Temporary Activation Block
By default, an activation that reaches the configured maximum number of failed attempts is blocked permanently and has to be unblocked manually.
For activations using cryptography protocol version 4, you can enable a temporary activation block instead.
When this feature is enabled, such activations are blocked only for a limited time after reaching the maximum number of failed attempts.
These activations are automatically returned to the ACTIVE state once the temporary block period expires. At that point, one authentication attempt becomes available again
(failedAttempts is decremented by 1). If this authentication attempt fails, the activation is blocked again for a longer period. If it succeeds, both the failedAttempts
counter and the temporary block counter are reset.
Temporary block flow:
- An activation reaches the maximum number of failed authentication attempts and is temporarily blocked.
- The activation remains in the
BLOCKEDstate until the configured block period expires. - Once the block period expires, the activation automatically returns to the
ACTIVEstate. - At the same time, the
failedAttemptscounter is decremented by 1, allowing exactly one authentication attempt. - If this authentication attempt succeeds - the
failedAttemptscounter is reset, and the temporary block counter is reset. - If this authentication attempt fails - the activation is temporarily blocked again, and the next temporary block period is longer than the previous one.
Activations using older protocol versions are always blocked permanently, regardless of this configuration.
The activation status enum is not extended - a temporarily blocked activation is reported as BLOCKED.
The timestamp when the block will be lifted is available in the activation status response consumed by the mobile SDK.
Consecutive Block
To prevent brute-force attacks, the block period is extended for each consecutive block using a configurable multiplier.
The n-th consecutive block lasts:
periodInMilliseconds * multiplier^(n-1) milliseconds
For example, with the default values (5-minute period and a multiplier of 2), the first block lasts 5 minutes, the second 10 minutes, the third 20 minutes, and so on.
Configuration
The feature is disabled by default. You can configure it using the following environment variables:
POWERAUTH_SERVER_CRYPTO_TEMPORARY_ACTIVATION_BLOCK_ENABLED=false
POWERAUTH_SERVER_CRYPTO_TEMPORARY_ACTIVATION_BLOCK_PERIOD_IN_MILLISECONDS=300000
POWERAUTH_SERVER_CRYPTO_TEMPORARY_ACTIVATION_BLOCK_MULTIPLIER=2
See Post-Install Configuration for more details.