System for slowing password attacks

A device that controls access to a network, the device comprising:

• a network interface for connection to a computer network;
• one or more processors for execution of software instructions;
• a login capture module executing on the one or more processors, the login capture module configured to generate a history of successful network logins;
• an attack detection module executing on the one or more processors, the attack detection module configured to detect symptoms of a network password attack and to activate a lockout in response to detecting the symptoms of the network password attack;
• an access control module executing on the one or more processors, the access control module configured to receive a valid login request from a user via the network interface while the lockout is activated, wherein the valid login request comprises a valid username and a valid password corresponding to the valid username;
• and
• a decision engine executing on the one or more processors, the decision engine configured to, while the lockout is activated, analyze the history of successful network logins to determine whether the valid login request satisfies a match condition,
• wherein the access control module is further configured to, while the lockout is activated, grant the user access to the network when the valid login request satisfies the match condition and deny the user access to the network when the valid login request does not satisfy the match condition even though the valid login request contains a valid username and a valid password.

A system, comprising:

• an endpoint device associated with a user and with which the user interacts to access a network;
• a network access controller coupled to the network, the network access controller comprising:
• one or more processors for execution of software instructions;
• a login capture module executing on the one or more processors, the login capture module configured to generate a history of successful network logins;
• an attack detection module executing on the one or more processors, the attack detection module configured to detect symptoms of a network password attack and to activate a lockout in response to detecting the symptoms of the network password attack;
• an access control module executing on the one or more processors, the access control module configured to receive a valid login request from a user while the lockout is activated, wherein the valid login request comprises a valid username and a valid password corresponding to the valid username;
• and
• a decision engine executing on the one or more processors, the decision engine configured to, while the lockout is activated, analyze the history of successful network logins to determine whether the valid login request satisfies a match condition,
• wherein the access control module is further configured to, while the lockout is activated, grant the user access to the network when the valid login request satisfies the match condition and deny the user access to the network when the valid login request does not satisfy the match condition even though the valid login request contains a valid username and a valid password.

A non-transitory computer-readable medium comprising instructions for causing a programmable processor to:

• generate a history of successful network logins;
• detect symptoms of a network password attack;
• activate a lockout in response to detecting the symptoms of the network password attack;
• receive a valid login request from a user while the lockout is activated, wherein the valid login request comprises a valid username and a valid password corresponding to the valid username;
• while the lockout is activated, analyze the history of successful network logins to determine whether the valid login request satisfies a match condition, grant the user access to the network when the valid login request satisfies the match condition, and deny the user access to the network when the valid login request does not satisfy the match condition even though the valid login request contains a valid username and a valid password.

A method comprising:

• generating a history of successful logins;
• detecting symptoms of a password attack;
• activating a lockout in response to detecting the symptoms of the password attack;
• receiving a valid login request from a user while the lockout is activated, wherein the valid login request comprises a valid username and a valid password corresponding to the valid username;
• while the lockout is activated, analyzing the history of successful logins to determine whether the valid login request satisfies a match condition;
• while the lockout is activated, granting the user access to a computing resource when the valid login request satisfies the match condition;
• and
• while the lockout is activated, denying the user access to the computing resource when the valid login request does not satisfy the match condition even though the valid login request contains a valid username and a valid password.