Certificate Similarity Blocking for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data security measures, such as SSL and HTTPS protocols, are vulnerable to man-in-the-middle attacks and inflexible certificate policies, which can lead to unauthorized data access and resource restrictions, necessitating improved network connection blocking methods.
Innovation Solution
A system and method for intercepting and analyzing certificates during protected connections, using similarity determination methods like regular expressions and N-dimensional vector clustering to identify forbidden certificates, and blocking connections when similarities are found, thereby enhancing data security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a policy of trusted certificates is used to prevent man-in-the-middle attacks, then data security is improved, but network resource availability is restricted and the system becomes inflexible
Solution Approach 1:
The patent changes the comparison parameter from exact certificate fingerprint matching to similarity-based comparison using N-dimensional vectors. This allows the system to recognize certificates from the same issuer even when specific certificate details change, thus maintaining security while improving adaptability to different network resources and certificate variations.
Solution Approach 2:
The patent implements a dynamic certificate blocking system where the database of forbidden certificates is continuously updated based on similarity analysis. The system adapts to new certificates by comparing them against known forbidden patterns, allowing flexible response to changing network threats without rigidly restricting access to predefined resources.
2Reliability
If exact certificate fingerprint comparison is used, then connection security is verified, but the system fails when certificates from the same issuer are altered
Solution Approach 1:
The patent transforms certificate data into N-dimensional vectors that capture essential characteristics while allowing for variations. This parameter transformation enables the system to maintain security verification through similarity comparison rather than exact matching, accommodating certificate alterations from the same issuer while preserving connection security.
Solution Approach 2:
The patent creates an abstract representation (N-dimensional vector) of the certificate that serves as a pattern template. This copied representation captures the essential identity of the certificate issuer without being tied to specific certificate instances, allowing the system to recognize variations while maintaining security through pattern matching.
3Reliability
If the database of trusted certificates is not updated in time, then new potentially trusted certificates are not recognized, but frequent updates increase system complexity
Solution Approach 1:
The patent performs preliminary transformation of certificates into N-dimensional vectors and stores these representations in advance in the database. When new certificates are encountered, the system compares them against the pre-stored vector patterns, enabling rapid recognition without requiring complex real-time updates of the entire certificate database.
Solution Approach 2:
The patent creates and stores abstract vector representations of certificates in advance. These copied patterns serve as reference templates that enable the system to recognize new certificates by comparison, reducing the need for frequent database updates while maintaining reliable recognition of trusted certificates.
4Reliability
If unique network addresses are blocked to counter unlawful information transmission, then security is improved, but the method becomes ineffective when addresses change
Solution Approach 1:
The patent creates abstract representations of certificates that capture the essential identity of the resource without being tied to specific network addresses. By blocking based on certificate pattern recognition rather than address matching, the system maintains security effectiveness even when resources move to different addresses, as the certificate patterns remain consistent.
Solution Approach 2:
The patent changes the blocking parameter from network address to certificate characteristics represented as N-dimensional vectors. This parameter transformation enables the system to track and block resources based on their cryptographic identity rather than their network location, making the security mechanism effective regardless of address changes.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are systems and methods for blocking network connections. An exemplary method comprises: intercepting a certificate from the server when establishing a protected connection between a server and a client, determining whether the intercepted certificate is similar to one or more forbidden certificates, the determination of whether the intercepted certificate is similar to one or more forbidden certificates comprising transforming the intercepted certificate in accordance with a method of determining similarities between certificates and a method of saving forbidden certificates in a database of forbidden certificates, and blocking the connection when the intercepted certificate is similar to the one or more forbidden certificates.