Skip to content

Release 0.2.0

Choose a tag to compare

View all tags
@anonympins anonympins released this 26 Aug 05:54
· 37 commits to main since this release
fingerprint-0.2.0
ae6f9f9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changelog

  • isApiRequest / isStaticResource](1813021)

Cryptographic Binding of the Solver Fingerprint to the Proof of Work

To counter sophisticated attacks where a bot might offload challenge solving to a server farm (workers), we have introduced a new security layer. The system now cryptographically binds the digital fingerprint of the machine solving the challenge to the solution itself.

Technical Details

  1. Client Side (Solver):
  • The solver (pow.solver.inline.js) now generates the client machine's fingerprint.
  • This fingerprint is included in the message hashed for the Proof of Work (PoW) when clientSecret is used.
  • Upon solution submission, the solver fingerprint is sent to the server via a new URL parameter: pow_fp.
  1. Server Side (Verification):
  • When issuing a challenge, the server stores the digital fingerprint of the original request within the challenge context.
  • Upon receiving a solution, the server performs a double check:

  1. Consistency Check: It compares the solver fingerprint (pow_fp) with the stored original fingerprint. If they do not match, validation fails immediately. This blocks attempts to solve the challenge on a remote machine.

  2. Cryptographic Verification: If the fingerprints match, the solver fingerprint is included in the hash recalculation to validate the Proof of Work, ensuring the solution was indeed calculated using the correct fingerprint.

  3. Unit Test Updates:

  • Tests simulating challenge solving have been updated to include the solver fingerprint in hash calculations and submission requests. * Tests setting up a challenge context within the mocked store now include the expected fingerprint.

Impact

This change significantly increases the system's robustness. It ensures that the Proof-of-Work "effort" is actually performed by the client machine that initiated the request, rendering parallelization attacks using external servers ineffective and much more costly to implement.

Feature: Useful Proof-of-Work (U-PoW)

This update introduces a new challenge mechanism called "Useful Proof-of-Work" (U-PoW), which can be enabled via the enableUsefulWork: true flag in the security configuration.

Instead of making the client's browser perform computationally expensive but otherwise useless hash calculations, U-PoW leverages the client's processing power to contribute to solving complex optimization problems that are beneficial to the platform.

How It Works

  1. Dynamic Challenge Issuance: When a request is flagged as suspicious, the system can now randomly issue a U-PoW challenge instead of a traditional PoW. This makes bot automation more difficult, as attackers cannot predict the type of challenge they will receive.

  2. Problem Dispatching: The server maintains a pool of complex problems (e.g., Traveling Salesperson Problem, Portfolio Optimization) via a problemManager. When a U-PoW challenge is needed, the manager dispatches a small, discrete unit of work to the client. The difficulty and size of the work unit are proportional to the request's suspicion score.

  3. Client-Side Computation: The client's browser receives the work unit and uses its own CPU resources to perform the calculations. This is handled by the solveUsefulWorkTask function in the client-side solver. The client-side library includes lightweight versions of advanced optimization algorithms (like Simulated Annealing and Genetic Algorithms) to solve these tasks.

  4. Solution Integration: Once the computation is complete, the client sends the result back to the server. The server then integrates this partial solution into the main problem being solved, advancing it towards a final, optimal solution.

  5. Verification and Clearance: If the submitted work is valid, the client is granted a clearance ticket, just like with a standard PoW, and their original request is allowed to proceed.

Key Benefits

  • Resource Monetization: Turns the cost of bot mitigation into a productive asset. The CPU cycles of suspicious clients are harnessed to solve real business or research problems, effectively creating a distributed computing network.
  • Enhanced Security: The variety of challenge types (standard PoW vs. different U-PoW tasks) significantly increases the complexity and cost for bot developers, as they must implement solvers for multiple, non-trivial algorithms.
  • Scalable Problem Solving: The system is designed to manage and aggregate solutions for large-scale optimization problems, making it suitable for tasks that would be too costly to run on a single server.

New Components

  • problem-manager.js: A new server-side module responsible for managing the lifecycle of optimization problems, dispatching work units, and integrating solutions.
  • solveUsefulWorkTask (in pow.solver.js): A new client-side function that acts as a router to solve various types of optimization tasks sent by the server.
Assets 2
Loading