System and method for preventing well behaving clients from causing account lockouts in a group
Methods and systems for account authentication in a distributed computing node group may involve sending a message to a member, the message having a first timestamp, increasing an authentication failure count, receiving a first key-exchange message from the member, the first key-exchange message having a second timestamp, evaluating the second timestamp, and determining whether to ignore the first key-exchange message based on an evaluation of the second timestamp. The first timestamp may be associated with a message received from the member prior to sending the message with the first timestamp to the member. The first key-exchange message may include a value computed by the member based on a group passcode shared with the member. The evaluation of the second timestamp may be based on at least one of a default value, the authentication failure count, or a timestamp associated with the group passcode.
1. A method for preventing account lockouts in a distributed computing node group, comprising:
sending a message to a group to identify a master of the group;
receiving a response to the message, the response received from the master to identify the master of the group;
sending a first key-exchange message to the master, the first key-exchange message comprising:
a first timestamp;
a value computed based on a shared group passcode;
receiving a second key-exchange message from the master in response to the first key-exchange message, the second key-exchange message comprising:
a first secret based on the shared group passcode;
a second timestamp;
sending a third key-exchange message to the master, the third key-exchange message comprising:
a second secret generated after a validation of the first secret;
receiving a fourth key-exchange message from the master in response to the third key-exchange message, the fourth key-exchange message encrypted with an encryption key corresponding to the second secret;
decrypting the fourth key-exchange message using the encryption key to obtain a group session transport encryption key;
deriving a message key based on the group session transport encryption key and a seed; and
sending an encrypted message to the master, the encrypted message encrypted with the message key.
2. The method of claim 1 , further comprising:
determining whether a request to authenticate communication with the master of the group is an external request; and
flushing a timestamp stored in a timestamp map in response to a determination that the request to authenticate communication with the master of the group is an external request, the timestamp associated with the master of the group.
3. The method of claim 1 , further comprising:
receiving an account lockout message from the master in response to the first key-exchange message;
updating the first timestamp of the first key-exchange message in response to the account lockout message; and
re-sending the first key-exchange message to the master, the first key-exchange message having the first timestamp updated.
4. The method of claim 1 , wherein:
the message to identify the master of the group is a shout message;
the shout message comprising a shout counter, wherein the shout counter is incremented before the message to identify the master is sent;
the response to the message to identify the master of the group is a whisper message;
the whisper message comprising a whisper counter associated with messages from the member that sent the whisper message; and
the whisper message is retained based on a determination that the shout counter that is incremented is greater than or equal to the whisper counter.
5. The method of claim 1 , further comprising:
storing the second timestamp by inserting an entry in a timestamp map, wherein the entry comprises:
an identifier for the master; and
the second timestamp.
6. The method of claim 5 , further comprising:
flushing the second timestamp from the timestamp map based on a determination that communication with the master is authenticated.
7. An information handling system, comprising:
a processor subsystem having access to a first memory;
a management controller comprising a secondary processor having access to a second memory, the second memory configured with an embedded storage partition and the second memory storing instructions executable by the secondary processor to:
send a message to a group to identify a master of the group;
receive a response to the message, the response received from the master to identify the master of the group;
send a first key-exchange message to the master, the first key-exchange message comprising:
a first timestamp;
a value computed based on a shared group passcode;
receive a second key-exchange message from the master in response to the first key-exchange message, the second key-exchange message comprising:
a second timestamp;
a first secret based on the shared group passcode;
send a third key-exchange message to the master, the third key-exchange message comprising:
a second secret generated after a validation of the first secret;
receive a fourth key-exchange message from the master in response to the third key-exchange message, the fourth key-exchange message encrypted with an encryption key corresponding to the second secret;
decrypt the fourth key-exchange message using the encryption key to obtain a group session transport encryption key;
derive a message key based on the group session transport encryption key and a seed; and
send an encrypted message to the master, the encrypted message encrypted with the message key.
8. The information handling system of claim 7 , wherein the second memory further stores instructions executable by the secondary processor to:
determine whether a request to authenticate communication with the master of the group is an external request; and
flush a timestamp stored in a timestamp map in response to a determination that the request to authenticate communication with the master of the group is an external request, the timestamp associated with the master of the group.
