Efficient and secure user credential store for credentials enforcement using a firewall
Techniques for an efficient and secure store for credentials enforcement using a firewall are disclosed. In some embodiments, a system, process, and/or computer program product for an efficient and secure store for credentials enforcement using a firewall includes receiving a space-efficient and secure data structure, such as bloom filter, from an agent executed on an authentication server, in which the bloom filter is generated by the agent based on a transformation of a plurality of user credentials extracted from the authentication server and/or intercepted at the authentication server; storing the bloom filter on the network device (e.g., in a cache on the network device); and monitoring network traffic at the network device to perform credentials enforcement using the bloom filter.
1. A system for a credentials store for credentials enforcement using a firewall, comprising:
a processor of a network device configured to:
receive a plurality of user credentials from an authentication server;
transform the plurality of user credentials for storage at the network device, comprising to:
transform the plurality of user credentials into a bloom filter; and
store the plurality of user credentials in a cache on the network device, wherein network traffic is monitored at the network device to perform credentials enforcement based on one or more of the plurality of user credentials, wherein the bloom filter is stored in the cache;
monitor network communications between a client and an external site;
determine if the client sends a request that includes user credentials for authentication at the external site using the bloom filter; and
perform an action in response to a determination that the client sent the request that includes user credentials for authentication at the external site that match one or more of the plurality of user credentials stored at the network device, wherein the action includes activating an additional authentication request based on a two-factor authentication when an attempt to access a protected resource is detected; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system recited in claim 1 , wherein one or more of the plurality of user credentials includes a password.
3. The system recited in claim 1 , wherein one or more of the plurality of user credentials includes a username and a password.
4. The system recited in claim 1 , wherein the plurality of user credentials is received from an agent executed on the authentication server.
5. The system recited in claim 1 , wherein the processor is further configured to:
monitor session traffic between a client and an external site based on a firewall policy; and
block the session traffic if a violation of the firewall policy is determined, wherein the firewall policy includes a policy for credentials enforcement used in the external site authentication.
6. The system recited in claim 1 , wherein the processor is further configured to:
monitor session traffic between a client and an external site based on a firewall policy; and
generate an alert if a violation of the firewall policy is determined, wherein the firewall policy includes a policy for credentials enforcement used in the external site authentication.
7. The system recited in claim 1 , wherein the processor is further configured to:
monitor session traffic between a client and an external site based on a firewall policy; and
log the session traffic if a violation of the firewall policy is determined, wherein the firewall policy includes a policy for credentials enforcement used in the external site authentication.
8. The system recited in claim 1 , wherein the processor is further configured to:
extract a username and/or password from user credentials submitted in the request to perform credentials enforcement using the bloom filter.
9. The system recited in claim 1 , wherein the processor is further configured to:
extract a username and/or password from user credentials submitted in the request; and
determine if the username and/or password matches one or more of the plurality of user credentials to perform credentials enforcement using the bloom filter.
10. The system recited in claim 1 , wherein the processor is further configured to:
extract a username and/or password from user credentials submitted in the request;
determine if the username and/or password matches one or more of the plurality of user credentials to perform credentials enforcement using the bloom filter; and
if the username and/or password is determined to match one or more of the plurality of user credentials, then perform a responsive action.
11. The system recited in claim 1 , wherein the processor is further configured to:
extract a username and password from user credentials submitted in the request;
determine if the username and password match one or more of the plurality of user credentials to perform credentials enforcement using the bloom filter; and
if the username and password are determined to match one or more of the plurality of user credentials, then verify whether the username and password match one or more of the plurality of user credentials by querying the authentication server using the username and password.
12. A method for a credentials store for credentials enforcement using a firewall, comprising:
receiving a plurality of user credentials from an authentication server;
transforming the plurality of user credentials for storage at a network device, comprising:
transforming the plurality of user credentials into a bloom filter; and
storing the plurality of user credentials in a cache on the network device, wherein network traffic is monitored at the network device to perform credentials enforcement based on one or more of the plurality of user credentials, wherein the bloom filter is stored in the cache;
monitoring network communications between a client and an external site;
determining if the client sends a request that includes user credentials for authentication at the external site using the bloom filter; and
performing an action in response to a determination that the client sent the request that includes user credentials for authentication at the external site that match one or more of the plurality of user credentials stored at the network device, wherein the action includes activating an additional authentication request based on a two-factor authentication when an attempt to access a protected resource is detected.
13. A computer program product for a credentials store for credentials enforcement using a firewall, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
receiving a plurality of user credentials from an authentication server;
transforming the plurality of user credentials for storage at the network device, comprising:
transforming the plurality of user credentials into a bloom filter; and
storing the plurality of user credentials in a cache on a network device, wherein network traffic is monitored at the network device to perform credentials enforcement based on one or more of the plurality of user credentials, wherein the bloom filter is stored in the cache;
monitoring network communications between a client and an external site;
determining if the client sends a request that includes user credentials for authentication at the external site using the bloom filter; and
performing an action in response to a determination that the client sent the request that includes user credentials for authentication at the external site that match one or more of the plurality of user credentials stored at the network device, wherein the action includes activating an additional authentication request based on a two-factor authentication when an attempt to access a protected resource is detected.
14. A system for a credentials store for credentials enforcement using a firewall, comprising:
a processor of a network device configured to:
receive a bloom filter from an agent executed on an authentication server, wherein the bloom filter is generated by the agent based on a transformation of a plurality of user credentials extracted from the authentication server and/or intercepted at the authentication server;
store the bloom filter in a cache on the network device; and
monitor network traffic at the network device to perform credentials enforcement using the bloom filter;
monitor network communications between a client and an external site;
determine if the client sends a request that includes user credentials for authentication at the external site using the bloom filter; and
perform an action in response to a determination that the client sent the request that includes user credentials for authentication at the external site that match one or more of the plurality of user credentials stored at the network device, wherein the action includes activating an additional authentication request based on a two-factor authentication when an attempt to access a protected resource is detected; and
a memory coupled to the processor and configured to provide the processor with instructions.