Authentication attack detection and mitigation with embedded authentication and delegation
A system and methods for authentication attack detection with embedded authentication and delegation is provided, comprising an authentication object inspector configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object, wherein subsequent access requests accompanied by authentication objects are validated by comparing identifiers for each authentication object to previous identifiers.
1 . A system for mitigating an authentication attack, comprising:
a memory storing instructions to be executed by one or more hardware processors; and
one or more hardware processors configured to execute the instructions stored in the memory, wherein the instructions, when executed by the one or more hardware processors, cause the system to:
maintain an authentication ledger comprising metadata associated with a plurality of authentication objects;
receive network traffic associated with a first authentication object;
update one or more portions of metadata in the authentication leger based on the received network traffic associated with the first authentication object;
receive a request for access to a network resource accompanied by the first authentication object;
upon a determination that the first authentication object is invalid, update the authentication ledger to reflect that the first authentication object is invalid, wherein the determination that the first authentication object is invalid is based on the received network traffic associated with the first authentication object; and
revoke access to other network resources based on the determination that the first authentication object is invalid, wherein the revocation of access to the other network resources is performed based on one or more rules executed by a distributed computational graph.
2 . The system of claim 1 , wherein the instructions instructions, when executed by the one or more hardware processors, cause the system to:
calculate an identifier comprising a cryptographic hash for the first authentication object by performing a plurality of calculations and transformations on the first authentication object; and
update one or more portions of metadata associated with first authentication object in the authentication ledger to include the identifier.
3 . The system of claim 1 , wherein the metadata associated with the first authentication object comprises a randomly-generated unique identifier for the first authentication object.
4 . The system of claim 1 , wherein the metadata associated with the first authentication object comprises a numerical counter for the first authentication object.
5 . The system of claim 1 , wherein the authentication ledger comprises a second authentication object derived from the first authentication object.
6 . The system of claim 1 , wherein the first authentication object is embedded within a web request.
7 . The system of claim 1 , wherein the first authentication object is known to be generated by an identity provider associated with an authentication domain based on tracking of legitimate authentication events associated with the identity provider.
8 . The system of claim 1 , wherein the authentication attack is a golden ticket attack.
9 . The system of claim 1 , wherein the authentication attack is a silver ticket attack.
10 . A method for mitigating an authentication attack, comprising the steps of:
maintaining an authentication ledger comprising metadata associated with a plurality of authentication objects;
receiving network traffic associated with a first authentication object;
updating one or more portions of metadata in the authentication leger based on the received network traffic associated with the first authentication object;
receiving a request for access to a network resource accompanied by the first authentication object;
upon a determination that the first authentication object is invalid, updating the authentication ledger to reflect that the first authentication object is invalid, wherein the determination that the first authentication object is invalid is based on the received network traffic associated with the first authentication object; and
revoking access to other network resources based on the determination that the first authentication object is invalid, wherein the revocation of access to the other network resources is performed based on one or more rules executed by a distributed computational graph.
11 . The method of claim 10 , further comprising the steps of:
calculating an identifier comprising a cryptographic hash for the first authentication object by performing a plurality of calculations and transformations on the first authentication object; and
updating one or more portions of metadata associated with first authentication object in the authentication ledger to include the identifier.
12 . The method of claim 10 , wherein the metadata associated with the first authentication object comprises a randomly-generated unique identifier for the first authentication object.
13 . The method of claim 10 , wherein the metadata associated with the first authentication object comprises a numerical counter for the first authentication object.
14 . The method of claim 10 , wherein the authentication ledger comprises a second authentication object derived from the first authentication object.
15 . The method of claim 10 , wherein the first authentication object is embedded within a web request.
16 . The method of claim 10 , wherein the first authentication object is known to be generated by an identity provider associated with an authentication domain based on tracking of legitimate authentication events associated with the identity provider.
17 . The method of claim 10 , wherein the authentication attack is a golden ticket attack.
18 . The method of claim 10 , wherein the authentication attack is a silver ticket attack.