DETECTING AND MITIGATING FORGED AUTHENTICATION ATTACKS USING AN ADVANCED CYBER DECISION PLATFORM
A system for detecting and mitigating forged authentication attacks is provided, comprising an authentication inspector configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object; and a hashing engine configured to retrieve the new authentication object from the authentication object inspector, calculate a cryptographic hash for the new authentication object, and store the cryptographic hash for the new authentication object in a data store; wherein subsequent access requests accompanied by authentication objects are validated by comparing hashes for each authentication object to previous generated hashes.
1 . A system for detecting and mitigating forged authentication attacks, comprising:
an authentication inspector comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a computing device, wherein the first plurality of programmable instructions, when operating on the processor, cause the computing device to:
receive a plurality of first authentication attributes associated with a network request;
calculate a cryptographic hash of each first authentication attribute using a hashing engine;
store the cryptographic hashes of the first authentication attributes in a database of hashes;
receive a request for access to a service accompanied by a plurality of second authentication attributes;
select a plurality of the second authentication attributes;
calculate a cryptographic hash of each of the selected second authentication attributes using the hashing engine;
determine whether the request for access is forged by comparing each hash of a second authentication attribute with the hashes of the first authentication attributes stored in the database of hashes to determine whether each hash of a second authentication attribute already exists in the database; and
where a hash of a second authentication attribute does not exist in the database, generate a notification that the request for access may be forged.
2 . The system of claim 1 , further comprising a rules engine comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programmable instructions, when operating on the processor, cause the computing device to:
retrieve a plurality of predefined rules from a data store upon detection of a forged authentication attribute; and
execute commands as dictated in each retrieved predefined rule.
3 . A method for detecting and mitigating forged authentication attacks, comprising the steps of:
receiving a plurality of first authentication attributes associated with a network request;
calculating a cryptographic hash of each first authentication attribute using a hashing engine;
storing the cryptographic hashes of the first authentication attributes in a database of hashes;
receiving a request for access to a service accompanied by a plurality of second authentication attributes;
selecting a plurality of the second authentication attributes;
calculating a cryptographic hash of each of the selected second authentication attributes using the hashing engine;
determining whether the request for access is forged by comparing each hash of a second authentication attribute with the hashes of the first authentication attributes stored in the database of hashes to determine whether each hash of a second authentication attribute already exists in the database; and
where a hash of a second authentication attribute does not exist in the database, generating a notification that the request for access may be forged.
4 . The method of claim 3 , further comprising the steps of:
retrieving a plurality of predefined rules from a data store upon detection of a forged authentication attribute; and
executing commands as dictated in each retrieved predefined rule.