password history; and
responsive to the additional password being part of the incorrect password history, to generate an alert for presentation to the user to indicate that the additional password may be an incorrect password.
2. The apparatus of claim 1 wherein the alert is generated and presented to the user only if the incorrect password history contains identifiers of at least a threshold number of incorrect passwords.
3. The apparatus of claim 1 wherein the client is further configured, responsive to presentation of the alert to the user, to receive an override command from the user, and to submit the additional password to the one or more authentication servers responsive to receipt of the override command from the user.
4. The apparatus of claim 1 wherein the client is further configured, responsive to presentation of the alert to the user, to receive another password from the user, and if the other password is not part of the incorrect password history, to submit the other password to the one or more authentication servers in place of the additional password.
5. The apparatus of claim 1 wherein the one or more authentication servers comprise a plurality of authentication servers and wherein the client is further configured to maintain the incorrect password history on a per-server basis such that the incorrect password history comprises separate sets of incorrect password history information for respective ones of the authentication servers.
6. The apparatus of claim 5 wherein the client is further configured to include in each of the sets of incorrect password history information a listing identifying no more than n most recently rejected passwords submitted by the client for the particular user to the corresponding one of the authentication servers.
7. The apparatus of claim 1 wherein the client is further configured to store the incorrect password history with the corresponding one or more incorrect passwords in hashed form.
8. The apparatus of claim 1 wherein the identifiers of the one or more passwords previously entered by the user and indicated as being incorrect passwords by at least one of the one or more authentication servers comprise the passwords themselves.
9. The apparatus of claim 1 wherein the identifiers of the one or more passwords previously entered by the user and indicated as being incorrect passwords by at least one of the one or more authentication servers comprise information generated by applying a cryptographic function to the passwords.
10. The apparatus of claim 9 wherein the cryptographic function comprises a hash function.
11. The apparatus of claim 1 wherein the client is further configured to delete a given one of the identifiers from the incorrect password history responsive to expiration of a timer associated with that identifier.
12. The apparatus of claim 1 wherein the client is further configured to delete the identifiers from the incorrect password history responsive to an indication from a given one of the one or more authentication servers that another password submitted by the client for the particular user is a correct password.
13. The apparatus of claim 1 wherein the client is further configured to submit the password to a given one of the one or more authentication servers in the form of authentication information computed as a cryptographic function of the password.
14. The apparatus of claim 1 wherein the client is further configured to submit the password to a given one of the one or more authentication servers in the form of authentication information computed using the password and a challenge received by the client from the given authentication server.
15. A method comprising:
configuring a client to perform client-side portions of one or more user authentication protocols carried out between the client and one or more authentication servers over a network;
storing in the client, for one or more instances of a given one of the user authentication protocols carried out for a particular user, an incorrect password history comprising identifiers of one or more passwords previously entered by the user and indicated as being incorrect passwords by at least one of the one or more authentication servers;
determining in the client, for an additional password entered by the user but not yet submitted by the client to the one or more authentication servers, whether or not the additional password is part of the incorrect password history; and
responsive to the additional password being part of the incorrect password history, generating in the client an alert for presentation to the user to indicate that the additional password may be an incorrect password;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
16. The method of claim 15 wherein the client is further configured, responsive to presentation of the alert to the user, to receive an override command from the user, and to submit the additional password to the one or more authentication servers responsive to receipt of the override command from the user.
17. The method of claim 15 wherein the one or more authentication servers comprise a plurality of authentication servers and wherein the client is further configured to maintain the incorrect password history on a per-server basis such that the incorrect password history comprises separate sets of incorrect password history information for respective ones of the authentication servers.
18. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes said processing device:
to configure a client to perform client-side portions of one or more user authentication protocols carried out between the client and one or more authentication servers over a network;
to store in the client, for one or more instances of a given one of the user authentication protocols carried out for a particular user, an incorrect password history comprising identifiers of one or more passwords previously entered by the user and indicated as being incorrect passwords by at least one of the one or more authentication servers;
to determine in the client, for an additional password entered by the user but not yet submitted by the client to the one or more authentication servers, whether or not the additional password is part of the incorrect password history; and
responsive to the additional password being part of the incorrect password history, to generate in the client an alert for presentation to the user to indicate that the additional password may be an incorrect password.
19. The computer program product of claim 18 wherein the client is further configured, responsive to presentation of the alert to the user, to receive an override command from the user, and to submit the additional password to the one or more authentication servers responsive to receipt of the override command from the user.
20. The computer program product of claim 18 wherein the one or more authentication servers comprise a plurality of authentication servers and wherein the client is further configured to maintain the incorrect password history on a per-server basis such that the incorrect password history comprises separate sets of incorrect password history information for respective ones of the authentication servers.