Active IP Geolocation

Abstract

This invention provides a computer-based method for determining the source of instruction information in a networked connection between a client device and a server. [Solution] The method includes receiving the instruction information from a client device on a server, determining a client-server value based on the transmission time of a connection signal transmitted between the client device and the server, transmitting a tracing signal addressed to the instruction information via a specific router in a networked connection between the client device and the server, determining a tracing value based on the transmission time of the tracing signal to the specific router, and determining whether the instruction information originated from an intermediate connection in the networked connection or from the client device by comparing a difference value based on the client-server value and the tracing value with a threshold.

Description

Technical Field

[0001] The present invention relates to a method for determining the source of instruction information within a network. In particular, the present invention relates to a method for determining the source of instruction information in a networked connection between a client and a server, and to a corresponding computer program and information processing apparatus.

Background Art

[0002] Active IP geolocation is a process of identifying the location of a device by probing or operating the device on the Internet. However, some users may attempt to distort their recognized location information. This can occur because communication via the Internet can be either direct communication (where a device (often called a client device and belonging to a user) directly sends packets to a server) or indirect communication (where a client device directly sends packets to a third-party (intermediate) device, and that device relays the communication to the server). In such communication, the destination IP address of the packets sent from the client device and the destination IP address of the packets sent from the server both become the IP address of a third-party relay device. Examples of such third-party relay devices include proxy servers, VPN servers, and even the Tor network.

[0003] A Virtual Private Network (VPN) is a mechanism used to create a secure connection between a computer / network (e.g., the client / client device mentioned herein) via an insecure connection medium (usually the public Internet) and another network. That connection is protected by a secure virtual point-to-point (PTP) connection to a secure server using a tunneling protocol. By using a VPN, the original IP of the connected client device is obfuscated / hidden, and the client is virtually connected to the target network.

[0004] Therefore, a VPN server can run software that forwards network traffic while obscuring the source of the communication. There are many practical uses for VPNs, but there are also malicious uses. Users typically use indirect communication to hide their information from the final destination server they are communicating with indirectly. Information that a VPN / proxy can hide from an end server includes the location information and IP address of the client device. Indirect communication can also prevent the access network of the client device from knowing which final destination server the client device is communicating with.

[0005] VPN servers can be used by malicious attackers to conceal their identities, and by spoofing source IPs, the location information of client devices can also be spoofed. Therefore, VPN / proxy detection is necessary to detect and prevent geolocation spoofing. VPN detection can be particularly important in services that utilize geolocation as a security element, such as zero-trust infrastructure and fraud prevention services. The global zero-trust security market is valued at $26.45 billion and is projected to reach $162.91 billion by 2032 (https: / / www.emergenresearch.com / industry-report / zero-trust-security-market (accessed May 19, 2024)). Similarly, the fraud detection and prevention market was valued at $36.89 billion in 2022 and is projected to grow to $182.66 billion by 2030 (https: / / www.fortunebusinessinsights.com / industry-reports / fraud-detection-and-prevention-market-100231 (accessed May 19, 2024)). IP geolocation is also a growing market, expected to reach $7.4 billion by 2031 (see https: / / www.alliedmarketresearch.com / [accessed September 18, 2024]).

[0006] Client obfuscation using VPNs or proxy services can be a significant weakness in IP geolocation as a security element. When a client connects to a server using a VPN, the IP address observed by the server is the VPN's IP address, not the client's own IP address. In other words, the geolocation of the "client's" IP address returns the VPN server's location instead. This "flaw" can be exploited to effectively circumvent geolocation-based defenses. Obfuscation can effectively alter a client's perceived geographical location, potentially allowing access to geographically restricted services (such as government services, financial services, and content streaming). For these reasons, VPN detection has always been a pressing issue for secure services that require a high level of reliability.

[0007] Existing solutions for detecting client VPN usage generally employ passive methods that rank (or score) Internet Protocol (IP) addresses to which VPNs / proxies are known to be connected. For example, existing methods may use APIs with known IP databases and behavioral analytics to detect VPN / proxy usage. Some known services collect data over time, analyze communications in combination with publicly available information, and create risk scores and proxy / VPN ratings. However, these methods are often not robust enough for truly sensitive services and can be circumvented. [Overview of the Initiative] [Problems that the invention aims to solve]

[0008] Therefore, it is desirable to improve the ability of services (e.g., services from the server) to detect when a VPN is being used by a client (client device). [Means for solving the problem]

[0009] The present invention is defined in the independent claims, which should be referenced herein. Further features are described in the dependent claims.

[0010] A computer-implemented method is provided for determining the source of instruction information in a networked connection between a client device and a server, according to the first aspect. The method includes the steps of: receiving or causing a server to receive instruction information from a client device; determining a client-server value based on the transmission time of a connection signal transmitted between the client device and the server; transmitting or causing a tracing signal addressed to the instruction information via a specific router in the networked connection between the client device and the server; determining a tracing value based on the transmission time of the tracing signal to the specific router; and determining whether the instruction information originated from an intermediate connection in the networked connection or from the client device by comparing a difference value based on the client-server value and the tracing value with a threshold.

[0011] In another aspect, a computer-implemented method is provided for determining the origin of instruction information in a networked connection between a client device and a server, the method comprising: receiving or causing a server to receive instruction information from a client device; determining a client-server value based on the transmission time of a connection signal transmitted between the client device and the server; causing the server to send or cause a packet internet or internet network grower (PING) message addressed to the instruction information in the networked connection; sending or causing a tracing signal to a specific router in the networked connection between the client device and the server if the elapsed time for receiving a PING response message has elapsed; determining a tracing value based on the transmission time of the tracing signal; and determining whether the instruction information originated from an intermediate connection in the networked connection or from the client device by comparing a difference value based on the client-server value and the tracing value with a threshold. [Brief explanation of the drawing]

[0012] [Figure 1a] This shows an example of a virtual private network configuration within a network. [Figure 1b] This document shows the handshake procedures between the client and server, between the client and proxy, and between the client and VPN. [Figure 2] This document outlines the steps for determining the source of instruction information in a networked connection between a client device and a server. [Figure 3] This document presents an example of a method for determining the source of instruction information in a networked connection between a client device and a server. [Figure 4]A flowchart shows the steps for an alternative method of determining the source of instruction information in a networked connection between a client device and a server. [Figure 5] This document presents an embodiment of another method for determining the source of instruction information in a networked connection between a client device and a server. [Figure 6a] Further embodiments of another method for determining the source of instruction information in a networked connection between a client device and a server are presented. [Figure 6b] Further embodiments of another method for determining the source of instruction information in a networked connection between a client device and a server are presented. [Figure 6c] Further embodiments of another method for determining the source of instruction information in a networked connection between a client device and a server are presented. [Figure 7] This example illustrates coordination between a probe and a server to determine transmission delay in a network connection. [Figure 8a] A flowchart illustrating the implementation of the methods described herein is provided. [Figure 8b] A flowchart illustrating the implementation of the methods described herein is provided. [Figure 8c] A flowchart illustrating the implementation of the methods described herein is provided. [Figure 9] Other flowcharts illustrating the methods described herein are shown below. [Figure 10] This specification shows an architecture for implementing the methods described herein. [Figure 11] This shows a block diagram of an information processing device, computing device, or server. [Modes for carrying out the invention]

[0013] Simply refer to the attached drawing as an example.

[0014] The following non-restrictive definitions may be helpful in understanding the terms used throughout this specification.

[0015] IP geolocation, also known as network, internet, device localization, or geolocation, is the process of determining the geographical location of an internet-connected device through (active or interactive) measurement. In other words, IP geolocation is the process of determining the location of a device based on obtainable or inferred information, such as an IP (Internet Protocol) address.

[0016] In the field of internet security, IP geolocation has been used as an attack method (profiles victims to lure them into attacks) or as a security element. This idea has gained attention over the past decade, particularly in the areas of fraud prevention and the zero-trust market. IP geolocation technology can be broadly categorized into three types: passive, active, and hybrid.

[0017] ● Passive methods utilize information that can be analyzed based solely on IP addresses, without direct communication with the device. ● Active methods tend to measure the delay to the target using probes. Based on the collected data and a delay distance model, an estimate of the target device's position is generated. ● The hybrid approach combines the two methods described above, using pre-collected data and machine learning models to improve the results of active measurements.

[0018] A probe (also called a landmark, beacon, or anchor) is a node whose location is known and participates in the detection process.

[0019] A VPN (Virtual Private Network) is a mechanism that creates a secure connection between a computing device (client device) and a computer network, or between two networks, using an insecure connection medium such as the public internet.

[0020] VPN servers / services (Virtual Private Network Services) provide a proxy server that is useful when users want to bypass internet censorship such as geoblocking, or protect their communications from data profiling and MitM attacks on hostile networks.

[0021] Round-trip delay (RTD) or round-trip time (RTT) is the sum of the time it takes for a signal to be sent and the time it takes for an acknowledgment of that signal to be received. This delay may include propagation time along the path between the two communication endpoints. For example, RTT can measure the time it takes for a network request to be sent from its origin to its destination and back to the origin. The duration of RTT is measured in milliseconds (ms).

[0022] An end client is the end device (e.g., a client device) that a user uses to communicate with a server. In the case of direct communication between the server and the client device, the server will see the client device's IP address. In the case of indirect communication, the server can only see the IP address of the intermediate device (VPN / proxy server) and not the client device's IP address.

[0023] A server can either communicate directly with an end client or communicate indirectly by hosting a server that a client device accesses. For example, a server might host a web page that a client device requests access to.

[0024] This specification provides a computer-implemented method for determining the origin of instruction information in a networked connection between a client device and a server. The method includes the steps of: receiving instruction information from a client device at a server; determining a client-server value based on the transmission time of a connection signal transmitted between the client device and the server; transmitting a tracing signal addressed to the instruction information via a specific router in the networked connection between the client device and the server; determining a tracing value based on the transmission time of the tracing signal to the specific router; and determining whether the instruction information originated from an intermediate connection in the networked connection or from the client device by comparing a difference value based on the client-server value and the tracing value with a threshold.

[0025] If the difference is greater than the threshold, the instruction information may be determined to have originated from the intermediate connection. If the difference is less than the threshold, the instruction information may be determined to have originated from the client device.

[0026] The threshold may be measured in units of time, that is, the threshold may be a time value. The threshold may be set to 2ms or 5ms. The threshold may be between 2ms and 5ms (including both ends). The threshold may also be measured in distance, and may be set to 400km or 1000km, or between 400km and 1000km.

[0027] Instruction information may be received during the connection process between the client device and the server. It may be received as part of the initial connection request sent from the client device to the server. For example, instruction information may be included in the transmission control protocol header.

[0028] Transmission time can be understood as the time it takes from the transmission of a signal to its reception. In other words, it is the time from the transmission to the reception of the signal.

[0029] The indicating information may be an Internet Protocol (IP) address. For example, the indicating information may be a public IP address. The IP address may be an IPv4 or IPv6 IP address. The indicating information can be called location information or location indicating information, in that it can indicate the location or source of the information. That is, for example, if the indicating information is an IP address, the location of the indicating information can be obtained, for example, using an IP location database.

[0030] The tracing value is, for example, a time duration and can be determined based on the round-trip time of the combination of the tracing signal and the tracing signal response. The tracing signal response may originate from a specific router.

[0031] A particular router may be an intermediate connection. An intermediate connection can respond to tracing signals and send tracing signal responses. A particular router may be an individual router in a networked connection other than an intermediate connection. For example, an intermediate connection does not have to respond to tracing signals. An intermediate connection may be intentionally configured to be hidden within the network and therefore may not respond to tracing signals.

[0032] Tracing signals and tracing signal responses may be included in the traceroute transmission. Tracing signals may be User Datagram Protocol (UDP) packets or Internet Control Message Protocol (ICMP) packets. Tracing signal responses may be UDP responses or ICMP responses.

[0033] A networked connection may include more than one individual router. Individual tracing signals may be sent to more than one individual router in the networked connection, and each individual router receiving an individual tracing signal may send an individual tracing response, and the individual tracing signal with the longest transmission time among the individual tracing signals may be assigned as the tracing signal.

[0034] As mentioned above, the transmission time can be the time from when the signal is sent until it is received. Therefore, the longest transmission time is the longest delay between the transmission and reception of an individual tracing signal. It can be inferred that the individual router with the longest transmission time is the individual router located furthest from the source.

[0035] An individual router that receives an assigned tracing signal may be assigned as a specific router. That is, the specific router may be the router furthest from the source.

[0036] Individual tracing signals may be transmitted by a server; that is, the server may be the source.

