Identifier-Based Application Security via Digital Fingerprinting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Securing computer systems and applications against unauthorized access, particularly when attackers use valid credentials, is challenging due to the difficulty in detecting and managing malicious activities.
Innovation Solution
An identifier-based security system uses digital fingerprints to differentiate between legitimate and malicious sessions, directing potentially malicious users to cloned sessions with fabricated data while alerting authorized users to compromised credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional credential-based authentication is used, then authorized users can access applications, but attackers with stolen credentials can also gain unauthorized access
Solution Approach 1:
The authentication process is segmented into multiple independent verification layers: credential validation, device fingerprinting, behavioral analysis, and session monitoring. Each layer operates independently to assess different aspects of authentication risk, allowing the system to distinguish between legitimate and malicious users even when credentials are compromised.
Solution Approach 2:
A proxy server acts as an intermediary between users and the application, intercepting and analyzing all authentication requests. The proxy performs device fingerprinting, credential verification, and session management, mediating between the user's authentication attempt and the application's access control without requiring changes to the application itself.
2Reliability
If security measures are implemented to detect malicious activity, then unauthorized access can be prevented, but legitimate user experience may be degraded
Solution Approach 1:
Different security measures are applied locally based on specific risk indicators rather than uniformly to all users. Device fingerprinting is performed only when needed, behavioral analysis is triggered by suspicious actions, and session cloning is activated only for high-risk threats. This localized approach minimizes impact on legitimate users while maintaining strong security where needed.
Solution Approach 2:
When malicious activity is detected, the system creates a cloned session that replicates the application interface and functionality. The attacker's session is copied and isolated in a sandboxed environment, allowing continued monitoring and analysis without affecting the legitimate user's actual session. This copying mechanism prevents disruption to authorized users while containing threats.
3Reliability
If attackers are blocked immediately upon detection, then security is improved, but attackers may be alerted and change tactics
Solution Approach 1:
The system performs preliminary device fingerprinting and behavioral baseline establishment before malicious activity is detected. Device characteristics, browsing patterns, and interaction styles are captured and stored as baseline profiles during normal usage. When suspicious activity occurs, these pre-collected baselines enable immediate comparison and detection without requiring interruptive verification steps that would alert attackers.
Solution Approach 2:
The system converts the attacker's malicious actions into beneficial security data. When attackers attempt unauthorized operations, these actions are monitored and analyzed to improve detection algorithms, update threat signatures, and refine behavioral baselines. The harmful activity generates valuable intelligence that strengthens the system's ability to detect and prevent future attacks while maintaining undetected operation.
Data Source
AI summary
Systems, methods, and computer media for securing software applications are provided herein. Through the use of an identifier such as a digital fingerprint, application sessions or session requests that use the same credentials can be distinguished, and malicious users can be detected and managed. A request to establish a session with an application can be received. Based on a digital fingerprint associated with the request, it can be determined that although a credential included in the request is valid, the request is unauthorized by comparing the digital fingerprint to known malicious fingerprints. When the fingerprint is found to be malicious, a cloned application session having at least partially fake data can be established instead of the requested application, thus limiting an attacker's access to real application data without revealing to the attacker that the attack has been detected.