# US 12,003,534 B2 · Detecting and mitigating forged authentication attacks within a domain > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,534 B2 - Document ID: US12003534B2 - Status: Granted - Kind: B2 - Application number: 18/501,977 - Filed: 2023-11-03 - Published: 2024-03-07 - Granted: 2024-06-04 - Earliest claimed: 2015-10-28 - Assignees: Qomplx LLC - Applicants: Qomplx LLC - Inventors: Jason Crabtree; Andrew Sellers - Web page: https://patentgrep.com/patent/US12003534B2 ## CPC - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system for detecting and mitigating attacks using forged authentication objects within a domain is provided, comprising an authentication object inspector configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object; and a hashing engine configured to retrieve the new authentication object from the authentication object inspector, calculate a cryptographic hash for the new authentication object, and store the cryptographic hash for the new authentication object in a data store; wherein subsequent access requests accompanied by authentication objects are validated by comparing hashes for each authentication object to previous generated hashes. ## Claims ### Claim 1 A system for detecting and mitigating forged authentication attacks within a domain, comprising: a computing system comprising a memory and a processor; a policy manager subsystem comprising a plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing system to: receive and store a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain; calculate and store an authentication object identifier for each first authentication object; receive a request for access to a network resource associated with the authentication domain accompanied by a second authentication object; calculate an authentication object identifier of the second authentication object; compare the authentication object identifier of the second authentication object with the stored authentication object identifiers of the first authentication objects to determine whether the authentication object identifier of the second authentication object matches a stored first authentication object; where the authentication object identifier of the second authentication object does not match a stored first authentication object, generate a notification that the identity provider may be compromised. ### Claim 2 (depends on 1) The system of claim 1, wherein the authentication object identifiers are calculated using a hashing subsystem comprising a second plurality of programming instructions which, when operating on the processor, cause the computing system to: calculate cryptographic hashes for authentication objects received from the policy manager by performing a plurality of calculations and transformations on each received authentication object; and return the cryptographic hashes of authentication objects received to the policy manager as an authentication object identifier for the received authentication object. ### Claim 3 (depends on 1) The system of claim 1, wherein the policy manager is operated by the identity provider. ### Claim 4 (depends on 1) The system of claim 1, wherein the policy manager is operated by a client device communicating with the identity provider over a network. ### Claim 5 (depends on 1) The system of claim 1, wherein the policy manager is operated by a software-as-a-Service provider or a client hosted device communicating with the identity provider, endpoint, or network infrastructure devices over a network. ### Claim 6 A method of detecting and mitigating forged authentication attacks within a domain, comprising the steps of: using a policy manager subsystem operating on a computing system comprising a memory and a processor to: receive and store a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain; calculate and store an authentication object identifier of each first authentication object; receive a request for access to a network resource associated with the authentication domain accompanies by a second authentication object; calculate an authentication object identifier of the second authentication object; compare the authentication object identifier of the second authentication object with the authentication object identifiers of the first authentication objects stored in the database of authentication object identifiers to determine whether the authentication object identifier of the second authentication object matches an authentication object identifier of any stored first authentication object; and where the authentication object identifier of the second authentication object does not match an authentication object identifier of any stored first authentication object, generate a notification that the identity provider may be compromised. ### Claim 7 (depends on 6) The method of claim 6, wherein a hashing subsystem operating on the computing subsystem is used to: calculate cryptographic hashes for authentication objects received from the policy manager by performing a plurality of calculations and transformations on each received authentication object; and return the cryptographic hashes of authentication objects received to the policy manager as an authentication object identifier for the received authentication object. ### Claim 8 (depends on 6) The method of claim 6, wherein the policy manager is operated by the identity provider. ### Claim 9 (depends on 6) The system of claim 6, wherein the policy manager is operated by a software-as-a-Service provider or a client hosted device communicating with the identity provider, endpoint, or network infrastructure devices over a network. ### Claim 10 (depends on 6) The method of claim 6, wherein the policy manager is operated by a client device communicating with the identity provider over a network.