Authentication Object Validation Using Security Cookies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing single-sign-on protocols like SAML and OAuth 2.0 are vulnerable to forged authentication objects, allowing attackers to masquerade as users and maintain persistence within federated service providers, often going undetected for extended periods.
Innovation Solution
A system and method that uses a policy manager to generate unique security cookies for legitimate authentication objects, registers them on an authentication ledger, and checks incoming objects for these cookies, generating failures if they are missing or invalid, thereby detecting and mitigating authentication object forgery or manipulation attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If single-sign-on protocols (SAML, OAuth 2.0) are used to enable federated service access, then user convenience and ease of operation are improved, but security vulnerability to forged authentication objects increases
Solution Approach 1:
The system performs preliminary actions by generating security cookies and registering them in an authentication ledger before the actual authentication object is used. This pre-registration allows the system to validate authentication objects against previously registered security cookies, preventing forged objects from being accepted while maintaining single-sign-on convenience.
Solution Approach 2:
The patent introduces an intermediary authentication ledger that sits between the identity provider and federated service providers. This ledger acts as a mediator that validates authentication objects by checking their security cookies against registered entries, thereby enhancing security without disrupting the existing single-sign-on flow.
2Difficulty of detecting and measuring
If traditional cybersecurity approaches are used to detect suspicious activity, then detection capability is limited, but system complexity and difficulty of detecting manipulation attacks increase
Solution Approach 1:
The system performs preliminary validation by checking security cookies against the authentication ledger before allowing authentication object processing. This pre-validation approach enables detection of forged authentication objects without requiring complex analysis of authentication protocols or extensive monitoring infrastructure.
3Speed
If authentication objects are validated without security cookies, then processing speed is fast, but forged authentication objects go undetected
Solution Approach 1:
The system performs preliminary registration of security cookies in the authentication ledger before authentication objects are validated. During validation, the system quickly checks whether the security cookie in the authentication object exists in the ledger, enabling fast detection of forged objects without requiring complex cryptographic verification or protocol analysis.
Data Source
AI summary
A system and methods for detecting and mitigating authentication object forgery and manipulation attacks against services is provided, comprising a policy manager configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object; and a hashing engine configured to create a security cookie for each valid authentication session; wherein subsequent access requests accompanied by authentication objects are validated by checking for a valid security cookie.