[0037] Individual tracing signals may be transmitted by servers and probes to the same or different individual routers within a networked connection. Servers and probes may be the sources. More than one probe may transmit individual tracing signals.

[0038] The server and probe may share instruction information to communicate with the client device. That is, the server may receive instruction information and forward it to the probe. The server and probe may form an anycast network. Therefore, instruction information may be shared through the anycast network.

[0039] For example, tracing signals are transmitted by probes. That is, individual tracing signals assigned as tracing signals are individual tracing signals transmitted by probes.

[0040] The client-probe value (sometimes called the probe-client value) can be determined based on the transmission time of the probe message sent from the probe to the client device. The differential value may be further based on the client-probe value.

[0041] The server may receive a probe message response to a probe message. In other words, only the server can receive a probe message response. To put it another way, the probe does not need to receive a probe message response.

[0042] A probe message may, for example, be a message containing image information. A client device may request information such as an image (or a portion of an image) from a website, and the probe may send the image information as a probe message. The probe message may be an ACK message indicating that the image has been received.

[0043] The difference between the round-trip time of the probe message and the probe message response and the client-server value may be obtained as the transmission time of the probe message. That is, the transmission time of the probe message can be determined by subtracting the client-server value from the round-trip time of the probe message and the probe message response (traveling from the client to the server). The delay in the client device processing the probe message and sending the probe message response is negligible compared to the transmission time of the probe message and the probe message response and can therefore be ignored.

[0044] The round-trip time for probe messages and probe message responses may be determined by recording a first timestamp of the time the probe message was sent, recording a second timestamp of the time the probe message response was received, and determining the time difference between the first and second timestamps as the round-trip time.

[0045] Client-server values, client-probe values, and tracing values ​​may be time-based values. For example, values ​​may be measured in seconds. The difference value can be calculated as the difference between the client-probe value and the tracing value.

[0046] The threshold may be between 2ms and 5ms (including 2ms and 5ms). The threshold may be set according to the location of the instruction information. That is, the geolocation of the instruction information may be obtained, for example, using an IP location database. Then, the threshold may be set according to the geolocation.

[0047] The client-server value may include the client-server round-trip time for the connection signal. The client-server value may be determined as half of the round-trip time.

[0048] The connection signals transmitted between the client device and the server may be at least one of the following: Transmission Control Protocol (TCP) handshake signals, Source Socket Layer (SSL) handshake signals, and Transport Layer Security (TLS) handshake signals. Other appropriate connection signals may also be used. The signals are connection signals in that they are used to set up a connection between the client device and the server in the network.

[0049] If it is determined that the instruction information originated from an intermediate connection, the client device's network privileges may be revoked. If the client is accessing a web page, for example, through a URL (uniform resource locator) hosted by the server, the client device's access to the web page may be blocked if an intermediate connection is detected. Additionally, or alternatively, the server may restrict resources and / or trigger multifactor authentication.

[0050] When the VPN client connection ends, the previous VPN IP address may no longer be used for subsequent communications from the client, so the process of detecting whether the VPN is being used may be triggered again.

[0051] The intermediate connection may be at least one of the following: a virtual private network connection, a Tor connection, a proxy connection, or a tunneling connection. The intermediate connection may be a connection within the network that obfuscates the true identification information of the client device. That is, the intermediate connection may hide the public IP address assigned to the client device from the server.

[0052] In another aspect, a computer-implemented method is provided for determining the origin of instruction information in a networked connection between a client device and a server. This other aspect is described below in relation to Figures 2 and 3. The computer-implemented method includes the steps of: receiving instruction information from a client device at the server; determining a client-server value based on the transmission time of connection signals transmitted between the client device and the server; having the server transmit a packet internet or internet network grower (PING) message addressed to the instruction information in the networked connection; determining a PING trace value based on the transmission time of the PING message and PING response message; and determining whether the instruction information originated from an intermediate connection in the networked connection or from the client device by comparing a PING difference value based on the client-server value and the PING trace value with a threshold.

[0053] The inventors realized that combining the aforementioned methods could provide yet another aspect. The combined method may be provided as a computer-implemented method for determining the origin of instruction information in a networked connection between a client device and a server, comprising the steps of: receiving instruction information from a client device at the server; determining a client-server value based on the transmission time of a connection signal transmitted between the client device and the server; the server sending a packet internet or internet network grower (PING) message addressed to the instruction information in the networked connection; sending a tracing signal to a specific router in the networked connection between the client device and the server if the elapsed time for receiving a PING response message has elapsed; determining a tracing value based on the transmission time of the tracing signal; and determining whether the instruction information originated from an intermediate connection in the networked connection or from the client device by comparing a difference value based on the client-server value and the tracing value with a threshold.

[0054] Essentially, the other aspect described above may first perform a PING addressed to the instruction information. After the PING is sent, a timer is started, and if no PING response is received after the specified time has elapsed, the other aspect may perform the features of the first method described above.

[0055] Another aspect is a computer program that, when executed by a computer / computing device / teleconferencing device, causes the device to perform the actions described above. The computer program may be stored in computer-readable media, which may be non-temporary.

[0056] Another aspect is a computer program that, when executed by a companion device, causes the companion device to perform the actions described above. The computer program may be stored in a computer-readable medium, which may be non-temporary.

[0057] The invention may be implemented in digital electronic circuits, or in computer hardware, firmware, software, or a combination thereof. The invention may be implemented as a computer program or computer program product, i.e., a computer program tangibly embodied in a non-temporary information carrier (e.g., in a machine-readable memory device or in a propagated signal), for execution by one or more hardware modules, or for controlling the operation of one or more hardware modules. The computer program may take the form of a standalone program, a computer program portion, or more than one computer program, may be written in any form of programming language, including compiled or interpreted languages, and may be deployed in any form, as a standalone program or as modules, components, subroutines, or other units suitable for use in a data processing environment.

[0058] The invention is described in relation to a specific example / aspect. Other examples / aspects are within the scope of the subsequent claims. For example, the steps of the invention may be carried out in a different order, but the desired result can still be achieved.

[0059] Those skilled in the art will understand that, except where mutually exclusive, any feature described with respect to one of the aforementioned aspects can be applied to any other aspect with necessary modifications. Furthermore, except where mutually exclusive, any feature described herein may be applied to any aspect and / or combined with any other feature described herein.

[0060] Figure 1a shows an example configuration 100 of a virtual private network 110 within a network. The VPN connects a client device 120 to a (web / end) server 130. The client device is, for example, a computer / network / any device that can access the internet. The server may be any device or computer program that provides information to the client device. The information may be, for example, a "service" or "resource". In other words, the client device and the server can function as a client-server model. The VPN can create a secure connection between the client device and the web server (which may be an insecure medium such as the internet).

[0061] A VPN can obfuscate / conceal the original (true) location 125 of the client device. A device can determine its geographical location using the (public) IP address associated with the device. Therefore, a VPN can "conceal" the location of the client device by replacing the client device IP address with a VPN IP address. In other words, a VPN can obfuscate the true location of the client device (user) by masking the IP address. A web server communicating with the client device will receive a "VPN" IP address (i.e., the IP address assigned to the client device by the VPN) rather than the client device IP address. However, the IP address received by the web server will be recognized as having been sent from the client device. Therefore, if the web server attempts to determine the geographical location of the client device 120 using the IP address, the web server will instead determine the VPN location (VPN geolocation 115). The server is called a web server in this example, but of course, any suitable server can be used.

[0062] Because IP geolocation identifies the geographical location of a device with a public IP address (which may be an intermediate device), the perceived location of the end client may be distorted because the end client may be located in a different country or continent than the intermediate device (e.g., a VPN) through which the signal is relayed.

[0063] Geolocation mismatch detection is the process of detecting whether there is a mismatch between the geolocation of the device a server is communicating with and the geolocation of the device to which the public IP address from which the server is sending packets belongs. These may not be the same device and may be located in different places. Therefore, the inventors identified two technical challenges to the above problem, including 1) verifying whether these devices are the same (since the end server only knows the VPN / proxy's IP address, and the end client's IP address remains hidden) and 2) determining the distance between the end client and the intermediate VPN / proxy (this is difficult because the server cannot send messages directly to the client). While the purposes of VPNs / proxies are diverse, the inventors focused on using them to distort the true location of the client.

[0064] Figure 1a also shows an unsecured client device 140. In this example, if the web server uses the IP address of the unsecured client device to determine its geographical location, the web server can locate the unsecured client device. Therefore, this device is called an unsecured device in the sense that its true location can potentially be determined by its IP address.

[0065] Conventional techniques use behavioral analysis and IP ranking approaches to detect the use of VPNs as intermediate connections between client devices and servers in a network. Multiple solutions exist for server-side proxy / VPN detection, each with its own advantages and disadvantages. Here, we will only consider detection methods that can be implemented from the server side. In these examples, the service being accessed performs the detection and only accesses communications from clients that have passed through the VPN / proxy.

[0066] Known solutions can be divided into two main categories. The first category is generally passive methods based on known IP databases (DBs). DBs may include behavioral analysis data and reputation scores based on reports and passive data collection. Passive data may include raw packet captures at critical moments, offline port scans, and source analysis. Known methods include Maxman, SEON, and IPQualityScore. Another example of a passive method is (https: / / fingerprint.com / blog / vpn-detection-how-it-works / ): 1. Database Validation - Users who want to identify whether a particular IP address is a VPN address will compare that IP address against the database of VPN IP addresses. 2. Time-zone mismatch - Compare the time zone of the public IP address with the local time zone of the web browser communicating with the server. This is done using the IP address database and the web browser API, respectively. 3. OS Mismatch - By identifying a mismatch between the browser's operating system and the operating system estimated from the packets received by the server, VPN usage can be inferred.

[0067] The inventors discovered that these methods require a massive amount of data and time to analyze communications and establish a baseline for analysis. Passive VPN detection methods can detect VPN usage with an accuracy of up to 95 to 99%. However, passive detection methods require prior knowledge for detection and may fail with private VPNs or new VPNs until they are updated (see below).

[0068] The second method is an active detection method, of which there are numerous approaches.

[0069] Active Port and Service Scanning: Common VPN solutions / services may have default ports and protocols, and scanning these ports and protocols can determine whether the VPN service is running on the server. Once a connection is initiated on the server, scanning the source IP address can ideally determine whether the client is using the VPN. However, the inventors found this method to be unreliable because the ports and protocols used may be switched to non-default settings, potentially causing false negatives.

[0070] Deep Packet Inspection: The use of a VPN completely encapsulates the original packet. This can change the available size of the data within the packet, potentially leading to several detectable changes in the Transmission Control Protocol (TCP) header. Specifically, the Maximum Transmission Unit (MTU) / Maximum Segment Size (MSS) field in the header may deviate from the standard. This limitation also causes the data size and other characteristics of the received packet to change over time. Deep packet inspection can be implemented on the server using any sniffing tool (i.e., a tool that captures data transmitted between the client device and the server). However, the inventors found several problems with this approach. Anomalies in the TCP field can be resolved (and have been resolved) with simple configuration / implementation changes. On the other hand, anomalies in the packet content are inconsistent and require a considerable number of packets and complex machine learning models to identify them with sufficient accuracy.

[0071] Delay and RTT measurement: Delay anomaly measurement has been implemented to detect proxies (proxy servers) using TCP handshake RTT measurement compared to either TLS handshake or application layer communication. A more advanced method involves executing JavaScript® code that generates a new connection to the server (or multiple servers). While this method has proven effective for proxy detection, it has consistently failed to detect VPNs. This is because, in VPN services without extensions (as mentioned above), the entire communication is encapsulated, resulting in little difference in RTT measurement between different protocols and applications.

[0072] A known approach to proxy detection developed by Elisa Chiapponi et al. (Chiapponi, E., Dacier, M., Thonnard, O., Fangar, M., Rigal, V. (2022). BADPASS: Bots Taking Advantage of Proxy as a Service. In: Su, C., Gritzalis, D., Piuri V. (eds) Information Security Practice and Experience. ISPEC 2022. Lecture Notes in Computer Science, vol 13620. Springer, Cham.) uses the difference in round-trip time (RTT) between TCP and TLS handshakes to determine if a proxy is being used. While this method can detect proxy usage with up to 99% accuracy, it cannot detect VPNs or proxies that do not "disconnect" the TCP connection, which does not necessarily occur in VPN connections (e.g., core OpenVPN protocol (see Figure 1b)). Furthermore, it has limitations when the TLS protocol is not being used.

