Detection of bypass vulnerabilities

Patent metadata

Field	Value
Publication number	US-10084807-B2
Application number	US-201615054555-A
Country	US
Kind code	B2
Filing date	Feb 26, 2016
Priority date	Oct 16, 2015
Publication date	Sep 25, 2018
Grant date	Sep 25, 2018

Abstract

A method and proxy device for detecting bypass vulnerabilities in a cloud-computing platform are provided. The method includes identifying an access attempt by a client device to a cloud-based application hosted in the cloud-computing platform; identifying login information corresponding to the identified access attempt; requesting authenticated login information from a central authentication system; correlating the login information corresponding to the access attempt with the authenticated login information; determining, based on the correlation, whether a bypass vulnerability exists; and generating a bypass event when it is determined that the bypass vulnerability has been exploited wherein the bypass event indicates that the access attempt to the cloud-based application has not been properly authenticated.

First claim

What is claimed is:

1. A method for detecting authentication bypass vulnerabilities in a cloud-computing platform, comprising:
identifying an access attempt by a client device to a cloud-based application hosted in the cloud-computing platform;
receiving, from an access proxy, login information corresponding to the identified access attempt, wherein the access proxy is connected between the client device and the cloud computing platform;
requesting authenticated login information from a central authentication system;
correlating the received login information corresponding to the access attempt with the requested authenticated login information provided by the central authentication system;
determining, based on the correlation, whether an authentication bypass vulnerability exists, wherein the authentication bypass vulnerability exists when the received login information is uncorrelated with the requested authenticated login information; and
generating a bypass event when it is determined that the authentication bypass vulnerability exists, wherein the bypass event indicates that the access attempt to the cloud-based application has not been properly authenticated.

2. The method of claim 1 , further comprising:
upon generating the bypass event, causing execution of at least one mitigation action to secure the cloud-based application.

3. The method of claim 1 , wherein the central authentication system is any of: a federated identity management (FIdM) system and a single-sign-on (SSO) server.

4. The method of claim 1 , wherein each of the login information corresponding to the access attempt and the authenticated login information includes a set of attributes identifying at least one of: a user of the client device, the client device, and a request associated with the access attempt.

5. The method of claim 4 , wherein the set of attributes includes at least one of: a username, a password, login credentials, a current timestamp, and application-layer parameters.

6. The method of claim 4 , wherein correlating the login information with the authenticated login information further comprises:
comparing a set of attributes identified in the login information corresponding to the access attempt to a respective set of attributes identified in the authenticated login information; and
determining the login information as correlated to the authenticated login information, when the sets of attributes match.

7. The method of claim 6 , wherein the bypass vulnerability exists when the login information corresponding to the access attempt does not correlate to the authenticated login information.

8. The method of claim 6 , further comprising:
computing a confidence level based on the comparison of the set of attributes; and
associating the generated bypass event with the confidence level.

9. The method of claim 8 , further comprising:
selecting an access level from different access levels to be granted for the client device based on at least one of the confidence level and the bypass event, wherein the access level is any one of: full access, limited access, and no access.

10. The method of claim 1 , further comprising:
requesting the login information corresponding to the identified access attempt from the cloud-based application; and
determining that the client device bypasses authentication performed by the central authentication system when the bypass vulnerability exists.

11. The method of claim 1 , wherein the login information is derived from logs directly retrieved through a first API of the cloud-based application and the authenticated login information is derived from logs directly retrieved through a second API of the central authentication system.

12. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute a process for detecting authentication bypass vulnerabilities in a cloud-computing platform, the process comprising:
identifying an access attempt by a client device to a cloud-based application hosted in the cloud-computing platform;
receiving, from an access proxy, login information corresponding to the identified access attempt, wherein the access proxy is connected between the client device and the cloud computing platform;
requesting authenticated login information from a central authentication system;
correlating the received login information corresponding to the access attempt with the requested authenticated login information provided by the central authentication system;
determining, based on the correlation, whether an authentication bypass vulnerability exists, wherein the authentication bypass vulnerability exists when the received login information is uncorrelated with the requested authenticated login information; and

generating a bypass event when it is determined that the authentication bypass vulnerability exists, wherein the bypass event indicates that the access attempt to the cloud-based application has not been properly authenticated.

13. A proxy device for detecting authentication bypass vulnerabilities in a cloud-computing platform, the proxy device is connected between the client device and the cloud computing platform, the proxy device comprising:
a processing system; and
a memory, the memory containing instructions that, when executed by the processor, configure the proxy device to:
receive an access attempt by a client device to a cloud-based application hosted in the cloud-computing platform;
identify login information corresponding to the identified access attempt;

request authenticated login information from a central authentication system;
correlate the received login information corresponding to the access attempt with the requested authenticated login information provided by the central authentication system;
determine, based on the correlation, whether an authentication bypass vulnerability exists, wherein the authentication bypass vulnerability exists when the received login information is uncorrelated with the requested authenticated login information; and
generate a bypass event when it is determined that the bypass vulnerability exists, wherein the bypass event indicates that the access attempt to the cloud-based application has not been properly authenticated.

14. The proxy device of claim 13 , wherein the proxy device is further configured to:
cause execution of at least one mitigation action to secure the cloud-based application, upon generating the bypass event.

15. The proxy device of claim 13 , wherein the central authentication system is any of: a federated identity management (FIdM) system and a single-sign-on (SSO) server.

16. The proxy device of claim 13 , wherein each of the login information and the authenticated login information includes a set of attributes identifying at least one of: a user of the client device, the client device, and a request associated with the access attempt.

17. The proxy device of claim 16 , wherein the set of attributes includes at least one of: a username, a password, login credentials, a current timestamp, and application-layer parameters.

18. The proxy device of claim 16 , wherein the proxy server is further configured to:
compare a set of attributes identified in the login information corresponding to the access attempt to a respective set of attributes identified in the authenticated login information; and
determine the login information associated with the access attempt as correlated to the authenticated login information, when the sets of attributes match

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Most Yonatan
• Costica Yinon

Classifications

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title