Encrypted Authentication Protocol Detection via Packet Size Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer security, pass-through authentication protocols often rely on legacy protocols that are susceptible to security risks and vulnerabilities, making it difficult to maintain domain security, especially when the network logon protocol used in authentication requests is encrypted and difficult to identify.
Innovation Solution
A protocol detection engine pairs events with network packets to estimate the size of the challenge response embedded in encrypted packets, determining the network logon protocol used, and takes actions to deter the use of legacy protocols by identifying their use based on the response size.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pass-through authentication uses encrypted network packets to protect security, then security protection is improved, but protocol identification becomes difficult
Solution Approach 1:
The patent uses packet size as an intermediary characteristic to identify encrypted authentication protocols. Since the authentication protocol data is encrypted and cannot be directly read, the system measures the size of the encrypted packets as a proxy indicator. Different authentication protocols produce characteristic packet size patterns, allowing identification without decrypting the actual authentication data.
Solution Approach 2:
The patent changes the measurement parameter from attempting to read encrypted protocol content to measuring packet size characteristics. By analyzing variations in packet size across multiple authentication requests, the system can identify the underlying protocol type without compromising security or requiring decryption capabilities.
2Ease of operation
If legacy authentication protocols are used for compatibility, then ease of operation is improved, but security vulnerabilities increase
Solution Approach 1:
The patent implements a feedback mechanism that monitors authentication protocol usage in real-time. By detecting which protocols are being used through packet size analysis, the system can provide feedback to administrators about legacy protocol usage and enable policy enforcement to transition to more secure protocols while maintaining necessary compatibility.
Solution Approach 2:
The system performs preliminary detection of authentication protocol types before security policies are enforced. By identifying legacy protocols in advance through packet size characteristics, the system can prepare appropriate security responses, such as blocking legacy protocol attempts or alerting administrators before security incidents occur.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The network logon protocol used in a pass-through authentication request embedded in an encrypted network packet is identified. A protocol detection engine correlates events and network requests received at a domain controller in order to use the data contained in a correlated pair to determine a size of a challenge response in the encrypted network packet. The size of the response is used to identify the network logon protocol used in the pass-through authentication request.