Certificate Store Monitoring for Unauthorized Alteration Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting unauthorized access to computer systems or networks, such as CertLock and Man In The Middle attacks, are inefficient and unable to effectively counter unauthorized alterations in certificate stores, leading to delayed detection and vulnerability.
Innovation Solution
A system and method that tracks changes in the file system or system registry of a device's certificate store, detects alterations, and compares certificate information to known certificates using hashes or N-dimensional vectors formed from attributes, determining the status of the certificate and identifying unauthorized alterations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional detection methods (CertLock, MITM) are used to detect unauthorized access, then detection capability is provided, but detection speed is too slow and response time is delayed
Solution Approach 1:
The system performs preliminary actions by continuously monitoring and tracking changes in the certificate store before unauthorized alterations can cause harm. The monitoring module is set up in advance to detect modifications, additions, or deletions of certificates, enabling real-time detection rather than post-incident analysis. This preliminary monitoring approach allows the system to identify attacks as they occur, significantly reducing detection time while maintaining high detection capability.
2Measurement precision
If certificate store monitoring is implemented to detect unauthorized alterations, then security detection accuracy is improved, but system complexity increases
Solution Approach 1:
The system is segmented into distinct functional modules: a monitoring module that tracks certificate store changes, an analysis module that evaluates the changes, and a database module that stores certificate information. This segmentation allows each module to perform its specific function efficiently, improving detection accuracy while managing system complexity through modular design. The monitoring module specifically tracks changes in the file system or system registry related to the certificate store, enabling precise detection without requiring the entire system to be overly complex.
Solution Approach 2:
The patent introduces an intermediary analysis module that acts as a mediator between the monitoring module and the certificate store. This intermediary processes and analyzes the raw change data, comparing it against known certificate patterns and behaviors. By inserting this intermediary layer, the system achieves high detection accuracy through sophisticated analysis while keeping the overall system complexity manageable through clear separation of concerns and standardized interfaces between modules.
3Speed
If real-time tracking of certificate store changes is performed, then detection speed is improved, but computational resources and system load increase
Solution Approach 1:
The monitoring module implements partial monitoring by focusing specifically on changes within the certificate store and related file system or system registry entries, rather than monitoring all system activities. This selective approach enables real-time detection speed for certificate-related events while avoiding the excessive computational resource consumption that would result from comprehensive system-wide monitoring. The system applies monitoring resources proportionally to the actual security risk area.
Data Source
Figure 1
Figure 1a
Figure 2
AI summary
Disclosed herein are systems and methods for detecting unauthorized alteration with regard to a certificate store. An exemplary method comprises: tracking changes in a file system or a system registry of an operating system of a device with regard to the certificate store, detecting an alteration or an attempted alteration with regard to the certificate and sending information about the alternation or the attempted alteration to an analysis module, obtaining information about at least one certificate with which a change in the file system or the system registry with regard to the certificate store is connected, and determining a class of the change, where the class of the change is determined from a portion of the respective system registry or the file system in which the change occurred and from an action associated with the change, and comparing the obtained information to similar information on known certificates.