Server Proxy Detection via Encrypted Key Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network systems face challenges in detecting proxy devices, which can compromise security by spoofing authorization and allowing insecure connections, leading to potential data breaches.
Innovation Solution
A computing device is configured to provide an encrypted key to a client device, detecting the absence or presence of a proxy device by matching decrypted key portions, and terminating communications if a mismatch is detected, ensuring secure connections without additional encryption techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL server certificates and client authentication are used for server validation, then security is improved, but proxy devices can still spoof authorization and compromise security
Solution Approach 1:
The patent applies preliminary action by performing key matching verification before establishing the communication connection. The server decrypts the first portion of the key using stored credentials and compares it with the received first portion. Only after this preliminary verification confirms no proxy device is present does the server proceed to encrypt and send the second portion of the key, thereby preventing proxy spoofing before it can compromise security.
Solution Approach 2:
The patent introduces an intermediary verification mechanism using key portions as mediators between the client and server. Instead of directly trusting SSL certificates, the system uses encrypted and decrypted key portions as an intermediate layer of verification. This intermediary key matching process detects the presence or absence of proxy devices, adding a security layer that prevents unauthorized connections while maintaining legitimate communication.
2Reliability
If additional encryption techniques are implemented to detect proxy devices, then security is improved, but server load increases
Solution Approach 1:
The patent applies segmentation by dividing the encryption key into two distinct portions: a first portion that is encrypted and sent to the client for decryption, and a second portion that remains on the server and is encrypted only if key matching succeeds. This segmentation allows the server to perform lightweight decryption and comparison operations on the first portion without the computational burden of encrypting and managing the entire key, thereby reducing server load while maintaining security.
Solution Approach 2:
The patent implements partial action by performing encryption operations only on the second portion of the key, and only when the first portion matches successfully. The server does not encrypt the entire key or perform full cryptographic operations unconditionally. Instead, it performs partial encryption of just the second portion based on the outcome of the initial key matching, thereby reducing unnecessary computational overhead and server load while maintaining adequate security measures.
Data Source
AI summary
A computing device may include a processor and a memory. The processor may be configured to provide an encrypted second portion of a key to a client device in response to a match between data decrypted from an encrypted first portion of the key and a first portion of the key, the match being indicative of an absence of a proxy device. The processor may be configured to detect a loss in connectivity between the computing device and the client device based upon a mismatch between a decrypted second portion of the key and a second portion of the key, the mismatch being indicative of the proxy device.