F-SSO Anomaly Detection via In-Line Proxy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current corporate data security measures are inadequate in detecting unsecured computing devices and inconsistent identity associations, which pose threats through credential theft and unauthorized access, especially in environments relying on password protection and long inactivity timers.
Innovation Solution
Implementing an intermediary in-line device as an HTTP outbound proxy to monitor federated single sign-on (F-SSO) requests and detect anomalies by comparing user identities and attributes against known data, initiating actions such as blocking access or issuing alerts when inconsistencies are found.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If deep content inspection is performed on all data leaving the corporate network to detect sensitive information, then detection capability is improved, but system complexity and cost increase significantly
Solution Approach 1:
The patent extracts the detection function from deep content inspection and relocates it to the authentication protocol level. By monitoring F-SSO requests and comparing user identities against known data, the system achieves detection without requiring complex content inspection infrastructure. This extraction simplifies the overall system while maintaining effective detection capability.
Solution Approach 2:
The patent introduces an intermediary device positioned between users and external identity providers. This intermediary monitors F-SSO requests and compares authentication data against known information, serving as a lightweight detection mechanism that avoids the complexity of deep content inspection while maintaining effective security monitoring.
2Reliability
If smart card tokens and very short inactivity timers are used for two factor authentication, then security is improved, but cost and practicality worsen
Solution Approach 1:
The patent enables the existing F-SSO system to perform security monitoring functions without requiring additional hardware tokens or complex authentication mechanisms. The system uses the natural flow of authentication requests to detect anomalies, making security enhancement self-service rather than requiring separate security infrastructure.
Solution Approach 2:
The patent makes the F-SSO authentication protocol serve multiple functions: both user authentication and security anomaly detection. This multi-functionality eliminates the need for separate security devices like smart cards while maintaining effective security through the existing authentication infrastructure.
3Difficulty of detecting and measuring
If monitoring employee behavior and building behavior models is implemented to detect deviations, then detection capability is improved, but implementation complexity and cost increase
Solution Approach 1:
The patent performs preliminary action by pre-establishing known user identity associations and authentication patterns before anomalies occur. By monitoring current F-SSO requests against these pre-established baselines, the system detects deviations without requiring complex real-time behavior modeling, significantly reducing implementation complexity.
Data Source
AI summary
A method, apparatus and computer program product for detecting that a computing device may not be secure based on inconsistent identity associations identified during Federated Single Sign-On (F-SSO). A detection proxy detects when a user with a particular session is accessing an identity provider (IdP) that is associated with an account that is not the current user's account. When a user performs a login to an F-SSO-enabled IdP, the proxy performs an F-SSO, and the results are compared with known aliases for that particular federation partner. If an anomaly is detected (e.g., the in-line device sees that a user logs into a web site as someone else), a workflow is initiated to perform a given action, such as blocking access, issuing an alert, or the like.