[0073] Furthermore, the inventors discovered that, using the existing methods described above, new or privately used VPNs may not be detected initially, and detection may take a relatively long time (they may not be detected at all). Moreover, VPN services can adapt to these analysis methods and evade detection with minimal effort by regularly changing their behavior / location / IP. For example, malicious cybersecurity attacks almost always conceal their origin. One of the best and most effective ways to do this is to use a VPN, ideally a private VPN server not originating from a well-known VPN service. In this case, behavioral analysis and IP ranking are practically useless in detecting the use of this type of VPN, as there is little information to analyze during initial use.

[0074] Further limitations of known IP geolocation technologies are as follows: Passive geolocation technologies require a vast amount of ground truth data to achieve sufficient accuracy. Active technologies require significantly less data but are far more susceptible to network failures and can cause serious errors. The inventors identified a fundamental premise of IP geolocation: the IP address presented by the target device is the IP address assigned to the user's device. If the client's IP address is obfuscated using a VPN or proxy, geolocation security becomes ineffective. This tends to apply to all IP geolocation technologies, as both passive and active methods rely on this underlying premise. To compensate for this, some IP geolocation solutions incorporate a certain level of VPN / proxy detection functionality on the server side as a countermeasure.

[0075] To use geolocation as a security element, the solution may be integrated into the authentication process. In practice, the user experience should not be (significantly) affected by loading times or false positive errors. Most importantly, security standards must be met. This requires very high accuracy and very fast detection speeds. These standards may immediately disqualify passive approaches. While passive approaches are very fast, they require the use of databases and behavioral analytics, necessitating prior knowledge and massive data collection. When encountering new, non-mainstream VPN servers, passive approaches are essentially always prone to false negatives, which is unacceptable from a security standpoint. Port scanning, as mentioned earlier, is unreliable and tends to be easily bypassed. A combination of deep packet inspection and machine learning approaches is promising, but so far, it requires a large amount of traffic flow data to be effective, and this data tends not to be available in login processes.

[0076] One example of a technical application of VPN detection methods is the zero-trust security model. The zero-trust security model relies on IP geolocation as an additional security element. Specifically, multi-factor authentication (MFA) providers utilize IP geolocation to grant or deny access to users based on their location, or to implement additional security restrictions if a user attempts to log in from an unusual location. According to Microsoft Azure's Conditional Access policy (https: / / learn.microsoft.com / en-us / entra / identity / conditionalaccess / location-condition, accessed February 10, 2024), organizations can block users from countries or regions where the organization does not operate from accessing its services. Furthermore, the increasing national and multinational legislation concerning data and user protection (e.g., GDPR) requires certain data to remain within specific boundaries.

[0077] The inventors identified the following challenges in developing a reliable and secure VPN detection solution: ●VPNs are intentionally concealed: VPNs are intentionally used to hide the client's location, and therefore operate in a way that makes them undetectable at all times. This is due to server / procedure changes, security improvements, etc. ●Accuracy: Failure to detect a problem can have serious consequences for the service's security and user experience. ●Speed: Detection must be as fast as possible, as it should not negatively impact the user experience. ●Resilience: How long can detection persist even when exposed to an attacker threat?

[0078] The inventors found that none of the aforementioned solutions, in determining the geographical location of an end device based on the IP address visible to the server, attempt to verify whether the location information identified as a result of active IP geolocation is a reliable representation of the end client communicating with the server. The primary method used to estimate this is VPN / proxy detection, i.e., detection of whether a VPN proxy is being used. However, these methods do not answer the question of whether active IP geolocation is reliable because they do not detect whether the VPN is far from the end client. Many VPN detection methods rely on information that can be forged or concealed (such as OS and locale data), and therefore their impact can be mitigated through proper cooperation between the end client and the VPN service provider.

[0079] Figure 1b shows the client-server handshake procedure 150, the client-proxy handshake procedure 160, and the client-VPN handshake procedure 170.

[0080] As mentioned above, a VPN enables connections over public networks. This can be achieved by encapsulating and encrypting the packet data sent from the client. The packet data is then unpacked at the VPN server and sent out as if it originated from the VPN server. When the response is returned to the server, it is encapsulated, encrypted, and sent back to the client. This method hides the client's original IP address from the server the client is accessing, or allows access to an internal network while encrypting highly sensitive data over a public network.

[0081] An HTTPS proxy creates a secure connection over the transport layer. When a client connects to the proxy, all HTTPS requests are routed through the proxy server, which obfuscates the client's IP address. Client requests are sent to the proxy via TCP, meaning the TCP connection is "broken" each time a new connection is made. Thus, both the client and the server generate a TCP handshake (client-proxy handshake 160).

[0082] Both VPNs and proxy servers can conceal the client's IP address. However, detecting VPN traffic presents unique challenges not addressed by proxy detection techniques. A VPN can be considered a proxy operating at the network layer rather than the transport layer. This means that, unlike HTTPS proxies, the TCP connection is not necessarily interrupted. The differences between direct handshakes, proxy handshakes, and VPN handshakes are shown in Figure 1b. The core implementation of a VPN server (e.g., the OpenVPN protocol RFC https: / / openvpn.net / communityresources / openvpn-protocol / (accessed March 12, 2024)) encapsulates and tunnels all packets generated by the client, without interrupting the handshake sent to the server (client-VPN handshake 170). The tunnel created is the reason why traditional solutions failed to detect VPN usage. Some VPN services effectively function as proxies because the TCP handshake is interrupted, but the TLS handshake is tunneled. This can be observed when using services such as NordVPN (https: / / nordvpn.com / (accessed February 10, 2024)) and ExpressVPN (https: / / www.privateinternetaccess.com / (accessed February 10, 2024)). Since the RTT measured over a TCP connection is the same as the RTT measured over a direct connection to the VPN server, this method is effective for obfuscation.

[0083] The VPN servers mentioned above also tend to respond to PINGs. This means that the communication RTT appears to match the direct RTT measurement, making the server appear harmless with a simple detection approach. VPN services with SSL decryption capabilities (typically enterprise VPNs like Palo-Altos GlobalProtect) instead disconnect the TLS handshake. Therefore, the TLS RTT will be shorter than the TCP RTT.

[0084] Figure 2 illustrates the steps of Method 200 for determining the source of instruction information in a networked connection between a client device and a server. In other words, the Method can detect whether an intermediate connection is being used in a networked connection between a client device and a server. The inventors have found that a transmission delay exists between the end client and the device the server is directly communicating with (i.e., the intermediate VPN / proxy server) when the end client is located in a different location from the device the server is directly communicating with. If this delay exceeds a threshold, it is likely that the client and the intermediate connection are located in different geographical locations.

[0085] Unlike the conventional behavioral analysis approaches mentioned above, the method developed by the inventors utilizes objective metrics of proxy communication that can be detected immediately and consistently from the first use of the VPN server.

[0086] The use of a VPN introduces additional delays to communication based on the physical distance between the client and the VPN server. The methods disclosed herein may detect additional delays in responsive and unresponsive VPN server communications. In other words, the VPN (intermediate connection) detection method may use direct delay measurements of client communications from the server side.

[0087] Furthermore, because the indicators identified by the inventors are not behavior-based, their application may be virtually impossible. Considering the example of private VPN servers used to conceal cyberattacks, the methods described herein could potentially detect VPN usage instantly, which would be undetectable or time-consuming by conventional solutions.

[0088] A method for determining the source of instruction information in a networked connection between a client device and a server may include the following steps, as shown in Figure 2.

[0089] In receiving step S10, the server may receive instruction information from the client device. This instruction information may be, for example, an IP (Internet Protocol) address, such as a public IP address. The IP address may be, for example, IPv4 or IPv6. In cases where an intermediate connection is active or in use between the client device and the server, the instruction information may be information belonging to the intermediate connection. For example, the instruction information may be the IP address of the intermediate connection. The intermediate connection may be a VPN. Therefore, the intermediate connection may be the IP address of the VPN.

[0090] Instructional information, such as an IP address, may be sent to the server as part of the TCP (Transmission Control Protocol) packet header. For example, a client may initiate a request by entering a URL into a web browser, and the web browser may send an HTTP GET request to the server hosting the URL. The request may be sent over the internet using the Transmission Control Protocol (TCP), and the packet header may contain the client's IP address. The server receives the request and may extract the IP address from the request details.

[0091] In cases where the client device does not use an intermediate connection, the instruction information may be information belonging to the client device (client device instruction information). For example, the instruction information is the client device's IP address (client device IP address). The instruction information may also be called recognized instruction information, in that the server does not need to know whether the instruction information originated from the client device or from an intermediate connection. In either case, the server can recognize the instruction information as having originated from the client.

[0092] At any acquisition (or determination) step, the geolocation associated with the reference information may be acquired. The geolocation may be acquired using a geolocation service. For example, the reference information may be mapped to a physical location. A geolocation database or application programming interface (API) may map the reference information to a location such as country, region, year, latitude, and longitude. The geolocation database or API may be queried to acquire the geolocation associated with the reference information. For example, the reference information may be an IP address, and the geolocation associated with the IP address may be determined using IP-based geolocation technology.

[0093] In decision step S20, a client-server value may be determined based on the transmission time of the connection signal transmitted between the server and the client device. The client-server value may be, for example, the round-trip time of the connection signal transmitted between the client device and the server. For example, the client may send an initial connection signal to the server. The initial connection signal may contain instruction information. The server may send an acknowledgment (server ACK) to the client device and start a timer. The timer may be stopped when the server receives an acknowledgment (client ACK) return signal from the client device.

[0094] The connection signal may be any suitable signal with properties for determining the client-server value. For example, the connection signal may be a TCP handshake signal between a client device and a server. For example, a client device may initialize a TCP connection with a server by sending a TCP:SYN (TPC Sync) signal. In response, the server may send a TCP SYN+ACK to acknowledge the signal sent by the client device. The client device may send a further acknowledgment (TCP ACK) of the signal sent by the server.

[0095] The client-server value (which may be a value determined between the client and the server or between the server and the client) may be, for example, the TCP RTT measured by the TCP handshake. The TCP RTT may be measured as the interval between when the server sends a TCP SYN+ACK and when the client receives a TCP ACK packet.

[0096] Following the TCP handshake, additional (or other) connection signals may be sent. These additional connection signals may be TLS handshake signals. The client-server value may be determined from the average of the TCP RTT and TLS RTT, or from whichever of the TCP RTT and TLS RTT is longer or shorter. For example, the longer RTT may be used because signals belonging to the longer RTT may be inferred to reach the client device, while shorter RTTs may be disconnected in the VPN. The TLS handshake may be used to determine the TLS RTT as follows. In another example, the additional connection signal may be an SSL handshake signal, and the client-server value may be calculated as described above using the RTT measurement of the SSL signal.

[0097] A sniffing tool may be used to measure the TCP handshake and the TLP( / SSL) handshake. The client-server value may be determined using a discovery server (i.e., a server different from the server hosting the client device). The discovery server may run a sniffing tool. The discovery server may receive signals transmitted between the client device and the server. Additionally or alternatively, a server performing the method may determine the client-server value itself, i.e., without using a discovery server. Furthermore, the server may determine the client-server value and forward it to the discovery server. The discovery server may also receive initial tracing values ​​from the server and / or probe (described later). Thus, by comparing differential values, the discovery server may determine whether the instruction information originated from a client device originating from an intermediate connection in a networked connection.

[0098] During the TLS handshake, the client device may send a client "HELLO" packet to the server. The server may respond with a server "HELLO" packet. The TLS RTT may be determined as the interval between the SERVER HELLO packet sent from the server and the next TLS packet received from the client. Depending on the TLS version used in the communication, the next TLS packet may contain, for example, a CHANGE CIPHERSPEC or a TLS APPDATA FLAG. The TCP and TLS communications described above are visualized in Figure 1b.

[0099] The inventors identified that both sources (TCP RTT and TLS RTT) can be used to measure client RTT. This is because, as explained, different implementations may cause some communication to be disconnected and not tunneled by the VPN / proxy server, potentially leading to false negatives when used to detect VPN usage.

[0100] The inventors discovered that tunnel RTT can be significantly longer than disconnected communications originating from the VPN server rather than the client. While VPNs that disconnect TCP connections can be detected as proxies using conventional solutions, the inventors found that conventional solutions do not provide a consistent solution for detecting all VPN and proxy usage.

[0101] Four TCP and TLS RTTs can be measured from each client, and the median and minimum RTTs for each can be obtained. The inventors used four RTT measurements, but any number can be used as long as it is appropriate. Measuring four RTTs allows for support of different VPN connection types and reduces errors and noise. The RTT of the protocol with the longer median RTT may be used as the client-server value. Naturally, the RTT of the protocol with the shorter median RTT may also be used, or a combination of RTTs from both protocols may be used.

