Method and device for detecting compromise of a target by a side attack
AssigneeWallix
InventorsMeng Tan, Serge Adda
Life of this patent
Estimating the term…
Abstract
A method for detecting a side attack of a target by a user comprising a step of recording data relating to a so-called sensitive file, the sensitive file being a configuration file of the target; a step of primary connection of the user on a proxy gateway to establish a secondary connection of the proxy gateway on the target; a step of verification of the integrity of the sensitive file, subsequently to the step of secondary connection of the proxy gateway on the target and when the integrity of the sensitive tile is determined as compromised by the step of verification of the integrity of the sensitive file, and a step of detection of a side attack of the target by the user.
Claims17
A method for detecting a side attack on a target by a user, the method comprising:
- establishing a primary connection between the user and a proxy gateway and establishing a secondary connection between the proxy gateway and the target;
- obtaining first data relating to at least part of a sensitive file before a user session is initiated between the user and the target, the sensitive file being a target configuration file;
- obtaining second data relating to at least part of the sensitive file responsive to termination of a user session between the user and the target;
- verifying integrity of the sensitive file by comparing the first data to the second data;
- and
- detecting a side attack of the target by the user responsive to determining that at least part of the first data is different from at least part of the second data.
A proxy gateway for detecting a side attack of a target by a user, comprising data processing circuitry configured to:
- establish a primary connection between the user and the proxy gateway to establish a secondary connection of between the proxy gateway and the target;
- obtain first data of at least part of a sensitive file before a user session is initiated between the user and the target, the sensitive file being a target configuration file;
- obtain second data of at least part of the sensitive file responsive to a termination of the secondary connection between the user and the proxy gateway;
- verify integrity of the sensitive file by comparing the first data to the second data;
- and
- detect a side attack of the target by the user responsive to determining that at least part of the first data is different from at least part of the second data.
Dependencies are inferred from the claim text.