Patent ID: 9729538
Date: 2017-08-08
CPC Classifications: G06F,H04L

Claim:
1. A method for recoupling Kerberos Authentication and Authorization requests from a client computer to a key domain controller (KDC), the method comprising the steps of: (a) associating, with a security computing device, an authentication server request with its corresponding authentication server reply to observe an authentication transaction comprising the authentication server request and its corresponding authentication server reply, a Ticket Granting Ticket (TGT) being included in the authentication server reply; (b) extracting, with the security computing device, authentication information from the authentication transaction and storing a copy of the TGT and the authentication information in the KDC, the authentication information not including the TGT; (c) observing, with the security computing device, a ticket granting server request containing the TGT; (d) extracting, with the security computing device that is independent of the client computer and the KDC, authorization information and a copy of the TGT from the ticket granting server request from the client computer, the authorization information not including the TGT; (e) retrieving, with the security computing device, authentication information including said TGT from the KDC, said authentication information having been previously extracted from the authentication transaction associated with the ticket granting server request and stored in the KDC; and (f) cross-referencing, with the security computing device, said extracted authorization information from the client computer with said retrieved authentication information from the KDC, such that a discrepancy between said cross-referenced information invokes a security event alert and outputs the security event alert to an administrator for display.