[0102] Additionally, or alternatively, the connection signals transmitted between the server and client device may be secure socket link (SSL) packets (or TLS packets, depending on the version used by the web browser). That is, the client device and server may perform a standard TCP connection without measuring RTT. RTT measurement may begin with the TLS handshake. Depending on the VPN protocol / service, for example, TCP and / or TLS and / or SSL measurement may be used.

[0103] Multiple connection signals may be transmitted between the server and the client device. Multiple signals may be transmitted to ensure that the RTT is measured as many times as possible to determine, for example, a statistically significant result. The length of the handshake between the server and the client device may be extended to transmit multiple signals. The inventors have found that the length of the handshake can be extended by separating each step of the handshake into different packets. This differs from the usual handshake technique, which attempts to combine as many steps as possible. Each packet may be transmitted as a separate connection signal.

[0104] Additionally, or alternatively, the client-server value may be associated with (or based on) further TLS communication, such as the round-trip time of the Cipher signal between the server and the client device. For example, during Cipher negotiation between the server and the client device, the server may be configured to reject the Cipher proposed by the client. The Cipher round-trip time may be determined from further Cipher packets sent by the client device. That is, by rejecting the Cipher proposed by the client device, the client device may send further Ciphers, such as the "ChangeChiperSpec" command / packet. The round-trip time may be determined from the Cipher signal. The client-server value may be determined, for example, by calculating the average round-trip time from the RTT associated with the SSL packet and the RTT associated with the Cipher signal.

[0105] Additionally or alternatively, the client-server value may be determined from the average of any combination of RTTs. For example, the average of TCP and SSL, TCP and TLS, TCP and Cipher, TLS and Cipher, SSL and Cipher, TCP, TLS and Cipher, etc. Alternatively, the client-server value may be determined as the longer or shorter of the RTT signals. Thus, it will be understood that the client-server value determined based on the transmission time of the connection signal transmitted between the client device and the server refers to a client-server value that includes a value related to the connection signal (i.e., RTT), or that the connection signal may not be used, for example, because additional or further connection signals may be used. That is, the connection signal may still be used in the determination step, in the sense that it is compared with further / additional connection signals to determine which has a longer / shorter RTT.

[0106] TCP and TLS measurements were used to measure RTT, but of course, other suitable signals may be used. For example, upper-layer measurements and / or generated recursive requests may be used to measure RTT.

[0107] The client-server value may be determined on the server side or the client side, for example, depending on service limitations. On the server side, RTT may be determined using raw packet analysis of the TCP handshake and subsequent TCP / TLS communication. On the client side, JavaScript may be used to communicate with the server and calculate the RTT. Using JavaScript allows for more controlled analysis of communication, resulting in more accurate results.

[0108] In transmission step S30, the server sends a Packet Internet or Inter-Network Groper (PING) message addressed to the recognized instruction information over the networked connection. That is, the server may send a PING message addressed to an IP address, i.e., the recognized IP address of the client device.

[0109] A PING may be sent by sending an Internet Control Message Protocol (ICMP) echo request to a specified address (i.e., known instruction information). When the target of a PING (either a client device or an intermediate connection, as described below) receives the message, it may send a PING response message. For example, if a PING is sent as an echo request, the PING response may be an echo reply.

[0110] In examples where no intermediate connection is used, recognized instruction information may be sent from the client device. Thus, a PING message addressed to the instruction information may be received by the client device, and the client device may respond to the PING by sending a PING response.

[0111] In examples where an intermediate connection is used, the recognized instruction information may originate from the intermediate connection. Thus, a PING message addressed to the instruction information may be received by the intermediate connection, and the intermediate connection may respond to the PING by sending a PING response.

[0112] In decision step S40, a PING trace value may be determined based on the transmission time of the PING message and the PING response message. The PING trace value is sometimes called a tracing value because it refers to the result of transmitting a tracing signal within the network to determine whether an intermediate connection exists.

[0113] The transmission time may be, for example, the round-trip time from the transmission of a PING to the reception of a PING response. For example, the server may transmit a PING in the network and start a timer. The timer may be stopped when the server receives a PING response message. Alternatively, the transmission time may be half of the round-trip time. The processing time of the received PING at the receiver / device can be estimated to be negligible compared to the time it takes for the PING to travel within the network. Therefore, half of the transmission time becomes an estimated value of the time it takes for the PING to be transmitted from the server to the receiver (client device or intermediate connection).

[0114] In the determination step S50, for example, by the server, by comparing the PING difference value based on the client-server value and the probe value with a threshold value, it may be determined whether the indication information was issued from an intermediate connection within the networked connection or from a client device.

[0115] As an example, the client-server value may be the transmission time of a connection signal sent from the server to the client device, and can be denoted as T SC The PING tracing value may be the transmission time of a PING sent from the server to a receiver (either the client device or an intermediate connection if used) within the network, and can be denoted as T Sy (where y is either the client device (i.e., T SC ), or an intermediate connection (i.e., T SV ).). The PING difference value may be the difference between the client-server value and the PING tracing value.

[0116] Therefore, assuming x is the threshold value, if T SC - T SV >x, that is, assuming (x + T SV ) is the threshold value, then T SC >x + T SVIn this case, an intermediate connection may be determined. The value x may be set to, for example, 2ms or 5ms, or between 2ms and 5ms. The distance corresponding to a 5ms delay is,

number

[0117] Although the steps described above are presented in a numbered order, it will naturally be understood that the steps can be performed in any appropriate order. For example, the client-server values ​​may be determined before and / or during the reception of instruction information.

[0118] In another example, a computer program may be provided that, when executed on a computer, causes the computer to perform a method for determining the source of instruction information in a networked connection between a client device and a server, the method comprising: receiving (or causing a server to receive) instruction information from a client device; determining a client-server value based on the transmission time of a connection signal transmitted between the client device and the server; transmitting (or causing a server to transmit) a tracing signal addressed to the instruction information via a specific router in the networked connection between the client device and the server; determining a tracing value based on the transmission time of the tracing signal to the specific router; and determining whether the instruction information originated from an intermediate connection in the networked connection or from the client device by comparing a difference value based on the client-server value and the tracing value with a threshold.

[0119] In another example, an information processing device may be provided which has memory and a processor connected to the memory, and which determines the source of instruction information in a networked connection between a client device and a server. The processor may be configured to receive (or cause to receive) instruction information from a client device at the server, determine a client-server value based on the transmission time of the connection signal transmitted between the client device and the server, send (or cause to send) a tracing signal addressed to the instruction information via a specific router in the networked connection between the client device and the server, determine a tracing value based on the transmission time of the tracing signal to the specific router, and determine whether the instruction information originated from an intermediate connection in the networked connection or from the client device by comparing a difference value based on the client-server value and the tracing value with a threshold.

[0120] Figure 3 shows an embodiment 300 of a method for determining the source of instruction information in a networked connection between a client device and a server. As described above, the inventors have found that there may be a delay difference in connection signals and PING tracing signals when the end client is located in a different location from the device with which the server is directly communicating (e.g., an intermediate connection, if used). That is, this delay can be estimated to be the difference between the delay between the end client and the server and the delay between the end server and the device with which the server is directly communicating.

[0121] In practice, the inventors utilized typical TCP-like behavior to determine delay, where the receiver of a packet in a communication session with the sender must respond with an ACK packet notifying the sender that the packet has actually been received. This mechanism allows the sender to retransmit the packet if they do not receive an ACK packet. Essentially, the ACK packet is sent from the end client even if the end client is not a device that the end server is communicating with directly (i.e., the end client is communicating via a VPN / proxy). Therefore, by determining the round-trip time (RTT) from when the packet is sent from the end server until the ACK for that packet is received, and dividing this value by 2, a measure of delay between the end client and the end server can be obtained. In other words, the aforementioned client-server value can be determined.

[0122] If an intermediate connection (VPN / proxy) is used to determine the latency between the end server and the intermediate connection, the end server may send a PING to the public IP address with which it is communicating, based on the known instruction information. A PING reply will be received from the VPN / proxy, if one exists, and by dividing the RTT of this PING by two, a measure of latency between the end server and the VPN / proxy can be obtained. If no VPN / proxy exists, the measure obtained by TCP ACK should be approximately the same as the measure obtained by PING. If a VPN exists and is used to manipulate the client's known location, the difference between these two measurements can be observed, and it is directly proportional to the distance between the end client and the VPN / proxy. Several examples are detailed in Figure 3.

[0123] As shown in Figure 3, client 320 can form a networked connection with server 330. The networked connection may consist of an intermediate connection, which in this example is a VPN / proxy 310.

[0124] The client, or client device, may be operated by an end user. The client may initiate TCP communication (handshake) with the server. TCP communication is an example of connection signals sent between a server and a client. In this example, the handshake is routed through a VPN. The VPN can act as a relay; that is, it does not interfere with the TCP handshake but instead forwards the TCP connection to the server. The service requested by the client device may be, for example, an HTTP request.

[0125] The server responds to TCP communication with an ACK. Along with sending the ACK, the server records the time the ACK was sent. The server also initiates and sends a PING to the public IP address received when the client requested the TCP handshake.

[0126] In this example, since a VPN is used, the public IP address belongs to the VPN rather than the client device, so the VPN receives a PING from the server and sends / outgos a PING reply to the server.

[0127] An ACK (TCP ACK) is received by the client device, and the client device responds by sending an ACK reply to the server.

[0128] The server receives a PING response from the VPN and an ACK from the client device. Naturally, at this stage, the server does not need to know whether the client is using a VPN. The server receives the connection signal (TCP handshake) with a time delay T. SC and PING time delay T SV The following is calculated. Each time delay is an example of the client-server value and PING tracing value described above in relation to Figure 2.

[0129] The server compares each time delay, T SC -T SV >If x, the server will determine / presume that a VPN is being used.

[0130] Therefore, determining the source of the instruction information or detecting an intermediate connection can be achieved by utilizing protocol behavior such as TCP to measure the communication delay between the client's public IP address and the actual client device. If the delay exceeds a threshold, it can be inferred that an intermediate connection exists and is located beyond a threshold distance from the client device.

[0131] Figure 4 shows steps of a further method 400 for determining the source of instruction information in a networked connection between a client device and a server. The inventors have found that in some cases, intermediate connections do not respond to PING. For example, VPNs may be intentionally configured not to respond to PING so as to remain hidden on the network. Therefore, the inventors have developed another method for determining the source of instruction information in a networked connection between a client device and a server. That is, the method can detect intermediate connections in a networked connection between a client device and a server. The method may include the following steps. Some steps may be the same as the steps described above in relation to Figure 2 and are therefore not repeated in detail below.

[0132] In the receiving step S410, the server may receive instruction information from the client device. An example of the receiving step is explained in relation to Figure 2 and is not repeated here. The instruction information may also be referred to as location information. That is, the information may "instruct" where the information originated (for example, the client device or an intermediate device).

[0133] As described above, the geolocation associated with the recognized instruction information may be acquired in any acquisition (or determination) step.

[0134] In the determination step S420, the client-server value may be determined based on the transmission time of the connection signal transmitted between the server and the client device. An example of this determination step is illustrated in relation to Figure 2 and is not repeated here.

[0135] In the transmission step S430, a tracing signal addressed to instruction information may be transmitted via a specific router in the networked connection. The networked connection may have one or more individual routers involved in data transmission between the client device and the server. In the transmission step, the server (or a probe, as described later in relation to Figures 6a-10) may send an individual tracing signal to one or more of the individual routers in the networked connection (e.g., each individual router). The tracing signal may be addressed to instruction information (e.g., an IP address) and may be intercepted by each router in the network.

[0136] Individual tracing signals may be sent to each router as part of the traceroute. Individual tracing signals may be, for example, ICMP packets / messages or User Datagram Protocol (UDP) packets / messages. Individual tracing signals may use the TLL field of the IP packet header used for transmission.

[0137] Therefore, the traceroute may traverse / intercept each individual router in the network path before arriving at the destination of the recognized instruction information (either the client device or, if any, the intermediate connection). In this example, the intermediate connection (e.g., a VPN or proxy) can also be considered one of the routers in the network.

[0138] In decision step S440, a tracing value may be determined based on the transmission time of the tracing signal. Each individual router in the network path receiving individual tracing signals (i.e., in the networked connection path between the client device and the server) may send an individual tracing response. The individual tracing signal with the longest transmission time among the individual tracing signals may be assigned as the tracing signal. The individual router receiving the tracing signal, i.e., the individual tracing signal with the longest transmission time, may be assigned as a specific router. For example, an intermediate connection may also be assigned as a specific router, or can be considered as such. That is, an intermediate connection may respond to a tracing signal sent by, for example, a traceroute. When an intermediate connection responds to a tracing signal, the intermediate connection may receive the individual tracing signal with the longest transmission time, and therefore may be assigned as a specific router.

