Kerberos interdiction and decryption for real-time analysis
A system and methods for Kerberos protocol collection, interdiction and decryption for real-time analysis to aid in both operational and security functions in SSO-enabled networks, using agent processes that intercept and decrypt Kerberos traffic to identify compromised credentials and accounts in real-time without exposing sensitive information.
1 . A system for Kerberos interdiction and decryption for real-time analysis, comprising:
an interdiction agent comprising a network packet capture and cryptographic processing software including at least a first plurality of programming instructions stored in a memory of, and operating on at least one processor of, a computing device, wherein the first plurality of programming instructions, when operating on the at least one processor, causes the computing device to:
receive a network request comprising encrypted Kerberos authentication tickets;
import an authentication private key from a Kerberos Key Distribution Center (KDC) data store associated with the network request;
decrypt the encrypted Kerberos authentication tickets using the imported authentication private key;
analyze the decrypted authentication ticket in real-time to determine credential validity and detect security events;
generate a timestamped notification for the detected security events comprising details of detected credential events and responsive actions; and
initiate revocation of the authentication tickets when invalid the analyzing determines invalid credentials.
2 . The system of claim 1 , further comprising a domain controller comprising at least a second plurality of programming instructions stored in a memory of, and operating on at least one processor of, a computing device, wherein the second plurality of programming instructions, when operating on the at least one processor, causes the computing device to:
generate a new private key corresponding to a user account;
store the new private key in a data store;
receive the notification from the interdiction agent; and
revoke the new private key based on the notification.
3 . The system of claim 2 , wherein the interdiction agent and the domain controller are both stored in the memory of, and operating on at least one processor of, the same computing device.
4 . The system of claim 2 , wherein the interdiction agent and the domain controller are each stored in the memory of, and operating on at least one processor of, separate computing devices.
5 . A method for Kerberos interdiction and decryption for real-time analysis, comprising the steps of:
receiving a network request comprising encrypted Kerberos authentication tickets;
importing an authentication private key from a Kerberos Key Distribution Center (KDC) data store associated with the network request;
decrypting the encrypted Kerberos authentication tickets using the imported authentication private key;
analyzing the decrypted authentication ticket in real-time to determine credential validity and detect security events;
generating a timestamped notification for the detected security events comprising details of detected credential events and responsive actions; and
initiating revocation of the authentication tickets when invalid the analyzing determines invalid credentials.
6 . The method of claim 5 , further comprising the steps of:
generating, using a domain controller, a new private key corresponding to a user account;
storing the new private key in a data store;
receiving the notification from the interdiction agent; and
revoking the new private key based on the notification.
7 . The method of claim 6 , wherein the interdiction agent and the domain controller are both stored in the memory of, and operating on at least one processor of, the same computing device.
8 . The method of claim 6 , wherein the interdiction agent and the domain controller are each stored in the memory of, and operating on at least one processor of, separate computing devices.