Mitigating risk from multi-factor authentication fatigue attacks

Abstract

An authentication system identifies and mitigates the effectiveness of a Multi-factor Authentication (MFA) Fatigue attack. The attack may be detected based on the number of requests for authentication received for a user within a predetermined time window, or through user or administrator input. Once detected, the authentication system is placed in a safe mode to mitigate the MFA Fatigue attack. In safe mode, all pending requests for authentication are automatically rejected. Subsequent requests for mitigation may be automatically rejected or the authentication process may be modified to accurately differentiate authentication attempts from a legitimate user from authentication attempts that are part of the MFA Fatigue attack. To further mitigate the effectiveness of MFA Fatigue attacks, the authentication system may use simulated authentication attempts to identify and train users who are susceptible to MFA Fatigue attacks.