Intermediary Identity Service Handling Against Client-Side Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity services, such as those using SAML, OAUTH, and OpenID, are vulnerable to security risks like man-in-the-middle attacks, especially when clients access secure resources over untrusted networks, as credentials can be intercepted and authentication assertions can be compromised.
Innovation Solution
An intermediary server is introduced to handle identity service transactions on behalf of the client, establishing a secure resource domain session and intercepting redirects to the identity domain, thereby preventing direct client interaction with the identity provider and encrypting all communications within the resource domain.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the client directly interacts with the identity provider to authenticate, then the authentication process is simple and direct, but the credentials and identity assertions are vulnerable to interception on untrusted networks
Solution Approach 1:
The patent introduces a reverse proxy server as an intermediary between the client and identity provider. The proxy establishes an encrypted tunnel on behalf of the client, intercepts redirects to the identity domain, and manages the authentication flow. This mediator shields the client from direct exposure to untrusted networks while maintaining the federated identity service functionality.
2Reliability
If the client establishes direct connections to the identity domain, then the authentication flow is straightforward, but DNS poisoning and BGP hijacking can redirect traffic to man-in-the-middle attackers
Solution Approach 1:
The reverse proxy pre-establishes an encrypted tunnel connection to the identity provider before the client needs to authenticate. By preparing this secure channel in advance, the system eliminates the need for the client to perform DNS lookups or establish direct connections to potentially compromised identity domains, thereby preventing DNS poisoning and BGP hijacking attacks.
3Reliability
If identity assertions are transmitted directly between client and resource host, then the authentication flow is efficient, but the assertions can be intercepted and compromised on untrusted networks
Solution Approach 1:
The patent embeds the identity domain transaction within the resource domain session by nesting the authentication flow inside the pre-established encrypted tunnel. The identity assertion travels through the nested secure channel created by the reverse proxy, protecting it from interception while maintaining efficient transaction flow without requiring additional external communication steps.
Data Source
AI summary
This document describes, among other things, security hardening techniques that guard against certain client-side attack vectors. These techniques generally involve the use of an intermediary that detects and handles identity service transactions on behalf of a client. In one embodiment, the intermediary establishes a resource domain session with the client in order to provide the client with desired resource domain content or services from a resource domain host. The intermediary detects when the resource domain host invokes a federated identity service as a condition of client access. The intermediary handles the identity transaction in the identity domain on behalf of the client within the client's resource domain session. Upon successful authentication and/or authorization with an IdP, the intermediary connects the results of the identity services domain transaction to the resource domain.