Computer system employing challenge/response protocol with detection of non-unique incorrect responses

A computer system, comprising:

• one or more processors;
• memory coupled to the processors;
• and
• interface circuitry coupled to the memory, the interface circuitry providing an interface to a separate client;
• the memory storing computer program instructions which, when executed by the processors, cause the computer system to perform a method to control client access to protected computer system resources, the method including:
• sending a challenge to a client and receiving a corresponding response, the response including a response value, the challenge including a challenge value of a challenge/response pair computed using a secret shared with the client;
• making a determination whether the response is a correct response, a unique incorrect response, or a non-unique incorrect response, the correct response being identified based on the response value matching a response value of the challenge/response pair, the unique incorrect response and non-unique incorrect response being differentiated based on comparing the response value with a store of unique incorrect response values for challenges using the challenge value;
• and
• taking action based on the determination according to the following:
• for the correct response, permitting client access to the protected computer system resources and discarding the challenge value so as not to be used in subsequent challenges to the client;
• for the unique incorrect response, (1) when a predetermined limit of unique incorrect responses has not been reached, then adding the response value to the store of unique incorrect response values and repeating the above steps with reuse of the challenge value, and (2) when the predetermined limit has been reached, then locking out the client to prevent client access to the protected computer system resources even when the client correctly responds to a subsequent challenge;
• and
• for the non-unique incorrect response, repeating the above steps with reuse of the challenge value.

A non-transitory computer-readable medium storing computer program instructions, the instructions being executable by a set of one or more computers to cause the computers to perform a method to control client access to protected computer system resources, the method including:

• sending a challenge to a client and receiving a corresponding response, the response including a response value, the challenge including a challenge value of a challenge/response pair computed using a secret shared with the client;
• making a determination whether the response is a correct response, a unique incorrect response, or a non-unique incorrect response, the correct response being identified based on the response value matching a response value of the challenge/response pair, the unique incorrect response and non-unique incorrect response being differentiated based on comparing the response value with a store of unique incorrect response values for challenges using the challenge value;
• and
• taking action based on the determination according to the following:
• for the correct response, permitting client access to the protected computer system resources and discarding the challenge value so as not to be used in subsequent challenges to the client;
• for the unique incorrect response, (1) when a predetermined limit of unique incorrect responses has not been reached, then adding the response value to the store of unique incorrect response values and repeating the above steps with reuse of the challenge value, and (2) when the predetermined limit has been reached, then locking out the client to prevent client access to the protected computer system resources even when the client correctly responds to a subsequent challenge;
• and
• for the non-unique incorrect response, repeating the above steps with reuse of the challenge value.