NTLM Relay Attack Detection via Target Name Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized authentication protocols, such as Windows NT LAN Manager (NTLM), are susceptible to relay attacks where a compromised server intercepts and reuses authentication requests to gain unauthorized access to other devices on a network, bypassing access permissions.
Innovation Solution
A system and method that intercepts and verifies network packets containing authentication requests, decrypts attribute-value pairs to identify target devices, and blocks requests if the target name does not match the device name, using a relay detection device with a networking module, SPN translator, and IP address translator to validate the authenticity of NETLOGON and NTLM protocol messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized authentication protocols (NTLM) are used to verify user identities and enforce access permissions, then network security and access control are improved, but the system becomes susceptible to relay attacks where compromised servers can intercept and reuse authentication requests
Solution Approach 1:
The patent performs preliminary verification of the target device name in the authentication request before allowing access. The system extracts and validates the target device name against the actual target device identifier in advance, preventing relay attacks by detecting mismatches before authentication is completed. This preliminary check blocks malicious relayed requests that attempt to authenticate to unauthorized devices.
2Productivity
If authentication requests are processed without verification of target device identity, then processing speed and simplicity are maintained, but unauthorized access through relay attacks is enabled
Solution Approach 1:
The patent extracts the target device name from the authentication request attributes and separates it from the authentication processing flow. By isolating and independently verifying the target device identity, the system adds a security check that operates in parallel with the authentication process, minimizing impact on processing speed while ensuring reliable access control.
3Object-affected harmful factors
If the system validates target device names by comparing with device identifiers and blocking mismatched requests, then relay attack prevention is improved, but additional processing steps increase system complexity
Solution Approach 1:
The patent utilizes the target device name information that is already present in the authentication request attributes. Instead of requiring external verification systems or additional communication with target devices, the system performs self-validation by comparing the extracted target device name with the actual target device identifier from the request metadata. This self-service approach prevents relay attacks without significantly increasing system complexity.
Data Source
AI summary
A method is provided for verifying an authentication request to a computer network. The method may include receiving a network packet and extracting an authentication request from the network packet. The authentication request may be encrypted to store attribute-value pairs, and the method may further include decrypting the authentication request to access the attribute-value pairs. The method may also include extracting a target name and a device name from the attribute-value pairs, wherein the device name indicates an identified target device, and determining whether the target name refers to the identified target device identified by the device name.