US 11,818,169 B2
Detecting and mitigating attacks using forged authentication objects within a domain
Jason Crabtree, Vienna, VA (US); and Andrew Sellers, Monument, CO (US)
Assigned to QOMPLX LLC, New York, NY (US)
Filed by QOMPLX, Inc., Tysons, VA (US)
Filed on Oct. 26, 2022, as Appl. No. 17/974,257.
Application 17/974,257 is a continuation of application No. 17/169,924, filed on Feb. 8, 2021, granted, now 11,570,209.
Application 17/169,924 is a continuation in part of application No. 15/837,845, filed on Dec. 11, 2017, granted, now 11,005,824, issued on May 11, 2021.
Application 15/837,845 is a continuation in part of application No. 15/825,350, filed on Nov. 29, 2017, granted, now 10,594,714, issued on Mar. 17, 2020.
Application 15/825,350 is a continuation in part of application No. 15/725,274, filed on Oct. 4, 2017, granted, now 10,609,079, issued on Mar. 31, 2020.
Application 15/725,274 is a continuation in part of application No. 15/655,113, filed on Jul. 20, 2017, granted, now 10,735,456, issued on Aug. 4, 2020.
Application 15/655,113 is a continuation in part of application No. 15/616,427, filed on Jun. 7, 2017, abandoned.
Application 15/616,427 is a continuation in part of application No. 15/237,625, filed on Aug. 15, 2016, granted, now 10,248,910, issued on Apr. 2, 2019.
Application 15/237,625 is a continuation in part of application No. 15/206,195, filed on Jul. 8, 2016, abandoned.
Application 15/206,195 is a continuation in part of application No. 15/186,453, filed on Jun. 18, 2016, abandoned.
Application 15/186,453 is a continuation in part of application No. 15/166,158, filed on May 26, 2016, abandoned.
Application 15/166,158 is a continuation in part of application No. 15/141,752, filed on Apr. 28, 2016, granted, now 10,860,962, issued on Dec. 8, 2020.
Application 15/141,752 is a continuation in part of application No. 15/091,563, filed on Apr. 5, 2016, granted, now 10,204,147, issued on Feb. 12, 2019.
Application 15/091,563 is a continuation in part of application No. 14/986,536, filed on Dec. 31, 2015, granted, now 10,210,255, issued on Feb. 19, 2019.
Application 14/986,536 is a continuation in part of application No. 14/925,974, filed on Oct. 28, 2015, abandoned.
Application 15/616,427 is a continuation in part of application No. 14/925,974, filed on Oct. 28, 2015.
Claims priority of provisional application 62/596,105, filed on Dec. 7, 2017.
Prior Publication US 2023/0123314 A1, Apr. 20, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); H04L 9/06 (2006.01)
CPC H04L 63/1466 (2013.01) [H04L 9/0643 (2013.01); H04L 63/1416 (2013.01); H04L 63/1425 (2013.01)] 8 Claims
OG exemplary drawing
 
1. A system for detecting and mitigating attacks using forged authentication objects within a domain, comprising:
a computing device comprising a memory and a processor;
an authentication object inspector comprising a plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing device to:
receive a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
store a record of each received first authentication object, with attached metadata comprising a timestamp of when each first authentication object was received, in a time-series database;
calculate an authentication object identifier for each first authentication object;
store the authentication object identifier of each first authentication object in a database of authentication object identifiers for the identity provider;
receive a request for access to a network resource associated with the authentication domain accompanied by a second authentication object;
calculate an authentication object identifier of the second authentication object;
compare the authentication object identifier of the second authentication object with the authentication object identifiers of the first authentication objects stored in the database of authentication object identifiers to determine whether the authentication object identifier of the second authentication object already exists in the database of authentication object identifiers;
where the authentication object identifier of the second authentication object does not exist in the database of authentication object identifiers, generate a notification that the identity provider may be compromised.