Detecting and mitigating forged authentication object attacks in multi-cloud environments with attestation
A system for detecting and mitigating forged authentication object attacks in federated environments using attestation is provided, comprising an event inspector to monitor logs and detect vulnerable events, an authentication object inspector configured to observe a new authentication object generated by an identity provider, and intercept the new authentication object; and a hashing engine configured to calculate a cryptographic hash for the new authentication object, and store the cryptographic hash for the new authentication object in the SAML response; wherein subsequent access requests accompanied by authentication objects are validated by comparing hashes for each authentication object to previous generated hashes.
1. A cloud-based system for detecting and mitigating forged authentication object attacks in federated environments using attestation, comprising:
a plurality of virtual machines comprising at least a processor and at least a memory;
an authentication object inspector comprising a first plurality of programming instructions stored in the memory of, and operating on a processor of, a virtual machine of the plurality of virtual machines, wherein the first plurality of programmable instructions, when operating on the processor, cause the virtual machine to:
receive an authentication object known to be generated by an identity provider;
calculate a cryptographic hash of the authentication object using a hashing engine;
store the cryptographic hash in the authentication object;
forward the authentication object to the service provider; and
where the hash of the authentication object does not exist in the authentication object received by the service provider, generate a notification that the authentication object may be forged; and
an event inspector comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the virtual machine of the plurality of virtual machines, wherein the second plurality of programmable instructions, when operating on the processor, cause the virtual machine to:
monitor a plurality of service provider logs for a successful login event or a certificate export event;
identify one or more entities associated with the successful login event or a certificate export event;
search a plurality of security event logs from the one or more associated entities for corresponding events to determine if the successful login event is legitimate; and
trigger the execution of one or more commands as dictated in a plurality of predefined rules upon detection of an illegitimate login event or a certificate export event.
2. The cloud-based system of claim 1 , wherein the authentication object inspector is further configured to:
obtain attestation data from a machine invoking a service;
calculate the cryptographic hash of the authentication object based at least in part on the attestation data using the hashing engine; and
store the attestation data and the authentication object in an authentication object ledger.
3. The cloud-based system of claim 2 , wherein the attestation data is based at least in part on machine state information associated with the machine invoking the service.
4. The cloud-based system of claim 3 , wherein the machine state information comprises current configurations, settings, and condition of the machine.
5. The cloud-based system of claim 3 , wherein the machine state information comprises information about the kernel integrity of the machine.
6. The cloud-based system of claim 3 , wherein the machine state information comprises information about operating system details.
7. A method for detecting and mitigating forged authentication object attacks in federated environments using attestation, comprising the steps of:
receiving an authentication object known to be generated by an identity provider;
calculating a cryptographic hash of the authentication object using a hashing engine;
storing the cryptographic hashes in the authentication object;
forwarding the authentication object to the service provider
where the hash of the authentication object does not exist in the authentication object received by the service provider, generating a notification that the authentication object may be forged;
monitoring a plurality of service provider logs for a successful login event or a certificate export event;
identifying one or more entities associated with the successful login event or a certificate export event;
searching a plurality of security event logs from the one or more associated entities for corresponding events to determine if the successful login event is legitimate; and
triggering the execution of one or more commands as dictated in a plurality of predefined rules upon detection of an illegitimate login event or a certificate export event.
8. The method of claim 7 , further configured to:
obtain attestation data from a machine invoking a service;
calculate the cryptographic hash of the authentication object based at least in part on the attestation data using the hashing engine; and
store the attestation data and the authentication object in an authentication object ledger.
9. The method of claim 8 , wherein the attestation data is based at least in part on machine state information associated with the machine invoking the service.
10. The method of claim 9 , wherein the machine state information comprises current configurations, settings, and condition of the machine.
11. The method of claim 9 , wherein the machine state information comprises information about the kernel integrity of the machine.
12. The method of claim 9 , wherein the machine state information comprises information about operating system details.