Detecting and mitigating attacks using forged authentication objects within a domain
A system for detecting and mitigating attacks using forged authentication objects within a domain is provided, comprising an authentication object inspector configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object; and a hashing engine configured to retrieve the new authentication object from the authentication object inspector, calculate a cryptographic hash for the new authentication object, and store the cryptographic hash for the new authentication object in a data store; wherein subsequent access requests accompanied by authentication objects are validated by comparing hashes for each authentication object to previous generated hashes.
1. A system for detecting and mitigating attacks using forged authentication objects within a domain, comprising:
a computing device comprising a memory and a processor;
an authentication object inspector comprising a plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing device to:
receive a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
store a record of each received first authentication object, with attached metadata comprising a timestamp of when each first authentication object was received, in a time-series database;
calculate an authentication object identifier for each first authentication object;
store the authentication object identifier of each first authentication object in a database of authentication object identifiers for the identity provider;
receive a request for access to a network resource associated with the authentication domain accompanied by a second authentication object;
calculate an authentication object identifier of the second authentication object;
compare the authentication object identifier of the second authentication object with the authentication object identifiers of the first authentication objects stored in the database of authentication object identifiers to determine whether the authentication object identifier of the second authentication object already exists in the database of authentication object identifiers;
where the authentication object identifier of the second authentication object does not exist in the database of authentication object identifiers, generate a notification that the identity provider may be compromised.
2. The system of claim 1 , wherein the authentication object identifiers are calculated using a hashing engine comprising a second plurality of programming instructions which, when operating on the processor, cause the computing device to:
receive authentication objects from the authentication object inspector;
calculate cryptographic hashes for received authentication objects by performing a plurality of calculations and transformations on each received authentication object; and
return the cryptographic hashes of authentication objects received to the authentication object inspector as an authentication object identifier for the received authentication object.
3. The system of claim 1 , wherein the authentication object inspector is operated by the identity provider.
4. The system of claim 1 , wherein the authentication object inspector is operated by a client device communicating with the identity provider over a network.
5. A method of detecting and mitigating attacks using forged authentication objects within a domain, comprising the steps of:
using an authentication object inspector operating on a computing device comprising a memory and a processor to:
receive a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
store a record of each received authentication object, with attached metadata comprising a timestamp of when the authentication object was received, in a time-series database;
calculate an authentication object identifier of each first authentication object;
store the authentication object identifier of the first authentication objects in a database of authentication object identifiers for the identity provider;
received a request for access to a network resource associated with the authentication domain accompanies by a second authentication object;
calculate an authentication object identifier of the second authentication object;
compare the authentication object identifier of the second authentication object with the authentication object identifiers of the first authentication objects stored in the database of authentication object identifiers to determine whether the authentication object identifier of the second authentication object already exists in the database; and
where the authentication object identifier of the second authentication object does not exist in the database of authentication object identifiers, generate a notification that the identity provider may be compromised.
6. The method of claim 5 , wherein a hashing engine operating on the computing device is used to:
receive authentication objects from the authentication object inspector;
calculate cryptographic hashes of authentication objects received by performing a plurality of calculations and transformations on each authentication object received; and
return the calculated cryptographic hashes to the authentication object inspector as an authentication object identifier for the received authentication object.
7. The method of claim 5 , wherein the authentication object inspector is operated by the identity provider.
8. The method of claim 5 , wherein the authentication object inspector is operated by a client device communicating with the identity provider over a network.