Transport layer security session man-in-the-middle attack prevention
AssigneeInternational Business Machines Corporation
InventorsWei-Hsiang Hsiung, Sheng-Tung Hsu, Kuo-Chun Chen, Chih-Hung Chou
Life of this patent
Estimating the term…
Abstract
Preventing Transport Layer Security session man-in-the-middle attacks is provided. A first security digest generated by an endpoint device is compared with a second security digest received from a peer device. It is determined whether a match exists between the first security digest and the second security digest based on the comparison. In response to determining that a match does not exist between the first security digest and the second security digest, a man-in-the-middle attack is detected and a network connection for a Transport Layer Security session is terminated with the peer device.
Claims16
A method for preventing Transport Layer Security session man-in-the-middle attacks, the method comprising:
- comparing a first security digest generated by an endpoint device with a second security digest received from a peer device;
- determining whether a match exists between the first security digest and the second security digest based on the comparing;
- responsive to determining that a match does not exist between the first security digest and the second security digest, detecting a man-in-the-middle attack and terminating a network connection for a Transport Layer Security session with the peer device;
- selecting a segment of Transport Layer Security data corresponding to the Transport Layer Security session;
- sending information regarding selection of the selected segment of Transport Layer Security data to the peer device via the network connection;
- and
- generating the first security digest based on both a hash of a retrieved correct answer to a CAPTCHA puzzle and the selected segment of Transport Layer Security data corresponding to the Transport Layer Security session.
A computer system for preventing Transport Layer Security session man-in-the-middle attacks, the computer system comprising:
- a bus system;
- a storage device connected to the bus system, wherein the storage device stores program instructions;
- and
- a processor connected to the bus system, wherein the processor executes the program instructions to:
- compare a first security digest generated by the computer system with a second security digest received from a peer device;
- determine whether a match exists between the first security digest and the second security digest based on comparing the first security digest and the second security digest;
- detect a man-in-the-middle attack and terminate a network connection for a Transport Layer Security session with the peer device in response to determining that a match does not exist between the first security digest and the second security digest;
- select a segment of Transport Layer Security data corresponding to the Transport Layer Security session;
- send information regarding selection of the selected segment of Transport Layer Security data to the peer device via the network connection;
- and
- generate the first security digest based on both a hash of a retrieved correct answer to a CAPTCHA puzzle and the selected segment of Transport Layer Security data corresponding to the Transport Layer Security session.
A computer program product for preventing Transport Layer Security session man-in-the-middle attacks, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:
- comparing a first security digest generated by the computer with a second security digest received from a peer device;
- determining whether a match exists between the first security digest and the second security digest based on the comparing;
- responsive to determining that a match does not exist between the first security digest and the second security digest, detecting a man-in-the-middle attack and terminating a network connection for a Transport Layer Security session with the peer device;
- selecting a segment of Transport Layer Security data corresponding to the Transport Layer Security session;
- sending information regarding selection of the selected segment of Transport Layer Security data to the peer device via the network connection;
- and
- generating the first security digest based on both a hash of a retrieved correct answer to a CAPTCHA puzzle and the selected segment of Transport Layer Security data corresponding to the Transport Layer Security session.
Dependencies are inferred from the claim text.