[0139] In this example, the tracing signal is the individual tracing signal with the longest transmission time among the individual tracing signals. The transmission time can be understood as the time from when the signal is sent, for example, from the server, to when the signal is received, for example, by the router. That is, it is the time between the transmission and reception of the signal.

[0140] The transmission time of each individual tracing signal and response may be measured as the round-trip time of transmitting the individual tracing signal and receiving the individual tracing probe response. Therefore, the determined tracing value may be the tracing value corresponding to the longest transmission time (e.g., the longest round-trip time selected from the individual tracing signals). Thus, a particular router may be the router furthest from the source of the tracing signal, and the source of the signal may be, for example, a server or a probe.

[0141] In the determination step S440, for example, the server may determine whether the instruction information originated from an intermediate connection in the networked connection or from the client device by comparing a difference value based on the client-server value and the tracing value with a threshold. A similar example of this determination step is described in relation to Figure 2 and is not repeated here. In this example, the tracing value may be replaced with the PING tracing value described in relation to Figure 2.

[0142] Therefore, the method developed by the inventors, sometimes referred to as D3etecta (Displacement Discrepancy Detection via Active means), is based on the assumption that if the end client is located in a different location from the device with which the server is directly communicating (i.e., an intermediate VPN / proxy server), a transmission delay is expected between the end client and the device with which the server is directly communicating (i.e., an intermediate VPN / proxy server). If this delay exceeds a threshold, it can be inferred that the two are likely to be geographically different locations. The method described herein can solve this problem by measuring this delay using robust in-band means that overcome various obstacles, such as when the public IP address visible to the server does not respond to PING.

[0143] Although the steps described above are presented in a numbered order, it will naturally be understood that the steps can be performed in any appropriate order. For example, the client-server values ​​may be determined before and / or during the reception of instruction information.

[0144] In another example, a computer program may be provided that, when run on a computer, causes the computer to perform a method for determining the origin of instruction information in a networked connection between a client device and a server, the method comprising: receiving (or causing a server to receive) instruction information from a client device; determining a client-server value based on the transmission time of a connection signal transmitted between the client device and the server; having the server send (or causing a server to send) a packet internet or internet network grower (PING) message addressed to the instruction information in the networked connection; sending (or causing a server to send) a tracing signal to a specific router in the networked connection between the client device and the server if the elapsed time for receiving a PING response message has elapsed; determining a tracing value based on the transmission time of the tracing signal; and determining whether the instruction information originated from an intermediate connection in the networked connection or from the client device by comparing a difference value based on the client-server value and the tracing value with a threshold.

[0145] In another example, an information processing device may be provided that has memory and a processor connected to memory, and determines the origin of instruction information in a networked connection between a client device and a server. The processor may be configured to receive (or cause to receive) instruction information from the client device at the server, determine a client-server value based on the transmission time of the connection signal transmitted between the client device and the server, have the server send (or cause to cause to send) a packet internet or internet network growler (PING) message addressed to the instruction information in the networked connection, send (or cause to cause to send) a tracing signal to a specific router in the networked connection between the client device and the server if the elapsed time for receiving a PING response message has elapsed, determine a tracing value based on the transmission time of the tracing signal, and determine whether the instruction information originated from an intermediate connection in the networked connection or from the client device by comparing a difference value based on the client-server value and the tracing value with a threshold.

[0146] Figure 5 shows an embodiment 500 of a further method for determining the source of instruction information in a networked connection between a client device and a server. As described above, the inventors have found that in some situations the intermediate connection may not respond to PING (however, of course, if the intermediate connection does not respond to PING, another method may be used). In this embodiment, a traceroute from server 530 to the public IP address being communicated with may be performed to obtain a measure of the delay between the server and the furthest router 540 (e.g., the router furthest from the server that responds to the traceroute from the server, i.e., the particular router mentioned above). This delay may be used to estimate the delay between the VPN / proxy 510 itself and the furthest router (see Figure 5).

[0147] As described above, connection signals may be transmitted between the server and the client device 520, for example, when the client device requests a service (e.g., an HTTP request). Server-client value (in this case, the time delay between the client and the server, shown in the figure as T) SC It is stated as follows: ) may be determined from the round-trip time of the connection signal. Instructional information associated with or recognized as associated with the client device may be sent to the server during the connection process. The instructional information may be a public IP address, as before.

[0148] The server may further transmit the tracing signal to the furthest responding router, for example, via a traceroute. The tracing value may be determined based on the transmission time of the tracing signal. For example, the time it takes for the tracing signal to be intercepted by the furthest responding router and for the furthest responding router to transmit a tracing signal response may be measured. The tracing value associated with the transmission time is the server-router delay T. sfR This may be the case. The server-router delay may be determined as half the round-trip time of the tracing signal and the tracing signal response.

[0149] The steps for performing a traceroute may be as follows: 1. The server invokes the traceroute (or Tracert) command and specifies the target host. The target host may be specified using instructional information (e.g., an IP address). 2. The traceroute sets the TTL value to "1" and sends a data packet directed to / addressed to the instruction information. The first router in the route decrements the value by 1. This triggers a TTL overrun message, which is sent back to the server. 3. Upon obtaining details of the first "hop," i.e., the first router in the networked connection, the traceroute increments the TTL value to "2". That first router in the path still decrements the value by 1, but because the TTL value drops to "1" instead of 0, the packet can travel one more hop across the network. When the TTL value becomes 0 (in this case, at the second router in the path), another TTL overrun message should be generated and returned to the traceroute. It is then returned to the router. 4. This process is repeated until the destination of the instruction information is reached (or until no further responses are received) or the upper limit of the hop count is reached, with the traceroute incrementing the TTL by 1 each time. The upper limit may be set by the server. 5. When finished, the traceroute outputs all routers in the path (including intermediate connections if they respond to the traceroute) and the time taken to travel to each router (i.e., round-trip time).

[0150] As illustrated, the latency T between the server and the VPN / proxy SV , and the delay T between the furthest response router and the VPN / proxy. VfR It does not need to be known. For example, T SV This may not be possible if the VPN / proxy does not respond to PING or other probe / trace signals. To determine whether an intermediate connection is being used on the network, i.e., whether the instruction information originated from the client, the difference between the client-server value and the trace value may be obtained in the same / almost the same way as described above in relation to Figures 2-4 and compared to a threshold.

[0151] In practice, the latency between a particular router and the VPN / proxy can be considered negligible compared to the latency between the server and the client, and the latency between the server and the router. That is, the furthest responding router can be considered the router closest to the VPN / proxy within the distance error of the VPN / proxy's true location.

[0152] Figures 6a–6c show further implementations 600a, 600b, and 600c of a further method for determining the source of instruction information in a networked connection between a client device and a server. The inventors found that when using traceroute from end server 630, the furthest responding router found may not be the router closest to the VPN / proxy server and responding (to PING), thus not providing the most accurate estimate of the delay between the server and the VPN / proxy. To address this problem, the inventors found that by performing traceroute from multiple sources to the VPN / proxy, multiple furthest responding routers can be detected, and the furthest responding router closest to the server can be selected (as an intermediate router).

[0153] As described above, Figures 6a-6c show the VPN / proxy 610, client device 620, server 630, and the furthest responding router from the server (which may be called the server's furthest responding router 640a). The figures further show probes (probe 1 or 650). The furthest responding router from a probe is denoted as fRP1 640b in the figures (which may be called the probe 1 furthest responding router). Although one probe is shown here, the method may include more than one probe, for example, two, three, or four probes. Each of the one or more probes may have a corresponding furthest responding router.

[0154] For example (as described above), individual tracing signals may be sent from the server. In another example, individual tracing signals may be sent from both the server and the probe. Individual tracing signals may intercept different routers in the network because they may follow different paths within the network. Alternatively, individual tracing signals may follow the same path within the network and intercept the same individual router. In this example, the server's furthest responding router and the probe 1's furthest responding router are different routers. The furthest responding router for the probe may be determined in a manner corresponding to the server. That is, individual tracing signals are transmitted within the network, for example, through a traceroute, and each router in the network receiving an individual tracing signal responds with an individual tracing response. The individual router with the longest transmission time for the individual tracing signal may be determined as the furthest responding router for the probe.

[0155] Once the furthest responding router is determined for each of the server and one or more probes, the router closest to the VPN / proxy among the furthest responding routers may be determined. The router closest to the VPN / proxy may be assigned / labeled as a specific router.

[0156] The inventors found that the closest but furthest response router to the VPN / proxy has the lowest T VfRxx We discovered that there may be a delay (transmission delay of individual tray signals between the probe / server and the VPN / proxy, where xx is the traceroute source (e.g., probe / server)).

[0157] This delay can be estimated for each router using the following formula:

number

[0158] As shown in Figure 6b, the simultaneous equations for determining the closest and furthest response router to the VPN / proxy are:

number

[0159] The inventors have developed the following method for determining TP1C (more generally, the transmission delay between any probe and client device) and thereby determining the router closest to the VPN / proxy.

[0160] As explained in relation to the method described above, the original condition for checking whether an intermediate connection (e.g., VPN) exists within the network is "T SC -T SV >In the case of x, the server infers the use of a VPN."

[0161] Generally, this formula is T xxC-TxxV It can be written in the form of >x, where "xx" is the source of the traceroute (i.e., server or probe 1), and the set of xx values ​​corresponding to the traceroute source found to generate the router closest to the VPN / proxy is ultimately used to determine whether an intermediate connection is being used.

[0162] The inventors have developed a method to send a T from an end server (probe) that is different from the end server (probe) that the client was originally communicating with. xxCWe discovered that this presents a new challenge because the IP address is obtained. This is problematic because the client may have been communicating behind a VPN, potentially concealing its true IP address.

[0163] Considering Figure 6c, probe 1 has a transmission time TP1C A probe message may be sent to the client device, and the client device may respond with a probe message response. An example of a probe message is given below in relation to Figure 7. However, the probe message response is transmitted to the server 630, not probe 1, with a transmission time T. CS It may be sent via [unspecified method]. That is, probe message responses may only be sent to the server. The probe may send an initial message using the same instruction information. That is, the server and probe may share instruction information to communicate with the client device, for example, over an anycast network. However, probe message responses may be sent to the server because the network connection belonging to the specified instruction information (e.g., a public IP address) is between the server and not the client device and the probe.

[0164] The inventors identified several methods that can be used to configure an end server and one or more probes to communicate with a client device.

[0165] Intrusive Method The client agent interacts with an agent on the client that can communicate with the probe (sometimes called a new end server). This method often requires the client to have intrusive software (SW) capabilities; otherwise, the client agent may refuse to cooperate.

[0166] Non-Intrusive Methods URL (or other) redirects can force a client to communicate with a different IP address. For websites, this method can negatively impact page rankings, and the redirect process may be noticeable to end users. Virtual IP Addresses / Anycast...Anycast routing allows legitimate communication from a client to another end server located in a completely different physical location. This is possible because these end servers can share the same IP address, allowing access to the client from behind a VPN. If done cleverly, this method can appear undetectable to the end user. IP address spoofing... While it may be used, the inventors found that this method cannot be a reliable implementation because spoofed packets violate internet rules and tend to be actively dropped by network infrastructure if detected.

[0167] The primary method chosen by the inventors to obtain latency between a new server location (probe 1) and an end client was anycast networking (see, for example, https: / / render.com / blog / how-to-build-an-anycast-network).

[0168] In the anycast method, probe 1 shares the same IP address as the server, so it can potentially penetrate behind the VPN. Responses from the client are still routed only to the server. Therefore, coordination between the probe and the server may be necessary for measurement. As mentioned above, Figure 6c shows that the TxxC delay is used in formulating known timings for anycast network (client replies to messages sent from probe 1 are carried to the server):

number

[0169] Therefore, the step of determining the transmission time of a probe message may include recording a first timestamp of the time the probe message was sent, recording a second timestamp of the time the probe message response was received, determining the time difference between the first and second timestamps as the round-trip time, and determining the difference between the probe message round-trip time and the client-server value as the transmission time of the probe message.

[0170] By rewriting equations (3) and (4) above, we obtain the following equation:

number

[0171] Right-hand value (T xxfR and T S1fR ) is known, and the router closest to the VPN is (T VfRS1 +2T VC Assuming that ) is constant per server / probe, we generate the lowest leftmost value.

[0172] T xxCOnce latency is obtained for all probes, it is used to determine the closest and furthest responding router to the VPN (for example, a specific router may be assigned, and an estimate of the latency between an end client device and a device with which an end server is communicating directly can be determined (if no intermediate connection is used, the device is an end client device, or if an intermediate connection is used, it is, for example, a VPN / proxy)).

