Identity Theft Detection in Managed Systems Using Test Messages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managed computing systems face challenges in detecting identity theft or identity change, as changes in IP addresses can be mistaken for malicious activities or misconfigurations, leading to communication errors and potential security breaches.
Innovation Solution
A method that identifies matching unique identifiers between computing devices with different IP addresses, sends a test message, and alerts for potential malicious events or misconfigurations based on response receipt, involving digital certificate and credential comparisons to determine authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IP address changes are monitored without verification, then network security is maintained, but false alarms increase due to legitimate reconfigurations being mistaken for malicious activities
Solution Approach 1:
The system performs preliminary actions by sending test messages to the original IP address before finalizing the IP change detection. This preliminary verification step allows the system to distinguish between legitimate reconfigurations (where the device responds to the test message) and actual security threats (where no response is received), thereby reducing false alarms while maintaining security detection accuracy
Solution Approach 2:
The system implements feedback mechanisms by monitoring responses to test messages sent to original IP addresses. When a device legitimately changes its IP address, it will respond to the test message, providing feedback that confirms the change is authorized. This feedback loop enables the system to adjust its security alerts based on actual device behavior rather than relying solely on IP address changes, thus reducing false positives
2Object-affected harmful factors
If IP address changes are blocked without verification, then security breaches are prevented, but legitimate reconfigurations are hindered
Solution Approach 1:
The system introduces an intermediary verification process using test messages as a mediator between IP address change detection and security alert generation. Instead of directly blocking or alerting on IP changes, the system sends test messages to verify whether the change is legitimate. This intermediary step allows both security prevention and legitimate reconfiguration to coexist, as authorized changes will respond to test messages and be permitted
3Measurement precision
If unique identifier matching is performed without test message verification, then potential duplicates are identified, but communication errors increase due to false positive security alerts
Solution Approach 1:
The system performs preliminary unique identifier matching to identify potential duplicate devices, but then follows up with test message verification before generating security alerts. This two-stage approach allows the system to efficiently screen for duplicates using unique identifiers while using test messages as a preliminary verification step to confirm whether identified duplicates represent actual security threats or legitimate reconfigurations, thereby reducing false positive alerts and improving communication reliability
Data Source
AI summary
A method for detecting identity theft or identity change in managed computing systems is disclosed. An apparatus and computer program product also perform the functions of the method. The method includes identifying that a unique identifier of a first computing device assigned a first IP address matches a unique identifier of a second computing device assigned a second IP address and, in response to identifying that the unique identifier of the first computing device matches the unique identifier of the second computing device, sending a test message to the first computing device using the first IP address. The method includes sending an alert of a possible malicious event in response to receiving a response to the test message and sending an alert of a possible misconfiguration in response to a failure to receive a response to the test message.