Electronic Device MITM Detection via Network Hop Count Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting man-in-the-middle (MITM) attacks are inadequate as they can be circumvented, and there is a need for a detection method that can identify various types of MITM attacks without being limited to specific scenarios, ensuring the security of network communications.
Innovation Solution
An electronic device that determines the existence of a MITM attack by confirming network reachability by identifying the number of hops in the network path between the device and a server, attempting communication on a smaller number of hops than identified, and providing a notification or ending the connection if a MITM attack is detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If existing MITM detection methods are used, then detection capability is limited to specific scenarios, but adaptability to various MITM attack types is insufficient
Solution Approach 1:
The patent implements a universal detection mechanism that identifies MITM attacks by verifying network path consistency through hop count comparison. This single approach handles multiple attack scenarios including SSL strip, SSL strip+, and SSL split attacks, making the detection system adaptable to various MITM attack types without requiring scenario-specific detection logic
Solution Approach 2:
The patent changes the detection parameter from application-layer protocol analysis to network-layer hop count measurement. By comparing the hop count of the actual communication path against the pre-measured baseline path, the system detects MITM attacks regardless of the specific attack method, achieving broad adaptability through a simple parameter-based approach
2Measurement precision
If network path verification is performed by measuring actual communication hops, then detection accuracy is improved, but communication overhead and detection time increase
Solution Approach 1:
The patent performs the network path measurement action in advance by measuring and storing the baseline hop count between the electronic device and the server before normal communication begins. This preliminary measurement allows for rapid MITM detection during actual communication by simply comparing the current hop count against the pre-stored baseline, avoiding time-consuming measurements during critical communication moments
Solution Approach 2:
The patent creates a copy of the normal network path characteristics by measuring and storing the baseline hop count. This copied path information serves as a reference template that enables rapid comparison and detection without requiring real-time reconstruction of the network path, thus maintaining high detection accuracy while minimizing detection time
Data Source
AI summary
An electronic device and a control method thereof are provided. The electronic device includes an Internet protocol (IP) address corresponding to a domain name of a web page when a user command inputting the domain name is received, identifies a number of hops included in a network path connecting a server corresponding to the obtained IP address and the electronic device to each other, and determines that a man-in-the-middle attack exists in a network when a communication connection with the server is established on the basis of a smaller number of hops than the identified number of hops.