[0173] The latency between the client device and the intermediate connection (if used) may be determined by approximating the intermediate router as being in the same location as the VPN / proxy. Therefore, T VfRxx ≈ 0 and T xxV ≒T xxfrR .

[0174] Therefore,

number

[0175] If this delay exceeds a certain threshold, it can be inferred that an intermediate connection (VPN or proxy server) is being used. That is, T VC This can be compared to a threshold.

[0176] T VC >If x, it can be determined that an intermediate connection is being used. x may be between 2ms and 5ms (inclusive). In this example, T VC This can be a difference value.

[0177] Naturally, the above formula may be rewritten to determine that recognized instruction information from the client device originated from the intermediate connection when the client-server value exceeds a threshold. The threshold is based, for example, at least in part, on the tracing value. For example:

number

[0178] Or, TSC <RTT p1cS -T p1V -x.

[0179] If it is determined that an intermediate connection is being used (after the above determination has been made), no further communication is required between either probe or the client, and communication between the client and the server can resume as it was before the VPN discovery period.

[0180] The aforementioned method may be utilized by Content Delivery Networks (CDNs) (e.g., website hosts) to build and maintain a database of potential VPN / proxy IP addresses. This could enable providers to offer hybrid VPN / proxy discovery services.

[0181] The methods described herein can detect displacement discrepancies in scenarios where a VPN / proxy establishes a second, separate TCP connection with a server on behalf of a client (i.e., generates and sends TCP packets to the server), and in scenarios where the VPN / proxy forwards TCP packets received from a client. These methods provide resilient procedures for estimating latency between the VPN / proxy and the server, and can also add redundancy to obtain the actual latency between the end server and the client when TLS / SSL is not used.

[0182] Furthermore, the methods described herein can enhance resilience to detection in the case of uncooperative VPN servers that may not respond to PING.

[0183] Furthermore, the methods described herein may offer the following advantages: ●Even if the VPN / proxy does not generate ACK packets (only relays them) or does not respond to PING, the latency between the VPN / proxy and the server can be flexibly estimated. ● Because the discovered individual (alternative) routers are inline, the accuracy of timing measurements is maximized, increasing the likelihood of finding a router (or point) that is very close to the actual VPN / proxy server. ●This method eliminates the risk of detection errors caused by geolocation inaccuracies (ranging from 50% to 75% in urban granularity). ●These methods may not require an excessive number of probes, but are very suitable for CDN networks with points of presence (PoPs) distributed across cities worldwide. This applies to all CDNs, so no additional infrastructure is needed.

[0184] Figure 7 shows an example 700 of the coordination between probes 731, 732, and 733 and server 720 for obtaining transmission delay from probe messages and probe message responses in a network connection. The transmission delay obtained in this example is the transmission delay T related to the transmission of probe messages between each probe and client 710. xxC That is the case.

[0185] A client device may request access to a web page hosted by a server. For example, a client device may send an index request to the server. The server may respond with an HTML page served to the client device.

[0186] Using intelligent algorithms, seamlessly (i.e., without any service degradation or noticeable latency) T xxCDelay can be obtained. For example, when a web page is loaded, a message intended for the client (image file or image information) may be divided into N parts (one part for each probe, including the server). Each divided part of the message may be distributed directly to the probe, which sends them to the client as probe messages and records when they were sent. In this example, those times are sent back to the server. The server uses these times in combination with ACK responses received from the client (not shown) (e.g., probe message responses) to determine the RTT. PxC Calculate the delay.

[0187] The server and probe can cooperate to ensure that the transmission of parts of an image (image portion) or sets of images is divided between the probe and the server, so that all (image) components are transmitted, and no single component is transmitted by multiple devices (probes or servers).

[0188] In this example, the client device sends image requests to each of the probes, e.g., request img 1, request img 2, and request img 3. Each probe directly provides the requested image to the client device (i.e., they do not pass through the server to send the image information to the client). In this case, the probe messages may be messages that have sent the images to the server, e.g., img 1 served, img 2 served, and img 3 served. The probes may also send delayed sync messages (i.e., timestamps of the transmission time of the probe messages) Delay 1 Sync, Delay 2 Sync, and Delay 3 Sync to the server.

[0189] In cases where the VPN server (not the client) sends an ACK message, SSL protocol messages may be used to guarantee a response from the client. Specifically, the inventors found that the only SSL packets that reliably reach the client are SSL handshake packets. Measuring the delay from the maximum number of available probes increases the likelihood of finding the nearest further responding node to the intermediate connection. Furthermore, making the handshake as long as possible improves the accuracy of the transmission time measurement between the server / probe and the client device. The server may be configured to require client authentication, which increases the number of handshake SSL packets exchanged. Additionally, negotiation can be extended using additional TSL extensions enabled by the client. For example, Cipher negotiation may be used as described above.

[0190] HTML tags that trigger additional requests may be used to communicate immediately with the server / probe to obtain multiple latency measurements. HTML tags may be used, for example, when SSL is not used or when further communication is required. These requests may include cache busting techniques to ensure communication with the server / probe. To prevent further latency (based on domain lookup time), specify the IP address directly in the URL or use the same domain name for all requests. If using the same domain, it may be necessary to use an anycast server solution with an added tag layer to measure the full RTT (e.g., an iframe loading additional image tags).

[0191] Another way to verify that communication originated from the client is to use JavaScript code. However, using JavaScript may notify the VPN / proxy of the detection attempt. Therefore, since the VPN service itself actively tries to evade detection, the use of JavaScript should be avoided in use cases where obfuscation of VPN service detection is required.

[0192] Another implementation of the probe system is to use multiple “reverse proxies” as probes that share the same anycast IP. These reverse proxies route communications to only one main web server, which then chooses which proxy to route responses through. This allows for seamless measurement from different probes. In essence, in a reverse proxy architecture, a proxy (which may also be a server itself) is positioned in front of the main server to inspect requests before forwarding them to the main server.

[0193] Figures 8a–8c show flowcharts 800a, 800b, and 800c of embodiments of the method described herein. Numerical examples are given below in relation to the figures.

[0194] The initiation step S810a may be the start of communication between the client and the server. For example, the web server may receive an HTTP communication request from a device with source IP address 233.252.0.0 (i.e., instruction information) and want to determine whether the visible IP address location matches the location of the actual end client device that initiated the communication.

[0195] T SxC Acquisition step S820a is the T between the client and multiple probe (server-side) sources. SxCThis may include obtaining a measure of the following: The server may first obtain the client-server value from the TCP handshake. The TCP handshake may occur first, and the server may record the delay between its sending of a TCP ACK and its receiving of a TCP ACK from the client:

number

[0196] Therefore, in this example, the client-server value is T S1X-TCP And it is 50ms.

[0197] Upon receiving the client's initial communication, the server may perform a PING to the specified IP address. If a response to the PING is recorded, it can be determined that a VPN is being used. However, in this example, no response (PING response message) is received, so the server initiates a traceroute to that IP address from several geographical locations, including its own IP address.

[0198] T SxC Referring again to acquisition step S820a, for example, if PING is unsuccessful, the server may initiate one or more probes. If the secure (SSL / TLS) protocol is used (Y in Figure 8b), "T between the client and multiple probe (server-side) sources SxC Step 820b, “Obtain the measure of” may be performed for the server and each probe. If the secure (SSL / TLS) protocol is not used (N in Figure 8b), “Obtain the measure of” from a request within the application layer (e.g., browser time) or from a script deployed in the browser. SxC Step 830b, "obtaining," may be performed.

[0199] T SxV Acquisition step 830a is a measure of latency T between the server / probe and the device hosting the public IP address. SxVThis may include obtaining the public IP address. Referring to Figure 8c, first, as described above, the method may determine whether the public IP address responds to the PING. If so, "T via PING from the main server to the public IP address SxV Step 830c, "obtaining," may be performed. If Y, no time delay associated with the probe is required. From the PING response from the VPN / proxy, it can be concluded that the VPN / proxy is present on the network.

[0200] Furthermore, referring to Figure 8c, if the answer is "No," then "The T from the router closest to the public IP, discovered using traceroute from multiple probe servers, is..." SxV Step 820c, "Estimate the RTT," may be performed. In this example, since the VPN / proxy did not respond to the PING, a server and two additional probes are deployed (in this example, the probes are called the server, i.e., s2 and s3). The IP addresses of the corresponding furthest responding routers are 233.252.1.1, 233.352.1.2, and 233.252.1.1, respectively. Dividing the RTT by 2 gives T SxV This transmission delay is obtained:

number

[0201] Following the TCP handshake, the server may use the TLS handshake to measure the RTT to the end client:

number

[0202] Since the RTT measured from the TLS and TCP protocols are similar, it can be inferred that the public address resides in the same location as the end client device, or that the VPN is TCP passive (it does not initiate TCP packets to the server, but only forwards them from the client). In the latter case, the public IP address may still reside in a different location from the end client device. In either case, the TLS RTT and TCP RTT can be verified by comparing them to the RTT measured by pinging the VPN proxy or by tracing the furthest responding router (a specific router).

[0203] For each of the traceroutes described above, the minimum RTT delay of the "PING" sent to the furthest responding router (the one furthest from the transmitting probe) may be captured. SxfR A set of delays is generated, and after making a small adjustment of 4ms, the VPN RTT is generated. SxV This is estimated to be a delay between the two.

[0204] These delays are as follows:

number

[0205] The aforementioned 4ms adjustment may take into account the fact that the furthest response router may not be located in exactly the same place as the VPN. That is, the furthest response router may be one hop less from the server / probe than the VPN. Therefore, the inventors added a 4ms adjustment to the delay between the server and the furthest response router in order to more accurately estimate the delay between the server and the VPN / proxy. Of course, other values ​​may be used for the adjustment. For example, the adjustment value may be greater than 1ms, or in the range between 0ms and 4ms.

[0206] In decision step S840a, T SC and T SV The pair is T SxC and T SxVThe measurement can be determined / judged from a set of measurements. By assigning the closest and furthest responsive router to the VPN as the specific router, the measurement from the closest and furthest responsive router (FRR) to the VPN can be determined. SxV Use T SxV The value can be determined (multiple T values ​​in the same FRR) SxV If values ​​exist, the lowest value can be selected to reduce noise. The closest and furthest responding router to the VPN (referred to as the specific router) may be determined by calculating the following formula for all servers:

number

[0207] Right-hand value (T xxfR and T S1fR ) is known, and the individual router closest to the VPN will produce the lowest right-hand value.

[0208] Server 1 T xxCS1 (This is already known from TCP / TLS / SSL RTT delays), and the remaining servers may be decided as follows: Since the client is requesting a web page, HTML communication tags embedded in the delivered page may be used (to trigger the end client to request / download additional content).

[0209] While parts of a webpage may be delivered by Server 2, these special tags may be sent from Servers 2 and 3 according to instructions from Server 1. The time it takes for these tags to be sent to the client may be recorded by Servers 2 and 3 and notified to Server 1. When the client receives these tags, it may request additional information from Server 1, and Server 1 may record the time each additional request is received. Using these timestamps, the delay from Server 2 to the client and then to Server 1 is T S2CS1 It can be calculated as follows, and similarly, the delay from server 3 to client and then to server 1 is T S3CS1It can be calculated as follows.

[0210] [Table 1] Therefore, substituting these values ​​into the server-specific formula:

number

[0211] In the above equation, S1 and S3 produce the same value, namely 54ms. This indicates that they are connected to the same furthest response router (FRR). However, since the equation for S2 produces the lowest value, it can be concluded that the FRR communicating with Server 2 is closest to the VPN / proxy and therefore labeled as the intermediate router.

[0212] By rewriting the above equations for S1 and S2, the transmission time for sending a message from server 2 to the client device may be determined as follows:

number

[0213] Alternatively, the transmission time may be calculated as the round-trip time (RTT) between the transmission sent from server 2 and the reception at server 1, i.e., the transmission time between server 1 and the client device, minus 114ms. This is the TLS transmission time, for example, T S1X-TLS It can also be set to =52ms. Therefore, the same value as above, T S2CThis becomes 62ms. Of course, TCP transmission time, or for example, the average of TCP transmission time and TLS transmission time, could be used instead. This example may apply when the furthest responding router is along the server's network path. That is, when using TSL RTT, a specific furthest responding router may be used, rather than any furthest responding router (hence the formula may lose its generality, i.e., in the case of "xx").

[0214] Therefore, measurements from server 2 may be used to measure the time displacement between the public IP address and the client:

number

[0215] The distance error between the end client's location and the public IP address's location can be obtained as follows:

number

[0216] n fibre is the refractive index of the optical fiber, which can be approximately 1.5 in the case of glass, for example. Since the delay exceeds a certain threshold x (x=5ms in this example), the use of a VPN / proxy within the networked connection can be inferred.

