Payload Integrity Validation via Distributed Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based security services and DDoS mitigation systems acting as man-in-the-middle entities may compromise or modify network traffic payloads when intercepting flows, especially during DDoS attacks, making it difficult to ensure payload integrity across multiple proxies.
Innovation Solution
Implementing a computer-implemented method using a permissioned distributed database, such as a blockchain, where clients, servers, and proxies compute and store hashes of network traffic payloads, allowing for validation and identification of any modifications or tampering by comparing hashes across entities in the transit path.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud-based security services and DDoS mitigation systems intercept or proxy network traffic flows for security inspection, then security monitoring and threat mitigation capabilities are improved, but payload integrity may be compromised or modified by man-in-the-middle entities
Solution Approach 1:
The system performs preliminary hashing of the original payload before it passes through proxy entities. This hash is stored in a distributed database before any potential modifications can occur, enabling later verification of payload integrity without requiring real-time intervention in the traffic flow.
Solution Approach 2:
A distributed database acts as an intermediary between the client and server, storing hash values that serve as reference points for verifying payload integrity. This mediator allows security inspection through proxies while providing a mechanism to detect and identify any unauthorized modifications.
2Reliability
If traffic is steered to DDoS mitigation providers during attacks, then DDoS mitigation effectiveness is improved, but payload modification risk increases due to multiple proxy entities in the transit path
Solution Approach 1:
The system implements feedback by comparing the original hash (stored before mitigation) with the hash of the received payload after mitigation. This feedback mechanism enables verification that the DDoS mitigation process did not inadvertently modify the payload, providing confidence in both mitigation effectiveness and payload integrity.
Solution Approach 2:
The hash of the original payload is computed and stored in the distributed database before the traffic is steered to the DDoS mitigation provider. This preliminary action creates a reference point that enables later verification without requiring changes to the mitigation process itself.
3Adaptability or versatility
If private keys are conveyed to alternate DDoS mitigation providers for dynamic mitigation delegation, then DDoS response flexibility is improved, but security risk increases due to key exposure
Solution Approach 1:
The system extracts the critical verification function (hashing) from the key management process. By using cryptographic hashing of the payload, the system achieves verification capability without requiring private keys to be present or exchanged, thereby separating security verification from key exposure risks.
Data Source
AI summary
In a network that includes a client, a server and one or more proxy entities that intercept network traffic between the client and the server, a computer-implemented method is provided including: establishing trust with a permissioned distributed database; computing hashes from packet payloads of network traffic originated, intercepted or received; storing the hashes to the permissioned distributed database so that the permissioned distributed database maintains hashes computed from packets of the network traffic originated, intercepted or received by the client, server and the one or more proxy entities; and validating the hashes by comparing, with each other, the hashes stored to the permissioned distributed database by the client, server and the one or more proxy entities to determine whether any packet payload of the network traffic was modified in transit.