System and methods for detecting authentication object forgery or manipulation attacks
AssigneeQomplx LLC
InventorsJason Crabtree, Richard Kelley, Jason Hopper, David Park
Life of this patent
Estimating the term…
Abstract
A system and methods for detecting and mitigating authentication object forgery and manipulation attacks against services is provided, comprising a policy manager configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object; and a hashing engine configured to create a security cookie for each valid authentication session; wherein subsequent access requests accompanied by authentication objects are validated by checking for a valid security cookie.
Claims44
A computing system for detecting authentication object forgery or manipulation attacks, the computing system comprising:
- one or more hardware processors configured for:
- receiving a plurality of authorization information comprising a first authentication object for a user of a service, the first authentication object comprising a first identification string known to be generated by an identity provider associated with the service;
- generating a security cookie for the first authentication object, wherein the security cookie forms a bijective association with the first authentication object;
- registering the first authentication object and the associated security cookie in an authentication ledger;
- receiving a request for access to the service by the user accompanied by a second authentication object;
- deterministically verifying, in response to the request for access, that the second authentication object includes the security cookie associated with the first authentication object by checking the authentication ledger;
- and
- generating an authentication failure when the security cookie is missing or invalid.
A computer-implemented method executed for detecting authentication object forgery or manipulation attacks, the computer-implemented method comprising:
- receiving a plurality of authorization information comprising a first authentication object for a user of a service, the first authentication object comprising a first identification string known to be generated by an identity provider associated with the service;
- generating a security cookie for the first authentication object, wherein the security cookie forms a bijective association with the first authentication object;
- registering the first authentication object and the associated security cookie in an authentication ledger;
- receiving a request for access to the service by the user accompanied by a second authentication object;
- deterministically verifying, in response to the request for access, that the second authentication object includes the security cookie associated with the first authentication object by checking the authentication ledger;
- and
- generating an authentication failure when the security cookie is missing or invalid.
A system for detecting authentication object forgery or manipulation attacks, comprising one or more computers with executable instructions that, when executed, cause the system to:
- receive a plurality of authorization information comprising a first authentication object for a user of a service, the first authentication object comprising a first identification string known to be generated by an identity provider associated with the service;
- generate a security cookie for the first authentication object, wherein the security cookie forms a bijective association with the first authentication object;
- register the first authentication object and the associated security cookie in an authentication ledger;
- receive a request for access to the service by the user accompanied by a second authentication object;
- deterministically verify, in response to the request for access, that the second authentication object includes the security cookie associated with the first authentication object by checking the authentication ledger;
- and
- generate an authentication failure when the security cookie is missing or invalid.
Non-transitory, computer-readable storage media having computer-executable instructions embodied thereon that, when executed by one or more processors of a computing system for detecting authentication object forgery or manipulation attacks, cause the computing system to:
- receive a plurality of authorization information comprising a first authentication object for a user of a service, the first authentication object comprising a first identification string known to be generated by an identity provider associated with the service;
- generate a security cookie for the first authentication object, wherein the security cookie forms a bijective association with the first authentication object;
- register the first authentication object and the associated security cookie in an authentication ledger;
- receive a request for access to the service by the user accompanied by a second authentication object;
- deterministically verify, in response to the request for access, that the second authentication object includes the security cookie associated with the first authentication object by checking the authentication ledger;
- and
- generate an authentication failure when the security cookie is missing or invalid.
Dependencies are inferred from the claim text.