Cloud Credential Abuse Detection Using ASN Mismatch Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively detect and prevent unauthorized use of access tokens, which can lead to cyberattacks and data exfiltration in network services.
Innovation Solution
A method and apparatus that identify and compare autonomous system numbers (ASNs) associated with IP addresses and access tokens to generate alerts when mismatches are detected, indicating potential unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access tokens are used for authorization, then ease of operation is improved, but security reliability deteriorates due to unauthorized token usage
Solution Approach 1:
The patent introduces an intermediary verification system that checks the legitimacy of access tokens by comparing ASN information. This intermediary layer validates whether the token was obtained through proper authentication by verifying that the ASN of the service and the ASN of the IP address making the request match, thereby preventing unauthorized token usage while maintaining the ease of token-based authorization
Solution Approach 2:
The system implements feedback by continuously monitoring access token usage and comparing ASN information from log files with current service ASN data. When a mismatch is detected, the system generates alerts and blocks suspicious access attempts, providing real-time feedback that enhances security without disrupting legitimate operations
2Reliability
If comprehensive access monitoring is implemented, then security reliability is improved, but device complexity increases
Solution Approach 1:
The system performs self-service by automatically extracting ASN information from log files and comparing it with current service ASN data without requiring manual intervention. The automated verification process and alert generation reduce operational complexity while maintaining comprehensive monitoring capabilities
Solution Approach 2:
The patent applies preliminary action by pre-extracting and storing ASN information from log files before actual access requests occur. This preparatory step allows for rapid comparison and verification during real-time access monitoring, reducing the computational complexity during critical security checks
Data Source
AI summary
Methods, storage systems and computer program products implement embodiments of the present invention that include detecting an access by a networked entity to a service associated with a first autonomous system number (ASN) using a credential assigned to entities associated with the first ASN, determining whether the networked entity is authorized to use the credential by identifying a second ASN associated with the networked entity and with the credential, comparing the first ASN to the second ASN, and performing a security action upon determining that the networked entity is not authorized to use the credential based on a mismatch between the first ASN and the second ASN.