System and methods for detecting and mitigating golden saml attacks against federated services

A system for detecting and mitigating golden SAML attacks against federated services, comprising:

• an authentication object inspector comprising at least a processor, a memory, and a plurality of programming instructions stored in the memory and operating on the processor, wherein the programmable instructions, when operating on the processor, cause the processor to:
• receive network traffic comprising a plurality of network packets, the plurality of network packets comprising at least a first authentication object known to be generated by an identity provider associated with a federated service;
• store a record of the first authentication object, with attached metadata comprising at least a timestamp of when the authentication object was received, in a time-series database;
• generate a security cookie for the first authentication object using a hashing engine;
• provide the security cookie to the identity provider from which the first authentication object was generated;
• receive a request for access to the federated service accompanied by a second authentication object;
• compare a value of an ID string within the second authentication object against a value of a corresponding ID string within the stored record of the first authentication object;
• check the second authentication object for a valid security cookie;
• and
• a hashing engine comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programmable instructions, when operating on the processor, cause the computing device to:
• receive authentication objects from the authentication object inspector;
• calculate a security cookie for each authentication object received by performing at least a plurality of calculations and transformations on each authentication object received;
• and
• return the security cookie for each authentication object received to the authentication object inspector.