[0217] The methods described herein can detect whether the device with which the server is communicating directly is not the same device that is sending responses to the server, and may therefore be used to infer whether the server is communicating indirectly with the client via means such as a VPN, proxy server, or Tor network.

[0218] The method complements Internet geolocation technology and enables the detection of clients attempting to disguise their geographical location, thereby reducing false negatives in geolocation applications (such as use cases of multi-factor authentication GeoLock where geolocation is an additional element), and enhancing the reliability of robust localization applications.

[0219] Furthermore, the method can also be applied to the detection of VPN usage, which helps content providers comply with license terms and international laws. A CDN equipped with this technology can offer customers a new service that mitigates the threat of click fraud by bots using VPNs / proxies to conceal their activities. The method described herein uses aspects that are difficult to forge (such as timings where it is difficult for a device to shorten communication transit times), thus providing an accurate method for detecting the use of intermediate connections.

[0220] Figure 9 shows another flowchart 900 for implementing the method described herein.

[0221] In the waiting step S910, the server may wait for communication from the client to detect a displacement mismatch (i.e., to detect whether a VPN located at a different position from the client device is being used).

[0222] In the execution step S920, the method described herein may be executed. That is, a displacement mismatch is detected. The method can use timing measurements to detect the (distance / time) displacement between the device hosting the public IP address (the device the server is communicating with) and the end-client device (the end-client device the server is communicating with), and use this to infer a geolocation mismatch between the two devices and to infer whether a VPN / proxy server is being used by the end-client.

[0223] In one example, if the VPN / proxy does not send a TCP ACK message to the server that the client is communicating with, PING may be used to estimate the latency from the VPN / proxy to the server. For example, the server may send a PING addressed to the recognized indication information (public IP address) of the client device. If the VPN / proxy is being used and responds to the PING, the server may determine that the VPN / proxy is being used. If the VPN / proxy does not respond to the PING, a traceroute from the probe's unicast network may be used to estimate the latency from the router closest to the VPN / proxy that does not respond to the PING. If a secure TLS / SSL connection is not being used and TCP ACKs are being sent from the VPN / proxy to the server (not from the end client), an application layer technique may be used to estimate this latency.

[0224] Using the response from the intermediate router, the server may determine whether a VPN / proxy is being used by the methods described herein.

[0225] In the output step S930, the server may output the detection result. That is, the server may output whether the indication information was issued from an intermediate connection within the networked connection or from the client. That is, the method may determine whether an intermediate connection exists within the network. Additionally, or alternatively, if it is determined that an intermediate connection exists, the client device may, for example, have its access to a website or service cancelled. That is, if the connection between the server and the client is via the HTTP protocol to a connection to a website, if an intermediate connection is established, the client's access to the website may be blocked or cancelled.

[0226] Furthermore, by determining whether an intermediate connection is being used, the method may potentially be used in the following applications: ● To enable banks to more effectively prevent phishing attacks, money laundering, and other security breaches. ● To enable law enforcement agencies to more effectively monitor online transactions and transactions with prohibited countries. ● To enable content providers to comply with licenses and international laws. ● To enable social media companies to identify threats and provide customized services.

[0227] For example, a content provider may require such technology (as described herein) to comply with license terms that may restrict content distribution to specific regions and to ensure that they are not deceived by users behind a VPN. Furthermore, multi-factor authentication that uses geolocation as a factor must not be deceived by a VPN, especially in highly sensitive applications such as banking. Therefore, if it is detected that a VPN is being used, a content provider may revoke or block access to the content on the client device, or block authentication or login on the client device through multi-factor authentication.

[0228] Therefore, given the importance of these applications, the ability to detect when a client is attempting to distort actual location information can be crucial for the integrity of these systems and applications.

[0229] Active IP geolocation may be included in Data & Security Lab's Trusted Web3, Smart Data Vonvernance, and Privacy-Conscious Identity projects. The methods described herein may be used to provide the “D3tecta service,” which notifies the server whether the client is using a VPN / proxy to communicate with the server. Such information (IP address information away from the end client) may be collected from the service’s customers to provide another service, passive VPN / proxy detection. The database for this service may be actively maintained, for example, by a customer-managed D3tecta service. In other words, if it is determined that an intermediate connection is being used, the methods described herein may record / store the recognized indication information (IP address). If the IP address is used again, it will be recognized as coming from an intermediate connection, and the client device may be blocked from accessing the server’s services.

[0230] As another example, the methods described herein could be used by content delivery networks (CDNs) to prevent click fraud, an example of VPN misuse (https: / / fingerprint.com / blog / vpn-detection-how-it-works / ). In other words, if a VPN is detected, access to the service can be blocked, preventing click fraud.

[0231] Figure 10 shows an architecture 1000 that implements the method described herein. As described above, the server's IP anycast network 1010 may be used to communicate with the end client device 1040. The anycast network may include a main server 1013 and one or more probes 1014. The main server may communicate with the end client device via the internet 1020. For example, the main server and the client device may communicate via the HTTPS protocol.

[0232] The main client device may route its data / traffic through an intermediate connection marked in the diagram as "device 1030, which is assigned a public IP address that the main server sees."

[0233] The main server may receive a public IP address and share it with the probe. Therefore, the probe can communicate with client devices using the same IP address as the main server.

[0234] Figure 11 is a block diagram of an information processing device 1100 or computing device 1100 or server 1100 (e.g., a (data storage) server) which may be used to embody the present invention, implement some or all of the operations of a method for embodying the present invention, or perform some or all of the tasks of the apparatus of the embodiment. The computing device 1100 may be used to implement any of the method steps described above, for example, steps S10 to S50 and / or S410 to S450 and / or S810a to 860a. The apparatus described in relation to Figure 11 may be implemented herein as a server and / or probe and / or client, for example, in relation to the architecture of Figure 10.

[0235] The computing device 1100 includes a processor 1103 and memory 1104. Optionally, the computing device also includes a network interface 1107 for communicating with other such computing devices, for example, other computing devices in the embodiments of the invention. Optionally, the computing device also includes one or more input mechanisms, such as a keyboard or mouse 1106, and one or more display units, such as monitors 1105. These elements can assist user interaction. The components are connectable to each other via a bus 1102.

[0236] Memory 1104 may include a computer-readable medium. This term can refer to a single or multiple mediums configured to carry computer-executable instructions (e.g., a centralized or distributed database and / or associated caches and servers). Computer-executable instructions may include instructions and data that are accessible by a computer (e.g., one or more processors) and cause the computer to perform one or more functions or operations. For example, computer-executable instructions may include instructions for performing the methods disclosed herein or any of the method steps disclosed herein, e.g., steps S10 to S50. Accordingly, the term “computer-readable storage medium” may include any medium that can store, encode or carry a set of instructions executed by a machine and cause the machine to perform one or more of the method steps of this disclosure. Accordingly, the term “computer-readable storage medium” may be understood to include, but not be limited to, solid-state memory, optical media and magnetic media. For example, and not as an limitation, such computer-readable media may include non-temporary computer-readable storage media such as random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), compact disk read-only memory (CD-ROM) or other optical disk storage, magnetic disk storage or other magnetic storage devices, and flash memory devices (e.g., solid-state memory devices).

[0237] The processor 1103 is configured to control the computing device and perform processing operations, such as executing computer program code stored in memory 1104 to implement any of the method steps described herein. Memory 1104 stores data that the processor 1103 reads and writes, and may store at least one IP address-geolocation database, a probe database (i.e., a database of available anycast probes), and / or expressions (e.g., expressions (1), (2), (3), etc.), and / or any of the aforementioned blocks, and / or programs for performing any of the aforementioned method steps. These entities may take the form of code blocks that are called and executed by the processor as needed.

[0238] As described herein, a processor may include one or more general-purpose processing devices, such as a microprocessor or a central processing unit. A processor may include a multiple instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or a processor implementing another instruction set or a combination of instruction sets. A processor may also include one or more special-purpose processing devices, such as an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), or a network processor. In one or more embodiments, a processor is configured to execute instructions for performing the operations and behaviors described herein. As described above, processor 1103 can be considered to have either a block, a unit, or a module. Any operation described as being implemented by a block may be implemented by a computer, for example, by processor 1103.

[0239] The display unit 1105 may display a representation of data stored and / or generated by the computing device, such as a determination of whether the connection between the client device and the server is routed through an intermediate connection. For example, the computing device may be a client device. The client device may request access to a website / web page by communicating with other computing devices (e.g., a server). The output may be presented as a GUI window and / or interactive representation that allows the server-side user to interact with the device 1100, for example, by selection interactions, input text boxes, and / or other aforementioned outputs, and may also display cursors, dialog boxes, screens, etc., that enable interaction between the user and programs or data stored in the computing device. The input mechanism 1106 may allow the user to input data or commands into the computing device. For example, the display unit may display a GUI including a user panel or an input space for user interaction. For example, on the server side, the user may input a query about whether the connection is routed through an intermediate connection. The user can interact with the GUI or display to generate or view the determined answer. Of course, the process can be automated without any interaction with the user.

[0240] A network interface (network I / F) may be connected to a network such as the Internet and can connect to other computing devices and / or servers via the network. Network I / F 1107 can control data input from other devices and data output to other devices via the network. Other peripherals such as microphones, speakers, printers, power supply units, fans, cases, scanners, and trackballs may also be included in computing devices.

[0241] A method for embodying the present invention may be performed in a computing device / apparatus / server 1100 as shown in Figure 11. Such a computing device does not need to have all the components shown in Figure 11, but may consist of some of these components. For example, apparatus 1100 may have a processor 1103 and a memory 1104 connected to the processor 1103. Alternatively, apparatus 1100 may have a processor 1103, a memory 1104 connected to the processor 1103, and a display 1105. For example, the functions and / or architectures described with respect to Figures 8a-8c and Figure 9 may be stored in memory, and / or the methods described with respect to Figure 2 and / or Figure 4 may be stored in memory. The processor may be configured to execute the methods stored in memory using, for example, the functions and / or architectures stored in memory.

[0242] A method for embodying the present invention may be performed by a single computing device / server that communicates with one or more (data storage) servers over a network. The computing device itself may be data storage that stores at least a portion of the data. The functions and / or architecture and / or methods may be stored in one or more data storage servers, and a processor in the computing device may be configured to perform the method steps. As an example, step S10 in Figure 2 may be performed by a (web) server that receives instruction information from a client device. The server may transfer / transmit the instruction information to a computing device / device / server (i.e., a discovery server), which may then perform the remaining steps S20-S50. Alternatively, method steps S10-S50 may be performed by a (web) server.

[0243] The method of embodying the present invention may be executed by a plurality of computing devices that cooperate with each other. One or more of the plurality of computing devices may be a data storage server that stores at least a part of the data. For example, an IP address-geolocation database and / or a probe database may be stored in a server separate from other blocks, units, or modules.

[0244] The present invention may be implemented in digital electronic circuits, or in computer hardware, firmware, software, or combinations thereof. The present invention may be embodied as a computer program or a computer program product, i.e., a non-transitory information carrier, e.g., a computer program tangibly embodied in a machine-readable storage device, for execution by, or to control the operation of, one or more hardware modules, or may be implemented in a propagated signal.

[0245] The computer program may take the form of a stand-alone program, a computer program portion, or more than one computer program, and may be written in any form of programming language, such as a compiled or interpreted language. Also, it may be deployed in any form, such as a stand-alone program, a module, a component, a subroutine, or other unit suitable for use in a data processing environment. The computer program may be deployed to be executed in one module, or in one location, or distributed in multiple locations and executed by multiple modules interconnected by a communication network.

[0246] The method steps of the present invention may be carried out by one or more programmable processors that execute a computer program to perform the functions of the present invention by acting on input data to generate an output. The apparatus of the present invention may be implemented as special-purpose logic circuits or programmed hardware, such as FPGAs (field programmable gate arrays) or ASICs (application-specific integrated circuits).

[0247] Processors suitable for executing computer programs include, for example, one or more processors from both general-purpose and special-purpose microprocessors, or any type of digital computer. Generally, a processor receives instructions and data from read-only memory, random-access memory, or both. An essential element of a computer is a processor that executes instructions, coupled with one or more memory devices that store instructions and data.

[0248] The aforementioned embodiments of the present invention may be used advantageously independently of the other embodiments, or in any viable combination with one or more other embodiments.

