# US 12,598,197 B2 · System and methods for detecting authentication object forgery or manipulation attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,598,197 B2 - Document ID: US12598197B2 - Status: Granted - Kind: B2 - Application number: 18/619,162 - Filed: 2024-03-28 - Published: 2024-07-18 - Granted: 2026-04-07 - Earliest claimed: 2015-10-28 - Assignees: Qomplx LLC - Applicants: Qomplx LLC - Inventors: Jason Crabtree; Richard Kelley; Jason Hopper; David Park - Web page: https://patentgrep.com/patent/US12598197B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and methods for detecting and mitigating authentication object forgery and manipulation attacks against services is provided, comprising a policy manager configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object; and a hashing engine configured to create a security cookie for each valid authentication session; wherein subsequent access requests accompanied by authentication objects are validated by checking for a valid security cookie. ## Claims ### Claim 1 A computing system for detecting authentication object forgery or manipulation attacks, the computing system comprising: one or more hardware processors configured for: receiving a plurality of authorization information comprising a first authentication object for a user of a service, the first authentication object comprising a first identification string known to be generated by an identity provider associated with the service; generating a security cookie for the first authentication object, wherein the security cookie forms a bijective association with the first authentication object; registering the first authentication object and the associated security cookie in an authentication ledger; receiving a request for access to the service by the user accompanied by a second authentication object; deterministically verifying, in response to the request for access, that the second authentication object includes the security cookie associated with the first authentication object by checking the authentication ledger; and generating an authentication failure when the security cookie is missing or invalid. ### Claim 2 (depends on 1) The computing system of claim 1, wherein the one or more hardware processors are further configured for: calculating a unique identifier for the first authentication object by performing a plurality of calculations and transformations on the first authentication object; and linking the unique identifier to the security cookie to use in checking the authentication ledger for subsequently received authentication objects. ### Claim 3 (depends on 1) The computing system of claim 1, wherein the plurality of authorization information comprises a plurality of network packets obtained from network traffic logs. ### Claim 4 (depends on 3) The computing system of claim 3, wherein the plurality of network packets is encrypted. ### Claim 5 (depends on 3) The computing system of claim 3, wherein the plurality of network packets is unencrypted. ### Claim 6 (depends on 1) The computing system of claim 1, wherein the plurality of authorization information comprises a plurality of event log data. ### Claim 7 (depends on 1) The computing system of claim 1, wherein the first authentication object is an Open Authentication 2.0 (OAuth2) access token generated by the identity provider. ### Claim 8 (depends on 1) The computing system of claim 1, wherein the authentication ledger is a distributed digital ledger. ### Claim 9 (depends on 1) The computing system of claim 1, wherein the security cookie is based at least in part on an existing property of the first authentication object. ### Claim 10 (depends on 1) The computing system of claim 1, wherein the security cookie is based at least in part on session metadata for the user of the service based on device information, biometric indications, or behavioral indications. ### Claim 11 (depends on 1) The computing system of claim 1, wherein the security cookie forms a bijective association between an authentication event and a session associated with the authorization information, wherein the bijective association between the authentication event and the session associated with the authorization information can be used to link subsequent actions within the session back to the user of the service. ### Claim 12 A computer-implemented method executed for detecting authentication object forgery or manipulation attacks, the computer-implemented method comprising: receiving a plurality of authorization information comprising a first authentication object for a user of a service, the first authentication object comprising a first identification string known to be generated by an identity provider associated with the service; generating a security cookie for the first authentication object, wherein the security cookie forms a bijective association with the first authentication object; registering the first authentication object and the associated security cookie in an authentication ledger; receiving a request for access to the service by the user accompanied by a second authentication object; deterministically verifying, in response to the request for access, that the second authentication object includes the security cookie associated with the first authentication object by checking the authentication ledger; and generating an authentication failure when the security cookie is missing or invalid. ### Claim 13 (depends on 12) The computer-implemented method of claim 12, further comprising: calculating a unique identifier for the first authentication object by performing a plurality of calculations and transformations on the first authentication object; and linking the unique identifier to the security cookie to use in checking the authentication ledger for subsequently received authentication objects. ### Claim 14 (depends on 12) The computer-implemented method of claim 12, wherein the plurality of authorization information comprises a plurality of network packets obtained from network traffic logs. ### Claim 15 (depends on 14) The computer-implemented method of claim 14, wherein the plurality of network packets is encrypted. ### Claim 16 (depends on 14) The computer-implemented method of claim 14, wherein the plurality of network packets is unencrypted. ### Claim 17 (depends on 12) The computer-implemented method of claim 12, wherein the plurality of authorization information comprises a plurality of event log data. ### Claim 18 (depends on 12) The computer-implemented method of claim 12, wherein the first authentication object is an Open Authentication 2.0 (OAuth2) access token generated by the identity provider. ### Claim 19 (depends on 12) The computer-implemented method of claim 12, wherein the authentication ledger is a distributed digital ledger. ### Claim 20 (depends on 12) The computer-implemented method of claim 12, wherein the security cookie is based at least in part on an existing property of the first authentication object. ### Claim 21 (depends on 12) The computer-implemented method of claim 12, wherein the security cookie is based at least in part on session metadata for the user of the service based on device information, biometric indications, or behavioral indications. ### Claim 22 (depends on 12) The computer-implemented