9. The information handling system of claim 7 , wherein the second memory further stores instructions executable by the secondary processor to:
receive an account lockout message from the master in response to sending the first key-exchange message;
update the first timestamp of the first key-exchange message in response to the account lockout message; and
re-send the first key-exchange message to the master, the first key-exchange message having the first timestamp updated.
10. The information handling system of claim 7 , wherein:
the message to identify the master of the group is a shout message;
the shout message comprising a shout counter, wherein the shout counter is incremented before the message to identify the master is sent;
the response to the message to identify the master of the group is a whisper message;
the whisper message comprising a whisper counter associated with messages from the member that sent the whisper message; and
the whisper message is retained based on a determination that the incremented shout counter is greater than or equal to the whisper counter.
11. The information handling system of claim 7 , wherein the second memory further stores instructions executable by the secondary processor to:
store the second timestamp by insertion of an entry in a timestamp map, wherein the entry comprises:
an identifier for the master; and
the second timestamp.
12. The information handling system of claim 11 , wherein the second memory further stores instructions executable by the secondary processor to:
flush the second timestamp from the timestamp map based on a determination that communication with the master is authenticated.
13. The information handling system of claim 12 , wherein the determination that communication with the master is authenticated comprises at least one of:
the validation the first secret of the second key-exchange message received from the master; or
the receipt and decryption of the fourth key-exchange to obtain the group session transport encryption key.
14. A management controller for an information handling system having a primary processor and a primary memory, the management controller comprising a secondary processor having access to a secondary memory, the secondary memory configured with an embedded storage partition and the secondary memory storing instructions executable by the secondary processor to:
send a message to a group to identify a master of the group;
receive a response to the message, the response received from the master to identify the master of the group;
send a first key-exchange message to the master, the first key-exchange message comprising:
a first timestamp;
a value computed based on a shared group passcode;
receive a second key-exchange message from the master in response to the first key-exchange message, the second key-exchange message comprising:
a second timestamp;
a first secret based on the shared group passcode;
send a third key-exchange message to the master, the third key-exchange message comprising:
a second secret generated after a validation of the first secret;
receive a fourth key-exchange message from the master in response to the third key-exchange message, the fourth key-exchange message encrypted with an encryption key corresponding to the second secret;
decrypt the fourth key-exchange message using the encryption key to obtain a group session transport encryption key;
derive a message key based on the group session transport encryption key and a seed; and
send an encrypted message to the master, the encrypted message encrypted with the message key.
15. The management controller of claim 14 , wherein the second memory further stores instructions executable by the secondary processor to:
determine whether a request to authenticate communication with the master of the group is an external request; and
flush a timestamp stored in a timestamp map in response to a determination that the request to authenticate communication with the master of the group is an external request, the timestamp associated with the master of the group.
16. The management controller of claim 14 , wherein the second memory further stores instructions executable by the secondary processor to:
receive an account lockout message from the master in response to sending the first key-exchange message;
update the first timestamp of the first key-exchange message in response to the account lockout message; and
re-send the first key-exchange message to the master, the first key-exchange message having the first timestamp updated.
17. The management controller of claim 14 , wherein:
the message to identify the master of the group is a shout message;
the shout message comprising a shout counter, wherein the shout counter is incremented before the message to identify the master is sent;
the response to the message to identify the master of the group is a whisper message;
the whisper message comprising a whisper counter associated with messages from the member that sent the whisper message; and
the whisper message is retained based on a determination that the incremented shout counter is greater than or equal to the whisper counter.
18. The management controller of claim 14 , wherein the second memory further stores instructions executable by the secondary processor to:
store the second timestamp by insertion of an entry in a timestamp map, wherein the entry comprises:
an identifier for the master; and
the second timestamp.
19. The management controller of claim 18 , wherein the second memory further stores instructions executable by the secondary processor to:
flush the second timestamp from the timestamp map based on a determination that communication with the master is authenticated.
20. The management controller of claim 19 , wherein the determination that communication with the master is authenticated comprises at least one of:
the validation the first secret of the second key-exchange message received from the master; or
the receipt and decryption of the fourth key-exchange to obtain the group session transport encryption key.