Emulated System Detection via Variable Difficulty Challenges
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer system security methods, such as device fingerprinting, are inadequate in detecting emulated computer systems used for unauthorized access, as malicious actors can mimic legitimate systems, leading to potential account takeovers.
Innovation Solution
A method that involves challenging client systems with computational tasks tailored to their reported technical features, allowing the server to determine if the system is emulated by comparing response times and performance metrics, thereby distinguishing between emulated and physical systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If device fingerprinting is used to identify client systems, then access control is improved, but emulated systems can still mimic legitimate systems and bypass detection
Solution Approach 1:
The server performs preliminary actions by providing computational challenges to client systems before granting access. These challenges are designed to expose the actual computational capabilities of the client, allowing the server to detect emulated systems in advance. The challenge-response mechanism enables the server to verify whether the client's reported technical features match its actual performance capabilities.
Solution Approach 2:
The invention changes the parameter being measured from static device fingerprinting data to dynamic computational performance metrics. By challenging clients with computational tasks and measuring their actual performance (execution time, processing speed), the server can detect discrepancies between reported and actual capabilities, thereby identifying emulated systems that would pass static fingerprinting checks.
2Difficulty of detecting and measuring
If computational challenges are provided to all client systems, then emulated system detection is improved, but system complexity and processing overhead increase
Solution Approach 1:
The server applies computational challenges selectively rather than universally. Challenges are provided to clients based on risk assessment criteria such as unrecognized device fingerprints, suspicious access patterns, or high-value targets. This partial application reduces overall system complexity and processing overhead while maintaining effective detection capability for suspicious systems.
Solution Approach 2:
The computational challenge acts as an intermediary mechanism between device fingerprinting and access authorization. Rather than directly trusting or rejecting clients based on fingerprinting alone, the challenge-response process serves as a mediating verification step that provides additional information about client authenticity without completely blocking legitimate access.
3Measurement precision
If computational challenges with variable difficulty are used, then detection accuracy is improved, but the time required for authentication increases
Solution Approach 1:
The computational challenge difficulty is made dynamic rather than static. The server adjusts challenge difficulty based on client responses, risk assessments, and detected patterns. Legitimate clients may face easier challenges that can be solved quickly, while suspicious clients may face progressively harder challenges that reveal their emulated nature. This dynamic adjustment maintains detection accuracy while minimizing authentication time for legitimate users.
Solution Approach 2:
The system uses multiple challenge instances with varying difficulty levels that can be discarded after use. Rather than relying on a single time-consuming challenge, the server can present a sequence of challenges with different computational costs, using cheaper/easier challenges for verification and reserving more expensive/difficult challenges for suspected emulated systems.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
Techniques are disclosed relating to detecting that a client system is an emulated computer system based on its computational performance of one or more challenge problems. In some embodiments, a server computer system may receive, from a client system, a request to access a web service. The server computer system may determine reported technical features of the client system and select a particular challenge problem to provide to the client system. The server computer system may determine an expected response time of the particular challenge problem for the client system. The server computer system may receive a challenge response from the client system that includes a proposed solution to the particular challenge problem. The server computer system may then determine whether to authorize the request based on a measured response time by the client system and the expected response time of the particular challenge problem for the client system.