method of claim 12, wherein the security cookie forms a bijective association between an authentication event and a session associated with the authorization information, wherein the bijective association between the authentication event and the session associated with the authorization information can be used to link subsequent actions within the session back to the user of the service. ### Claim 23 A system for detecting authentication object forgery or manipulation attacks, comprising one or more computers with executable instructions that, when executed, cause the system to: receive a plurality of authorization information comprising a first authentication object for a user of a service, the first authentication object comprising a first identification string known to be generated by an identity provider associated with the service; generate a security cookie for the first authentication object, wherein the security cookie forms a bijective association with the first authentication object; register the first authentication object and the associated security cookie in an authentication ledger; receive a request for access to the service by the user accompanied by a second authentication object; deterministically verify, in response to the request for access, that the second authentication object includes the security cookie associated with the first authentication object by checking the authentication ledger; and generate an authentication failure when the security cookie is missing or invalid. ### Claim 24 (depends on 23) The system of claim 23, wherein executable instructions, when executed, further cause the system to: calculate a unique identifier for the first authentication object by performing a plurality of calculations and transformations on the first authentication object; and link the unique identifier to the security cookie to use in checking the authentication ledger for subsequently received authentication objects. ### Claim 25 (depends on 23) The system of claim 23, wherein the plurality of authorization information comprises a plurality of network packets obtained from network traffic logs. ### Claim 26 (depends on 25) The system of claim 25, wherein the plurality of network packets is encrypted. ### Claim 27 (depends on 25) The system of claim 25, wherein the plurality of network packets is unencrypted. ### Claim 28 (depends on 23) The system of claim 23, wherein the plurality of authorization information comprises a plurality of event log data. ### Claim 29 (depends on 23) The system of claim 23, wherein the first authentication object is an Open Authentication 2.0 (OAuth2) access token generated by the identity provider. ### Claim 30 (depends on 23) The system of claim 23 wherein the authentication ledger is a distributed digital ledger. ### Claim 31 (depends on 23) The system of claim 23, wherein the security cookie is based at least in part on an existing property of the first authentication object. ### Claim 32 (depends on 23) The system of claim 23, wherein the security cookie is based at least in part on session metadata for the user of the service based on device information, biometric indications, or behavioral indications. ### Claim 33 (depends on 23) The system of claim 23, wherein the security cookie forms a bijective association between an authentication event and a session associated with the authorization information, wherein the bijective association between the authentication event and the session associated with the authorization information can be used to link subsequent actions within the session back to the user of the service. ### Claim 34 Non-transitory, computer-readable storage media having computer-executable instructions embodied thereon that, when executed by one or more processors of a computing system for detecting authentication object forgery or manipulation attacks, cause the computing system to: receive a plurality of authorization information comprising a first authentication object for a user of a service, the first authentication object comprising a first identification string known to be generated by an identity provider associated with the service; generate a security cookie for the first authentication object, wherein the security cookie forms a bijective association with the first authentication object; register the first authentication object and the associated security cookie in an authentication ledger; receive a request for access to the service by the user accompanied by a second authentication object; deterministically verify, in response to the request for access, that the second authentication object includes the security cookie associated with the first authentication object by checking the authentication ledger; and generate an authentication failure when the security cookie is missing or invalid. ### Claim 35 (depends on 34) The non-transitory, computer-readable storage media of claim 34, wherein the computing system is further caused to: calculate a unique identifier for the first authentication object by performing a plurality of calculations and transformations on the first authentication object; and link the unique identifier to the security cookie to use in checking the authentication ledger for subsequently received authentication objects. ### Claim 36 (depends on 34) The non-transitory, computer-readable storage media of claim 34, wherein the plurality of authorization information comprises a plurality of network packets obtained from network traffic logs. ### Claim 37 (depends on 36) The non-transitory, computer-readable storage media of claim 36, wherein the plurality of network packets is encrypted. ### Claim 38 (depends on 36) The non-transitory, computer-readable storage media of claim 36, wherein the plurality of network packets is unencrypted. ### Claim 39 (depends on 34) The non-transitory, computer-readable storage media of claim 34, wherein the plurality of authorization information comprises a plurality of event log data. ### Claim 40 (depends on 34) The non-transitory, computer-readable storage media of claim 34, wherein the first authentication object is an Open Authentication 2.0 (OAuth2) access token generated by the identity provider. ### Claim 41 (depends on 34) The non-transitory, computer-readable storage media of claim 34, wherein the authentication ledger is a distributed digital ledger. ### Claim 42 (depends on 34) The non-transitory, computer-readable storage media of claim 34, wherein the security cookie is based at least in part on an existing property of the first authentication object. ### Claim 43 (depends on 34) The non-transitory, computer-readable storage media of claim 34, wherein the security cookie is based at least in part on session metadata for the user of the service based on device information, biometric indications, or behavioral indications. ### Claim 44 (depends on 34) The non-transitory, computer-readable storage media of claim 34, wherein the security cookie forms a bijective association between an authentication event and a session associated with the authorization information, wherein the bijective association between the authentication event and the session associated with the authorization information can be used to link subsequent actions within the session back to the user of the service.