[0249] The following numbered descriptions may help provide additional information relating to the present invention: S1. A computer-based method for determining the source of instruction information in a networked connection between a client device and a server, When the server receives (or triggers the reception of) the instruction information from the client device, The client-server value is determined based on the transmission time of the connection signal transmitted between the client device and the server, In the networked connection between the client device and the server, a tracing signal addressed to the instruction information is transmitted (or triggered to be transmitted) via a specific router. The tracing value is determined based on the transmission time of the tracing signal to the aforementioned specific router, By comparing the difference value based on the client-server value and the tracing value with a threshold, it is determined whether the instruction information originated from an intermediate connection within the networked connection or from the client device. A method that includes this.

[0250] The method described in S2.S1, The tracing value is determined based on the round-trip time of the combination of the tracing signal and the tracing signal response sent from the specific router. method.

[0251] The method described in S3.S2, The tracing signal and the tracing signal response are included in the traceroute transmission, and preferably the tracing signal is a User Datagram Protocol (UDP) packet or an Internet Control Message Protocol (ICMP) packet. method

[0252] A method described in any one of the descriptions in S4.S1 to S3, The aforementioned specific router is the intermediate connection. method.

[0253] A method described in any one of the descriptions in S5.S1 to S4, The aforementioned networked connection includes more than one individual router, Individual tracing signals are sent to more than one individual router in the networked connection. Each individual router that receives an individual tracing signal sends an individual tracing response. Among the individual tracing signals, the individual tracing signal with the longest transmission time is assigned as the tracing signal. method.

[0254] The method described in S6.S5, The individual tracing signals are transmitted by the server. method.

[0255] The method described in S7.S6, The individual tracing signals are transmitted by the server and the probe to the same or different individual routers in the networked connection. method.

[0256] The method described in S8.S7, The server and the probe share the instruction information to communicate with the client device, and preferably the server and the probe form an anycast network. method.

[0257] A method described in S9, S7 or S8, The tracing signal is transmitted by the probe, The client-probe value is determined based on the transmission time of the probe message sent from the probe to the client device. The aforementioned difference value is further based on the client-probe value, method.

[0258] The method described in S10.S9, The server receives a probe message response to the probe message. method.

[0259] Methods described in S11 and S10, The difference between the round-trip time of the probe message and the probe message response and the client-server value is defined as the transmission time of the probe message. method.

[0260] The method described in S12.S11, The round trip time of the probe message and the probe message response is The first timestamp of the time the probe message was sent is recorded, The second timestamp of the time when the probe message response was received is recorded, The time difference between the first timestamp and the second timestamp is determined as the round trip time. Determined by, method.

[0261] A method described in any one of the descriptions in S13.S9~S12, The client-server value, the client-probe value, and the tracing value are time values, preferably in seconds. The difference value is calculated as the difference between the client-probe value and the tracing value, and preferably the threshold is between 2ms and 5ms. method.

[0262] A method described in any one of the descriptions in S14.S1 to S13, The aforementioned instruction information is an Internet Protocol (IP) address, preferably a public IP address. method.

[0263] A method described in any one of the descriptions in S15.S1 to S14, The client-server value includes the client-server round-trip time of the connection signal. method.

[0264] A method described in any one of the descriptions in S16.S1 to S15, The connection signal transmitted between the client device and the server is at least one of the following: a Transmission Control Protocol (TCP) handshake signal, a Source Socket Layer (SSL) handshake signal, and a Transport Layer Security (TLS) handshake signal. method.

[0265] A method described in any one of the descriptions in S17.S1 to S16, If the server determines that the instruction information originated from the intermediate connection, the server may restrict the resources available to the client device, revoke the network privileges of the client device, and / or trigger multi-factor authentication for the client device. method.

[0266] A method described in any one of the descriptions in S18.S1 to S17, The aforementioned intermediate connection is a virtual private network connection, a Tor connection, a proxy connection, or a tunneling connection. method.

[0267] S19. When executed on a computer, the computer is instructed to perform a method for determining the source of instruction information in a networked connection between a client device and a server, the method being: The server receives (or triggers the reception of) the instruction information from the client device, The client-server value is determined based on the transmission time of the connection signal transmitted between the client device and the server, In the networked connection between the client device and the server, a tracing signal addressed to the instruction information is transmitted (or triggered to be transmitted) via a specific router. The tracing value is determined based on the transmission time of the tracing signal to the aforementioned specific router, By comparing the difference value based on the client-server value and the tracing value with a threshold, it is determined whether the instruction information originated from an intermediate connection within the networked connection or from the client device. A computer program that includes [this].

[0268] S20. An information processing device for determining the source of instruction information in a networked connection between a client device and a server, The system includes memory and a processor connected to the memory, the processor being The server receives (or triggers) the instruction information from the client device. The client-server value is determined based on the transmission time of the connection signal transmitted between the client device and the server. In the networked connection between the client device and the server, a tracing signal addressed to the instruction information is transmitted (or triggered) via a specific router. The tracing value is determined based on the transmission time of the tracing signal to the specific router. By comparing the difference value based on the client-server value and the tracing value with a threshold, it is determined whether the instruction information originated from an intermediate connection within the networked connection or from the client device. An information processing device configured in such a way.

[0269] S21. A computer-based method for determining the source of instruction information in a networked connection between a client device and a server, The server receives (or triggers the reception of) the instruction information from the client device, The client-server value is determined based on the transmission time of the connection signal transmitted between the client device and the server, The server transmits (or triggers the transmission of) a packet internet or internet network groper (PING) message addressed to the instruction information in the networked connection, Sending (or triggering) a tracing signal to a specific router in the networked connection between the client device and the server when the elapsed time for receiving a PING response message has elapsed, The tracing value is determined based on the transmission time of the aforementioned tracing signal, By comparing the difference value based on the client-server value and the tracing value with a threshold, it is determined whether the instruction information originated from an intermediate connection within the networked connection or from the client device. A method that includes this.

[0270] S22. When executed on a computer, the computer is instructed to perform a method for determining the source of instruction information in a networked connection between a client device and a server, the method being: The server receives (or triggers the reception of) the instruction information from the client device, The client-server value is determined based on the transmission time of the connection signal transmitted between the client device and the server, The server transmits (or triggers the transmission of) a packet internet or internet network groper (PING) message addressed to the instruction information in the networked connection, Sending (or triggering) a tracing signal to a specific router in the networked connection between the client device and the server when the elapsed time for receiving a PING response message has elapsed, The tracing value is determined based on the transmission time of the aforementioned tracing signal, By comparing the difference value based on the client-server value and the tracing value with a threshold, it is determined whether the instruction information originated from an intermediate connection within the networked connection or from the client device. A computer program that includes [this].

[0271] S23. An information processing device for determining the source of instruction information in a networked connection between a client device and a server, The system includes memory and a processor connected to the memory, the processor being The server receives (or triggers) the instruction information from the client device. The client-server value is determined based on the transmission time of the connection signal transmitted between the client device and the server. The server transmits (or triggers) a packet internet or internet network glober (PING) message addressed to the instruction information in the networked connection. If the elapsed time for receiving a PING response message has elapsed, a tracing signal is sent (or triggered) to a specific router in the networked connection between the client device and the server, The tracing value is determined based on the transmission time of the tracing signal. By comparing the difference value based on the client-server value and the tracing value with a threshold, it is determined whether the instruction information originated from an intermediate connection within the networked connection or from the client device. An information processing device configured in such a way. [Explanation of Symbols]

[0272] 110 Virtual Private Network 115 VPN Geolocation 120, 320, 520, 620, 710, 1040 client devices 130,330,530,630,720,1013 Servers 310, 510, 610, 1030 Intermediate connection (VPN / proxy) 540, 640a, 640b routers 731, 732, 733, 1014 probes 1010 Anycast Network 1100 Information Processing Device 1103 Processor 1104 memory

Claims

1. A computer-based method for determining the source of instruction information in a networked connection between a client device and a server, The server receives the instruction information from the client device, The client-server value is determined based on the transmission time of the connection signal transmitted between the client device and the server, In the networked connection between the client device and the server, a tracing signal addressed to the instruction information is transmitted via a specific router. The tracing value is determined based on the transmission time of the tracing signal to the specific router, By comparing the difference value based on the client-server value and the tracing value with a threshold, it is determined whether the instruction information originated from an intermediate connection within the networked connection or from the client device. A method that includes this.

2. The tracing value is determined based on the round-trip time of the combination of the tracing signal and the tracing signal response sent from the specific router. The method according to claim 1.

3. The tracing signal and the tracing signal response are included in the traceroute transmission, and preferably the tracing signal is a User Datagram Protocol (UDP) packet or an Internet Control Message Protocol (ICMP) packet. The method according to claim 2.

4. The aforementioned specific router is the intermediate connection. The method according to any one of claims 1 to 3.

5. The aforementioned networked connection includes more than one individual router, Individual tracing signals are sent to more than one individual router in the networked connection. Each individual router that receives an individual tracing signal sends an individual tracing response. Among the individual tracing signals, the individual tracing signal with the longest transmission time is assigned as the tracing signal. The method according to any one of claims 1 to 3.

6. The individual tracing signals are transmitted by the server. The method according to claim 5.

7. The individual tracing signals are transmitted by the server and the probe to the same or different individual routers in the networked connection, optionally, The server and the probe share the instruction information to communicate with the client device, and preferably the server and the probe form an anycast network. The method according to claim 6.

8. The tracing signal is transmitted by the probe, The client-probe value is determined based on the transmission time of the probe message sent from the probe to the client device. The aforementioned difference value is further based on the client-probe value. The method according to claim 7.

9. The server receives a probe message response to the probe message. The method according to claim 8.

10. The difference between the round-trip time of the probe message and the probe message response and the client-server value is defined as the transmission time of the probe message. The method according to claim 9.

11. The round trip time of the probe message and the probe message response is The first timestamp of the time the probe message was sent is recorded, The second timestamp of the time when the probe message response was received is recorded, The time difference between the first timestamp and the second timestamp is determined as the round trip time. Determined by, The method according to claim 10.

12. The client-server value, the client-probe value, and the tracing value are time values, preferably in seconds. The difference value is calculated as the difference between the client-probe value and the tracing value, and preferably the threshold is between 2 ms and 5 ms. The method according to claim 8.

13. The aforementioned instruction information is an Internet Protocol (IP) address, preferably a public IP address. The method according to any one of claims 1 to 3.

14. The client-server value includes the client-server round-trip time for the connection signal. The method according to any one of claims 1 to 3.

15. The connection signal transmitted between the client device and the server is at least one of the following: a Transmission Control Protocol (TCP) handshake signal, a Source Socket Layer (SSL) handshake signal, and a Transport Layer Security (TLS) handshake signal. The method according to any one of claims 1 to 3.

16. If the server determines that the instruction information originated from the intermediate connection, the server may restrict the resources available to the client device, revoke the client device's network privileges, and / or trigger multi-factor authentication for the client device. The method according to any one of claims 1 to 3.

17. The aforementioned intermediate connection is a virtual private network connection, a Tor connection, a proxy connection, or a tunneling connection. The method according to any one of claims 1 to 3.

18. When executed on a computer, the computer is instructed to perform a method for determining the source of instruction information in a networked connection between a client device and a server, and the method is: The server receives the instruction information from the client device, The client-server value is determined based on the transmission time of the connection signal transmitted between the client device and the server, In the networked connection between the client device and the server, a tracing signal addressed to the instruction information is transmitted via a specific router. The tracing value is determined based on the transmission time of the tracing signal to the specific router, By comparing the difference value based on the client-server value and the tracing value with a threshold, it is determined whether the instruction information originated from an intermediate connection within the networked connection or from the client device. A computer program that includes [this].

19. An information processing device that determines the source of instruction information in a networked connection between a client device and a server, The system includes memory and a processor connected to the memory, the processor being The server receives the instruction information from the client device, The client-server value is determined based on the transmission time of the connection signal transmitted between the client device and the server. In the networked connection between the client device and the server, a tracing signal addressed to the instruction information is transmitted via a specific router. The tracing value is determined based on the transmission time of the tracing signal to the specific router. By comparing the difference value based on the client-server value and the tracing value with a threshold value, it is determined whether the instruction information originated from an intermediate connection within the networked connection or from the client device. An information processing device configured in such a way.

20. A computer-based method for determining the source of instruction information in a networked connection between a client device and a server, The server receives the instruction information from the client device, The client-server value is determined based on the transmission time of the connection signal transmitted between the client device and the server, The server transmits a packet internet or internet network grower (PING) message addressed to the instruction information in the networked connection. If the elapsed time for receiving a PING response message has elapsed, a tracing signal is sent to a specific router in the networked connection between the client device and the server. The tracing value is determined based on the transmission time of the aforementioned tracing signal, By comparing the difference value based on the client-server value and the tracing value with a threshold, it is determined whether the instruction information originated from an intermediate connection within the networked connection or from the client device. A method that includes this.

Images