Cloud Identity Verification Ledger for Golden SAML and OAuth Forgery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems are vulnerable to Golden SAML and OAuth2 attacks, which exploit trust between identity and service providers, making detection and mitigation difficult, and there is a need for a centralized system to verify authentication transactions across multiple cloud identity providers.
Innovation Solution
A cloud-based identity verification exchange service (CIVEXS) that aggregates authentication data from various providers into a master global authentication ledger, providing centralized management, auditing, and analysis, with features like data ingestion, metadata management, and hashing capabilities to ensure authentication integrity and detect forgeries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a centralized authentication ledger is implemented to verify identity assertions across multiple providers, then detection precision of forgeries is improved, but device complexity increases
Solution Approach 1:
The patent introduces a centralized authentication ledger as an intermediary system that mediates between multiple identity providers and service providers. This ledger receives, stores, and verifies identity assertions from various providers, enabling centralized verification without requiring direct integration between all providers and consumers. The intermediary ledger simplifies the overall system architecture while improving detection precision through unified verification.
Solution Approach 2:
The authentication ledger is designed as a universal system that can handle identity assertions from multiple different identity providers and serve multiple service providers simultaneously. It performs multiple functions including receiving assertions, validating signatures, detecting forgeries, and providing verification services to various consumers, thereby reducing the need for separate verification systems for each provider-consumer pair.
2Reliability
If authentication data from multiple providers is aggregated into a centralized ledger, then authentication integrity is improved, but loss of time in data transmission and verification increases
Solution Approach 1:
The system performs preliminary actions by having identity providers submit their identity assertions to the centralized ledger in advance, before actual authentication events occur. The ledger pre-processes and stores these assertions with their cryptographic signatures, so that during actual authentication, service providers can quickly verify against the pre-stored data rather than performing full validation from scratch each time.
Solution Approach 2:
The authentication ledger creates and stores copies of identity assertions from multiple providers in a centralized location. These copies include the essential verification data (signatures, metadata) needed for quick validation. Service providers can then verify authentication by comparing against these pre-existing copies rather than contacting the original identity providers during the authentication moment, reducing verification time.
Data Source
AI summary
A system and method for providing a cloud identity verification exchange service which ingests a plurality of identity assertion data from various Identity Providers and/or Service Providers and aggregates the ingested plurality of data into a master global authentication ledger. The system and method comprise: a data ingestion engine configured for acquiring, extracting, and loading data into the system as well as providing hashing capabilities; a metadata manager for collecting, organizing, and cataloguing ingested data based on collected metadata; and database for storing the master global authentication ledger. The master ledger acts as a central repository that consolidates authentication objects from various Identity Providers, allowing for centralized authentication management, auditing, reporting, and analysis. It provides a comprehensive view of authentication activities across multiple systems and enables the tracking of user authentication events across different identity providers.