Intermediary Connection Detection Using Geolocation-Based RTT Thresholds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing VPN detection methods are inadequate for accurately and efficiently identifying intermediary connections, particularly VPNs, due to their ability to obfuscate client geolocation, leading to security vulnerabilities in services that rely on geolocation as a security factor.
Innovation Solution
A method that determines the client-server round-trip time and compares it to an expected value based on geolocation and propagation speed, using a threshold value to identify if a connection is routed through an intermediary connection, such as a VPN, by measuring TCP and TLS handshakes and considering the physical distance and geolocation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing passive VPN detection methods using IP databases and behavioral analysis are used, then detection capability is provided, but accuracy and robustness are insufficient for sensitive services
Solution Approach 1:
The detection process is segmented into multiple independent measurement components: TCP handshake RTT measurement, TLS handshake RTT measurement, and optional probe-based RTT measurement. Each segment measures a different aspect of the connection timeline, and their combination provides comprehensive detection accuracy that overcomes the limitations of any single measurement method.
Solution Approach 2:
Geolocated probes serve as intermediary elements between the server and the client. These probes measure RTT to the client's perceived location and provide a baseline for comparison. The probes act as mediators that enable indirect verification of whether the client is at the expected geolocation without requiring direct server-to-client geolocation measurement.
2Reliability
If VPN detection is implemented to improve security, then security standards are maintained, but user experience may be impacted
Solution Approach 1:
The system performs partial measurements by default (TCP and TLS handshake RTTs) and only performs additional probe-based measurements when necessary. The detection logic compares RTT differences and only triggers full detection protocols when anomalies are detected, thereby maintaining security standards while minimizing impact on normal user experience.
Solution Approach 2:
The detection mechanism changes parameters dynamically based on detected anomalies. When RTT differences exceed expected thresholds, the system adjusts its measurement parameters by initiating additional probe-based RTT measurements to confirm VPN usage, rather than continuously performing all measurements regardless of context.
3Reliability
If geolocation-based security measures are used, then security factors are provided, but VPN obfuscation circumvents these measures
Solution Approach 1:
Instead of trying to directly verify the client's true geolocation (which is obscured by VPN), the system inverts the approach by measuring the RTT from the client to multiple geolocated probes and comparing it against the expected RTT to probes near the perceived geolocation. This indirect verification method detects inconsistencies caused by VPN obfuscation without requiring direct geolocation revelation.
Solution Approach 2:
The system implements feedback loops where RTT measurements from probes provide continuous verification of client location consistency. When RTT measurements deviate from expected values based on geolocation, the system receives feedback indicating potential VPN usage and adjusts its security responses accordingly, maintaining geolocation-based security factors while detecting circumvention attempts.
Data Source
Figure 1a
Figure 1b
Figure 2
AI summary
There is disclosed a computer implemented method for detecting an intermediary connection in a network comprising receiving, at a server, perceived indication information of a client device, obtaining a geolocation associated with the perceived indication information, determining a client-server value based on a transmission time of a connection signal transmitted between the client device and the server, determining an expected value associated with the geolocation, establishing that a connection between the client device and server is routed through the intermediary connection if the client-server value exceeds a threshold value, the threshold value being at least partly based on the expected value.