Client-Server Session Security via Adaptive Challenge-Response
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing fraud prevention and detection systems in digital environments often lead to the unnecessary disconnection of legitimate users, causing trust issues and customer dissatisfaction, while lacking proactive and adaptive countermeasures to mitigate fraud.
Innovation Solution
A Continuous Active Defense system that applies countermeasures and captures user reactions, forming a feedback loop to improve decision-making and adaptively manage online client-server sessions through a predetermined challenge-response mechanism.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing fraud prevention systems apply countermeasures such as disconnecting users, then security against fraud attacks is improved, but legitimate users are wrongly classified and disconnected causing trust issues and customer dissatisfaction
Solution Approach 1:
The system dynamically adapts countermeasures based on real-time risk assessment. Instead of applying fixed disconnection actions, the system evaluates user behavior patterns and selects from multiple countermeasure options (challenge-response, MFA, monitoring) depending on the specific risk level, thereby maintaining security while reducing false positives against legitimate users
Solution Approach 2:
The system changes the parameters of security verification by introducing challenge-response pairs with varying difficulty levels and types. Rather than simply disconnecting, the system adjusts verification parameters (challenge type, number of factors required) based on risk assessment, allowing legitimate users to prove identity through alternative means while blocking fraudulent access
2Measurement precision
If fraud detection systems monitor and analyze user behavior, then fraud detection capability is improved, but system complexity and processing overhead increase
Solution Approach 1:
The system segments fraud detection into modular components: behavior pattern collection, risk factor identification, countermeasure selection, and verification. Each component handles a specific aspect of the detection process independently, reducing overall system complexity while maintaining comprehensive monitoring capabilities through structured division of functions
3Productivity
If systems disconnect users as a countermeasure to fraud, then immediate fraud prevention is achieved, but the negative impact on wrongly classified users and loss of customer trust occurs
Solution Approach 1:
The system implements feedback loops where user responses to challenges and countermeasures are continuously monitored and fed back into the risk assessment model. This allows the system to learn from interactions, adjust risk evaluations, and refine countermeasure selection, improving fraud prevention accuracy while minimizing impact on legitimate users through adaptive decision-making
Solution Approach 2:
Instead of immediately disconnecting suspected users, the system inverts the approach by attempting to verify legitimacy through challenge-response mechanisms first. Only after verification fails multiple times does the system proceed to disconnection, thereby inverting the traditional sequence and reducing false positives against legitimate users
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
Method and system (100) for securing an online client-server session between a client device (220) and a server device (110) by application of at least a countermeasure, comprising the server device collecting client behaviour pattern during the online session, the server device marking the online session as an affected session according to a pre-agreed client-server protocol, independently of any server-client contact, the client device requesting a client-initiated countermeasure according to the pre-agreed client-server protocol, the server device responding with an indication of a particular countermeasure to be carried out by the client device, the client device carrying out the indicated particular countermeasure and sending to the server device a reaction to the countermeasure, and the server device verifying the client reaction to the countermeasure, and if verified, marking the online session as non-affected.