Internet-Wide User Credential Protection Through Reverse Proxies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information security solutions lack visibility and control over the use of user credentials issued by organizations when accessed outside their network perimeter, particularly on third-party sites and cloud provider platforms, with no practical or affordable way to deploy integrated/federated authentication or monitoring.
Innovation Solution
A system of distributed reverse proxy servers, organized in a content delivery network (CDN), monitors and secures user credentials by parsing authentication requests, applying credential policies, and employing machine learning to detect anomalies, with optional two-factor authentication, transparent to the content provider.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If distributed reverse proxy servers are deployed to monitor credentials Internet-wide, then credential monitoring coverage is improved, but system complexity increases
Solution Approach 1:
The patent introduces reverse proxy servers as intermediary components that sit between users and content providers. These proxies intercept authentication requests, extract credentials, and forward them to the monitoring system without requiring direct integration with every site. This intermediary approach enables comprehensive Internet-wide monitoring while keeping the system architecture manageable and decoupled.
Solution Approach 2:
The reverse proxy servers perform multiple functions: they act as standard web proxies for content delivery, credential extraction points for security monitoring, and policy enforcement nodes. By making these intermediaries multi-functional, the system achieves broad credential monitoring coverage without deploying separate specialized infrastructure for each function, thereby managing complexity.
2Reliability
If credential policies are applied at every authentication request, then security control is improved, but processing time increases
Solution Approach 1:
The system performs preliminary actions by pre-extracting credentials from authentication requests before full policy evaluation begins. The reverse proxy servers capture credentials upfront and prepare them for policy checking, allowing the monitoring system to process multiple credentials efficiently and reduce overall authentication latency.
Solution Approach 2:
The credential monitoring system is segmented into independent reverse proxy servers distributed across the Internet. Each proxy handles credential extraction locally, while policy evaluation and anomaly detection are performed by centralized or distributed analysis services. This segmentation allows parallel processing of multiple credentials and reduces the time any single authentication request spends in the monitoring pipeline.
3Measurement precision
If machine learning anomaly detection is implemented, then detection accuracy is improved, but computational resources increase
Solution Approach 1:
The system applies machine learning anomaly detection selectively rather than to every credential uniformly. The reverse proxy servers extract all credentials and submit them to the monitoring system, which then applies ML-based anomaly detection to a subset of credentials that exhibit suspicious patterns or require deeper analysis. This partial application of computational resources maintains detection accuracy for critical cases while reducing overall energy consumption.
Data Source
AI summary
Among other things, this document describes systems, methods, and apparatus for monitoring and protecting a user credential issued by an organization when that credential is used outside that organization's network security perimeter. For example, a reverse proxy server (RPS) receives a client request directed to a content provider's site. The RPS initiates a process that involves parsing the request message and extracting a user credential. The RPS locates a credential policy from the credential owner based on the user credential. The RPS can issue an API request to a credential service that is authoritative for the credential. That credential service may return a directive to the RPS specifying how to handle the client request message. Preferably, the operation is transparent to the content provider whose site was the target of the client's request message. Activity records can be presented in visualizations that enhance security analysts' tactical comprehension at a glance.