Cloud Access Token Abuse Detection Using ASN Mismatch
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively detect and prevent unauthorized use of access tokens, which can lead to cyberattacks and data exfiltration in network services.
Innovation Solution
A method and apparatus that identify and compare autonomous system numbers (ASNs) associated with IP addresses and access tokens to generate alerts when mismatches are detected, indicating potential unauthorized access, and differentiate between low and high-severity threats based on organizational matches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access token validation is used, then authentication is simple and fast, but security against unauthorized access is insufficient
Solution Approach 1:
The patent introduces an autonomous system number (ASN) as an intermediary verification layer between the access token and the service. Instead of directly trusting the access token alone, the system retrieves the ASN from the token's IP address and compares it with the service's expected ASN, creating an additional security checkpoint that validates the token's legitimacy without significantly increasing system complexity.
Solution Approach 2:
The system performs preliminary validation by pre-fetching and storing the expected ASN for each service before access attempts occur. This allows the detection mechanism to quickly compare the token's IP-derived ASN against the pre-stored expected ASN during the access request, eliminating the need for complex real-time analysis and enabling fast security verification.
2Measurement precision
If ASN comparison validation is added, then unauthorized access detection improves, but processing time and system complexity increase
Solution Approach 1:
The system pre-fetches and caches the expected ASN for each service before any access validation occurs. This preliminary action ensures that during the actual access request, the system only needs to perform a simple comparison between the token's IP-derived ASN and the pre-stored expected ASN, rather than performing complex real-time lookups or analyses, thus maintaining fast validation times while achieving high detection accuracy.
3Measurement precision
If detailed organizational matching is performed, then threat differentiation accuracy improves, but computational overhead increases
Solution Approach 1:
The system performs partial organizational matching by first comparing ASN values and then selectively performing more detailed organization name comparisons only when the ASN comparison indicates a potential mismatch. This partial action approach achieves sufficient threat differentiation accuracy by focusing computational resources on suspicious cases rather than performing full organizational analysis on every access request, thereby reducing overall computational energy consumption.
Data Source
AI summary
Methods, storage systems and computer program products implement embodiments of the present invention that include identifying a first autonomous system number (ASN) for a service hosted by a networked entity, and retrieving, from a log file, an entry corresponding to an access by a networked entity to the service and including an Internet Protocol (IP) address of the networked entity and an access token authorizing access to the service. A second ASN for the IP address is identified, and the second ASN is compared to the first ASN. Finally, an alert is generated for the access upon detecting the first ASN differing from the second ASN.