Centralized Intrusion Detection for Network Impersonation Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for protecting computer networks from impersonation attacks, such as those using public key digital certificates, are inadequate as they rely on user trust assessment or certificate reputation systems, which are intrusive, unreliable, and unsuitable for sensitive networks due to technical obstacles and vulnerability to false information.
Innovation Solution
A centralized intrusion prevention system that uses a hosts database to store authentication records and generates alerts when suspect records from intrusion sensors do not match existing records, thereby detecting and preventing impersonation attacks by ensuring the authenticity of public key certificates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a certificate reputation system is used to enhance authentication, then reliability of certificate verification is improved, but device complexity and ease of operation deteriorate due to required client adaptation and firewall obstacles
Solution Approach 1:
The patent introduces a certificate authority as an intermediary that issues digital certificates to remote servers. Clients verify server authenticity by checking these certificates against a trusted authority's public key, eliminating the need for complex reputation systems or manual user assessment while maintaining high reliability
2Reliability
If certificate pinning is used to enhance security, then reliability of certificate verification is improved, but ease of operation deteriorates due to user burden of assessing trustworthiness
Solution Approach 1:
The system enables automatic certificate verification where the client application independently checks server certificates against the trusted certificate authority's public key without requiring user intervention, assessment, or manual approval, thus maintaining high reliability while ensuring ease of operation
3Reliability
If a certificate reputation system is used, then reliability of authentication is improved, but adaptability deteriorates due to unsuitability for sensitive private networks
Solution Approach 1:
The patent implements a universal certificate verification mechanism based on public key infrastructure that can be deployed in any network environment including sensitive private networks. The system uses a trusted certificate authority that can be configured locally, making it adaptable to different network contexts while maintaining consistent authentication reliability
Data Source
AI summary
In an embodiment, a central computer performs a data processing method. The central computer receives telemetry data from intrusion sensors. The central computer stores authentication records in a hosts database. Each authentication record is based on the telemetry data and comprises a thumbprint of a public key certificate and a host identifier of a sender computer. The central computer receives a suspect record that was sent by a first intrusion sensor. The suspect record has a first particular thumbprint of a first particular public key certificate and a first particular host identifier of a suspect sender. From the hosts database, the central computer searches for a matching record having a same host identifier as the first particular host identifier of the suspect record and a same thumbprint as the first particular thumbprint of the suspect record. The central computer generates an intrusion alert when no matching record is found.