Blockchain Integrity Token Endpoint Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer network security systems, such as Endpoint Detection & Response (EDR), face challenges in ensuring the integrity of data collected at endpoints before it is submitted to the backend, as attackers can tamper with this data to hide their presence and activities, and traditional cryptographic techniques are ineffective when the endpoint is compromised.
Innovation Solution
A blockchain-based method is employed, where an initial integrity token is generated and shared between the endpoint and the security backend, with each new input event generating a new integrity token using a cryptographic hash function, ensuring that any tampering can be detected by comparing the computed and received integrity tokens at the backend.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cryptographic techniques are used to protect data integrity at endpoints, then data protection is provided, but the system becomes vulnerable when the endpoint is compromised since the attacker can tamper with the data and invalidate the cryptographic protections
Solution Approach 1:
The patent introduces a blockchain as an intermediary system between the endpoint and the central server. The blockchain acts as a trusted mediator that records data hashes in a distributed, immutable ledger. When data is collected at the endpoint, its hash is recorded on the blockchain, creating a verifiable chain of custody that cannot be tampered with by compromised endpoints, thus resolving the vulnerability to endpoint compromise while maintaining data integrity protection.
Solution Approach 2:
The patent transitions from traditional single-point cryptography to a distributed multi-point verification system. Instead of relying solely on cryptographic signatures that can be forged at a compromised endpoint, the system adds a temporal and distributed dimension by recording data hashes across multiple blockchain blocks at different timestamps and locations. This dimensional expansion makes tampering detectable and ineffective.
2Productivity
If data is stored locally at endpoints for later processing, then operational efficiency is improved, but the risk of data tampering and loss increases
Solution Approach 1:
The patent applies preliminary action by computing and recording the cryptographic hash of data immediately when it is collected at the endpoint, before the data is stored or transmitted. This preliminary hashing creates a verifiable fingerprint that can be later compared against the actual data. The hash is recorded on the blockchain at this initial stage, establishing a trusted baseline that prevents any subsequent tampering while allowing the data to remain locally stored for operational efficiency.
Solution Approach 2:
The system implements feedback mechanisms where the recorded hash values from the blockchain are used to verify the integrity of data when it is later retrieved or processed. The system continuously monitors and compares current data hashes against the recorded blockchain hashes, providing real-time feedback on data integrity. This feedback loop enables detection of any tampering while maintaining the operational benefit of local data storage.
3Measurement precision
If manual verification of data integrity is performed, then accuracy is maintained, but response time increases and automated response becomes difficult
Solution Approach 1:
The patent implements self-service by enabling the system to automatically verify data integrity using cryptographic hashes recorded on the blockchain. The verification process is automated and requires no manual intervention - when data is collected, its hash is recorded, and later when data is accessed or transmitted, the system automatically compares current hashes against the blockchain records. This self-verifying mechanism maintains high accuracy while eliminating manual verification delays and enabling immediate automated response to integrity violations.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach effectively protects the integrity of data collected at endpoints by detecting unauthorized modifications, allowing for automatic response actions to secure the network and minimize breach damage without human intervention, even when administrators are unavailable.
Implementation Method 1
a new integrity token, Ti+1, is generated based on the new input event, Ei+1, and a prior integrity token, Ti
Data Source
AI summary
There is provided a method comprising: generating and sharing an initial value of an integrity token between an endpoint node and a security backend computer, collecting data at the endpoint node, wherein dissimilar data types are aligned as input events, generating a new integrity token every time a new input event is written to a local repository of the endpoint node, wherein the new integrity token is generated based on the new input event and a prior integrity token that was generated prior to the new integrity token, removing the prior integrity token generated prior to the new integrity token from the endpoint node each time a new integrity token has been generated, and sending one or more input events with the new integrity token to the security backend computer for enabling the security backend computer checking integrity of the data received from the endpoint.