Post-Attack Man-in-the-Middle Detection via Certificate Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures fail to effectively detect and mitigate man-in-the-middle (MITM) attacks, particularly when attackers fraudulently obtain valid public key certificates, allowing them to masquerade as domain owners and intercept communications without being easily detected.
Innovation Solution
A system where a client computer collects and stores data on public key certificates, including their origin, and uploads them to a server, which maintains a record of valid certificates from certification authorities. The server compares received certificates to identify fraudulent ones, taking appropriate actions such as notifying users or law enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public key certificates are used to verify server identity, then security against MITM attacks is improved, but attackers can still fraudulently obtain valid certificates and masquerade as domain owners
Solution Approach 1:
The system performs preliminary actions by collecting certificate data proactively from multiple sources (clients, servers, certificate authorities) before an attack occurs. This creates a baseline of legitimate certificates that can be used for later comparison to detect fraudulent certificates used in MITM attacks
Solution Approach 2:
A server acts as an intermediary between certificate authorities and clients, receiving certificate data from multiple sources and performing centralized comparison and validation. This intermediary consolidates certificate information and provides a coordination point for detecting fraudulent certificates across the network
2Ease of operation
If certificate validation is performed only at connection time, then ease of operation is improved, but detection of fraudulent certificates is delayed until after the attack has occurred
Solution Approach 1:
The system performs preliminary certificate collection and storage actions before attacks occur. Certificate data is gathered from multiple sources in advance and stored for future comparison, enabling post-attack detection without interfering with normal connection operations
Solution Approach 2:
The system maintains continuous collection and updating of certificate data from multiple sources. This ongoing process ensures that the latest certificate information is always available for comparison, enabling continuous detection capability while maintaining normal connection operations
3Measurement precision
If a centralized system collects and compares certificates from multiple sources, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The server performs multiple functions: it acts as a certificate collection point from clients and certificate authorities, a validation engine for comparing certificates, and a notification system for alerting about fraudulent certificates. This multi-functionality consolidates what would otherwise require separate systems into a single platform
Data Source
AI summary
Technologies are described herein for post attack man-in-the-middle detection. A first computer receives and stores public key certificates when connections are established. The first computer also uploads the stored public key certificates associated with a domain to a second computer each time a connection is established with the domain. The second computer receives the public key certificates from the first computer. The second computer then determines whether any of the public key certificates provided by the first computer are fraudulent certificates by comparing the received certificates to known valid certificates. If the second computer determines that the first computer has received one or more fraudulent certificates, the second computer may cause action to be taken with regard to the fraudulent certificates.