preface

A few days ago, I discussed some ideas to prevent impersonation in complex network environment (there are potential attackers). I have some interesting ideas to share here. Of course, the easiest way to prevent impersonation is authentication. Passwords, tokens, sessions are essentially the same thing and vulnerable to an attacker. Here is a list of personal considerations.

Application level

If you don’t care about real time, you can consider multiple bidirectional asymmetric encryption.

  1. A periodically sends requests to B with an encrypted seed X, which is generated by the original seed Z randomly generated by A and encrypted by its own private key
  2. Before receiving the next request from A, B adds a piece of validation data Y to the instruction sent by A, which is then generated by B decrypting X with A’s public key.
  3. After receiving the data, A decrypts it with b’s public key first, and then checks whether the data Y is consistent with z, so that it can know whether B is real B.

The physical layer

Dedicated line + firewall should be the simplest and most direct physical protection

other

If you consider that B may be attacked, you can consider distributing B into multiple independent services, and then A can obtain instructions from multiple B and get the majority of the same.