Usage Data Rollback Detection via Sequence Number Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems are vulnerable to 'rollback' attacks, where users can circumvent usage limits by restoring usage data to an earlier state, allowing repeated resource usage despite reaching the intended limit, which is difficult to prevent especially in centralized licensing systems.
Innovation Solution
A method involving saving usage data with a sequence number in both fast, accessible storage and protected, inaccessible storage, comparing these values to detect rollback or tampering, and taking measures to prevent unauthorized changes, such as encryption or hashing, to ensure compliance with usage limits.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If usage data is saved in fast, easily accessible storage, then ease of operation and speed are improved, but vulnerability to rollback attacks increases
Solution Approach 1:
The patent creates a copy of the sequence number and stores it in protected storage that is inaccessible to users. This copy serves as a reference to detect rollback attacks, while the main usage data remains in fast storage for easy access during normal operation.
Solution Approach 2:
The sequence number acts as an intermediary element between the usage data and the detection mechanism. It provides a verifiable reference point that enables rollback detection without requiring direct access to or modification of the protected usage data.
2Reliability
If usage data is hidden in protected storage, then security against rollback attacks is improved, but speed of access and ease of operation deteriorate
Solution Approach 1:
The patent segments the storage system into two distinct parts: fast storage for usage data that requires frequent access, and protected storage for the sequence number copy that requires infrequent access. This segmentation allows each part to be optimized for its specific access pattern.
Solution Approach 2:
The critical security element (the sequence number copy) is extracted from the main usage data storage and placed in a separate protected storage location. This extraction isolates the security reference from the operational data, protecting it from user access while maintaining fast access to the usage data itself.
3Measurement precision
If sequence number is frequently saved to protected storage, then detection capability is improved, but burden on license server and system performance worsen
Solution Approach 1:
Instead of continuously or frequently writing to protected storage, the system uses periodic action by only writing the sequence number copy to protected storage when necessary (e.g., when usage limits are approached or at scheduled intervals). This reduces the burden on the license server while maintaining adequate detection capability.
Solution Approach 2:
The sequence number is预先 calculated and prepared in advance, allowing the system to batch updates to protected storage rather than performing frequent individual write operations. This preliminary preparation reduces the total number of server operations required.
Data Source
AI summary
In an embodiment of a method of and system for detecting rollback of usage data, the usage data is recording in a database. A sequence value in the database is repeatedly advanced. A copy of the sequence value is repeatedly saved to protected storage. The copy of the sequence value in the protected storage is compared with the sequence value in the database, and it is determined whether the result of the comparison is consistent with normal operation of the database since the previous save to protected storage.