Detecting and mitigating forged authentication attacks within a domain
A system for detecting and mitigating attacks using forged authentication objects within a domain is provided, comprising an authentication object inspector configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object; and a hashing engine configured to retrieve the new authentication object from the authentication object inspector, calculate a cryptographic hash for the new authentication object, and store the cryptographic hash for the new authentication object in a data store; wherein subsequent access requests accompanied by authentication objects are validated by comparing hashes for each authentication object to previous generated hashes.
1 . A computing system for detecting and mitigating forged authentication attacks within a domain, comprising:
one or more hardware processors configured for:
receiving and storing a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
calculating and storing an authentication object identifier for each first authentication object;
receiving a request for access to a network resource associated with the authentication domain accompanied by a second authentication object;
calculating an authentication object identifier of the second authentication object;
determining whether the authentication object identifier of the second authentication object matches the stored first authentication object identifier; and
when the authentication object identifier of the second authentication object does not match the stored first authentication object identifier, generating a notification that the identity provider may be compromised.
2 . The computing system of claim 1 , wherein the authentication object identifiers are calculated by performing a plurality of calculations and transformations on each received authentication object.
3 . The computing system of claim 1 , wherein the computing system is operated by the identity provider.
4 . The computing system of claim 1 , wherein the computing system is operated by a client device communicating with the identity provider over a network.
5 . The computing system of claim 1 , wherein the computing system is operated by a Software-as-a-Service provider or a client-hosted device communicating with the identity provider, endpoint, or network infrastructure devices over a network.
6 . A computer-implemented method for detecting and mitigating forged authentication attacks within a domain, the computer-implemented method comprising:
receiving and storing a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
calculating and storing an authentication object identifier for each first authentication object;
receiving a request for access to a network resource associated with the authentication domain accompanied by a second authentication object;
calculating an authentication object identifier of the second authentication object;
determining whether the authentication object identifier of the second authentication object matches the stored first authentication object identifier; and
when the authentication object identifier of the second authentication object does not match the stored first authentication object identifier, generating a notification that the identity provider may be compromised.
7 . The computer-implemented method of claim 6 , wherein the authentication object identifiers are calculated by performing a plurality of calculations and transformations on each received authentication object.
8 . The computer-implemented method of claim 6 , wherein the computing system is operated by the identity provider.
9 . The computer-implemented method of claim 6 , wherein the computing system is operated by a client device communicating with the identity provider over a network.
10 . The computer-implemented method of claim 6 , wherein the computing system is operated by a Software-as-a-Service provider or a client-hosted device communicating with the identity provider, endpoint, or network infrastructure devices over a network.
11 . A system for detecting and mitigating forged authentication attacks within a domain, comprising one or more computers with executable instructions that, when executed, cause the system to:
receive and store a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
calculate and store an authentication object identifier for each first authentication object;
receive a request for access to a network resource associated with the authentication domain accompanied by a second authentication object;
calculate an authentication object identifier of the second authentication object;
determine whether the authentication object identifier of the second authentication object matches the stored first authentication object identifier; and
when the authentication object identifier of the second authentication object does not match the stored first authentication object identifier, generate a notification that the identity provider may be compromised.
12 . The system of claim 11 , wherein the authentication object identifiers are calculated by performing a plurality of calculations and transformations on each received authentication object.
13 . The system of claim 11 , wherein the computing system is operated by the identity provider.
14 . The system of claim 11 , wherein the computing system is operated by a client device communicating with the identity provider over a network.
15 . The system of claim 11 , wherein the computing system is operated by a Software-as-a-Service provider or a client-hosted device communicating with the identity provider, endpoint, or network infrastructure devices over a network.
16 . Non-transitory, computer-readable storage media having computer-executable instructions embodied thereon that, when executed by one or more processors of a computing system for detecting and mitigating forged authentication attacks within a domain, cause the computing system to:
receive and store a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
calculate and store an authentication object identifier for each first authentication object;
receive a request for access to a network resource associated with the authentication domain accompanied by a second authentication object;
calculate an authentication object identifier of the second authentication object;
determine whether the authentication object identifier of the second authentication object matches the stored first authentication object identifier; and
when the authentication object identifier of the second authentication object does not match the stored first authentication object identifier, generate a notification that the identity provider may be compromised.
17 . The non-transitory, computer-readable storage media of claim 16 , wherein the authentication object identifiers are calculated by performing a plurality of calculations and transformations on each received authentication object.
18 . The non-transitory, computer-readable storage media of claim 16 , wherein the computing system is operated by the identity provider.
19 . The non-transitory, computer-readable storage media of claim 16 , wherein the computing system is operated by a client device communicating with the identity provider over a network.
20 . The non-transitory, computer-readable storage media of claim 16 , wherein the computing system is operated by a Software-as-a-Service provider or a client-hosted device communicating with the identity provider, endpoint, or network infrastructure devices over a network.