Providing a honeypot environment in response to incorrect credentials

Patent metadata

Field	Value
Publication number	US-10574697-B1
Application number	US-201514623241-A
Country	US
Kind code	B1
Filing date	Feb 16, 2015
Priority date	Feb 16, 2015
Publication date	Feb 25, 2020
Grant date	Feb 25, 2020

Abstract

Disclosed are various embodiments for providing a honeypot environment in response to incorrect security credentials being provided. An authentication request for an account to log into an application is received from a client. It is determined that the authentication request specifies an incorrect security credential for the account. The client is then provided with access to a honeypot environment in response to the authentication request. The honeypot environment is configured to mimic a successful login to the application via the account.

First claim

Therefore, the following is claimed:

1. A non-transitory computer-readable medium embodying a program executable in at least one computing device, wherein when executed the program causes the at least one computing device to at least:
in response to receiving from a client a login request for an account, determine whether the login request specifies an incorrect password;
in response to determining that the login request specifies the incorrect password, determine whether the incorrect password corresponds to a known compromised password; and
in response to determining that the incorrect password corresponds to the known compromised password, provide the client with access to a honeypot environment that is configured to mimic a successful login via the account.

2. The non-transitory computer-readable medium of claim 1 , wherein when executed the program further causes the at least one computing device to at least:
generate fake account information based at least in part on data associated with the account; and
send the fake account information to the client.

3. The non-transitory computer-readable medium of claim 1 , wherein the program corresponds to a web-based interactive application configured to elicit a password from a user via a hypertext transfer protocol (HTTP) GET or POST request through a network page.

4. A system, comprising:
at least one computing device; and
an authentication service executable in the at least one computing device, wherein when executed the authentication service causes the at least one computing device to at least:
in response to receiving from a first client a first authentication request for an account to log in to an application that specifies an incorrect security credential, determine that the authentication request is fraudulent based at least in part on at least one criterion;
record the incorrect security credential in a database of incorrect security credentials; and
in response to determining that a second authentication request for the account from a second client specifies the recorded incorrect security credential, provide the second client with access to a honeypot environment that is configured to mimic a successful login to the application via the account.

5. The system of claim 4 , wherein when executed the authentication service further causes the at least one computing device to at least, in response to determining that the first authentication request is not fraudulent, return an error message to the first client.

6. The system of claim 4 , wherein the at least one criterion indicates that the incorrect security credential corresponds to a known compromised credential.

7. The system of claim 4 , wherein the at least one criterion indicates that the incorrect security credential corresponds to a known compromised credential correlated to the account by way of an account identifier shared by both the known compromised credential and the account.

8. The system of claim 4 , wherein the at least one criterion indicates that the first authentication request exceeds a maximum number of permissible failed authentication requests for the account.

9. The system of claim 4 , wherein the at least one criterion indicates that the first authentication request exceeds a maximum number of permissible authentication requests from the first client for a plurality of accounts.

10. The system of claim 4 , wherein the honeypot environment is hosted by a computing device that also hosts a production environment.

11. The system of claim 10 , wherein the honeypot environment is configured to deny the second client access to at least one function of the application permitted under the production environment.

12. The system of claim 4 , wherein the application corresponds to a web-based interactive application configured to elicit a security credential from a user via a hypertext transfer protocol (HTTP) GET or POST request through a network page.

13. The system of claim 4 , wherein the honeypot environment is configured to generate at least one user interface that presents fake user information that does not correspond to the account, and the fake user information comprises at least one of: user payment instrument information, user address information, user order history information, or user name information.

14. A method, comprising:
receiving, via at least one of one or more computing devices, a first login request for an account from a first client;
determining, via at least one of the one or more computing devices, that the first login request specifies an incorrect security credential for the account;
recording, via at least one of the one or more computing devices, the incorrect security credential provided by the first client in a database of incorrect security credentials; and
providing, via at least one of the one or more computing devices, a second client with access to a honeypot environment in response to a second login request from the second client that specifies the incorrect security credential that has been recorded in the database of incorrect security credentials, the honeypot environment configured to mimic a successful login via the account.

15. The method of claim 14 , wherein the account is a legitimate user account.

16. The method of claim 14 , wherein determining, via at least one of the one or more computing devices, that the first login request specifies the incorrect security credential for the account further comprises determining, via at least one of the one or more computing devices, that the first login request exceeds a maximum number of permissible failed login requests for the account, the maximum number of permissible failed login requests being greater than zero.

17. The method of claim 14 , wherein determining, via at least one of the one or more computing devices, that the first login request specifies the incorrect security credential for the account further comprises determining, via at least one of the one or more computing devices, that the incorrect security credential is included in a security credential dictionary.

18. The method of claim 14 , wherein determining, via at least one of the one or more computing devices, that the first login request specifies the incorrect security credential for the account further comprises determining, via at least one of the one or more computing devices, that the incorrect security credential is included in a list of compromised security credentials.

19. The method of claim 14 , wherein providing the second client with access to the honeypot environment further comprises:
generating, via at least one of the one or more computing devices, fake user information;
generating, via at least one of the one or more computing devices, a user interface including the fake user information; and
sending, via at least one of the one or more computing devices, data encoding the user interface to the second client.

20. The method of claim 14 , wherein receiving the first login request further comprises receiving, via at least one of the one or more computing devices, the login request via a hypertext transfer protocol (HTTP) GET or POST request.

Assignees

• Amazon Tech Inc

Inventors

• Mcclintock Jon Arron
• Canavor Darren Ernest
• Stathakopoulos George Nikolaos

Classifications

• H04L63/1491 Primary

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title