System and method for protection of computer networks against man-in-the-middle attacks

1. A method of detection, by at least one processor, of an attack on a computer network comprising a plurality of nodes, the method comprising:

associating the plurality of nodes with each other in a distributed ledger configuration;

producing, by a requesting node of the plurality of nodes, a request to set a value of at least one key derivation parameter;

performing a vote of confidence among a subset of the plurality of nodes regarding the validity of the request; and

detecting an attack on at least one node of a plurality of nodes according to the vote of confidence

loading to each of the plurality of nodes a master key;

deriving, by a first node, a secure key according to the master key and according to a key derivation parameter stored on a local copy at the first node of the distributed ledger;

encrypting, by the first node, a message according to the derived key;

sending the encrypted message, alongside an identification of the distributed ledger entry, to an at least one second node in the network;

requesting, by the at least one second node, a vote of confidence from the subset of nodes, regarding the validity of the key derivation parameter value in the identified distributed ledger entry;

if the vote of confidence passes then deriving, by the second node, a secure key according to the key derivation parameter value and deciphering the encrypted message;

if the vote of confidence fails then identifying the key derivation parameter value as pertaining to a suspected attack on the computer network and performing at least one preventive measure thereupon.

2. The method of claim 1 , wherein the attack is one of a man-in-the-middle (MITM) attack, a selected key attack and a targeted key attack.

3. The method of claim 1 , further comprising loading to each of the plurality of nodes a proprietary private node key, and wherein producing a request to set a value of at least one key derivation parameter by a first node comprises:

selecting a value of at least one key derivation parameter;

sending a request message to the plurality of nodes other than the first node; and

signing the request message with the proprietary private node key.

4. The method of claim 3 , wherein at least one second node is configured to:

validate the requesting node's signature of the request; and

store the key derivation parameter value in an entry of a local copy stored at the second node of the distributed ledger, based on the validation.

5. The method of claim 1 , wherein the preventive measures are selected from a list comprising: producing a notification regarding the suspected attack, blocking at least one message originating from the first node, quarantining at least one message originating from the first node, and producing, by a node other than the first node, a request to change a value of the at least one key derivation parameter.

6. The method of claim 1 , wherein the computer network comprises a plurality of separate entities of homogenous network topology, each entity comprising one or more nodes, and wherein the nodes of all entities are associating in a distributed ledger configuration.

7. The method of claim 6 , wherein at least one first node of a first homogenous network entity is communicatively connected to at least one second node of a separate, second homogenous network entity over a secure connection.

8. The method of claim 7 , wherein the at least one first node and the at least one second node are implemented as nodes in a Virtual Private Network (VPN), and wherein the secure network connection is performed over the computer network.

9. The method of claim 7 , wherein the at least one first node and the at least one second node are communicatively connected by a secure network connection separate from the computer network.

10. The method of claim 6 , wherein the computer network comprises at least one processing center, separate from the plurality of entities of homogenous network topology, and wherein producing a request to set a value of at least one key derivation parameter is performed by the processing center.

11. A system for detection of an attack on a computer network comprising a plurality of nodes, wherein each node comprises:

a non-transitory memory device, wherein modules of instruction code are stored and

a processor associated with the memory device, and configured to execute the modules of instruction code, whereupon execution of said modules of instruction code, the processor is configured to:

associate the plurality of nodes with each other in a distributed ledger configuration;

produce, by a requesting node of the plurality of nodes, a request to set a value of at least one key derivation parameter;

perform a vote of confidence among a subset of the plurality of nodes regarding the validity of the request; and

detecting an attack on at least one node of a plurality of nodes according to the vote of confidence

load to each of the plurality of nodes a master key;

derive, by a first node, a secure key according to the master key and according to a key derivation parameter stored on a local copy at the first node of the distributed ledger;

encrypt, by the first node, a message according to the derived key;

send the encrypted message, alongside an identification of the distributed ledger entry, to an at least one second node in the network;

request, by the at least one second node, a vote of confidence from the subset of nodes, regarding the validity of the key derivation parameter value in the identified distributed ledger entry;

if the vote of confidence passes then deriving, by the second node, a secure key according to the key derivation parameter value and deciphering the encrypted message;

if the vote of confidence fails then identifying the key derivation parameter value as pertaining to a suspected attack on the computer network and performing at least one preventive measure thereupon.

12. The system of claim 11 , wherein the attack is one of an MITM attack, a selected key attack and a targeted key attack.

13. The system of claim 11 , wherein each of the plurality of nodes is loaded with a proprietary private node key, and wherein at least one processor of a first node is configured to produce a request to set a value of at least one key derivation parameter by:

selecting a value of at least one key derivation parameter;

sending a request message to the plurality of nodes other than the first node; and

signing the request message with the proprietary private node key.

14. The system of claim 13 , wherein at least one processor of at least one second node is configured to:

validate the requesting node's signature of the request; and

store the key derivation parameter value in an entry of a local copy stored at the second node of the distributed ledger, based on the validation.

15. The system of claim 11 , wherein at least one processor is configured to perform at least one preventive measure, selected from a list comprising:

producing a notification regarding the suspected attack;

blocking at least one message originating from the first node;

quarantining at least one message originating from the first node; and

producing, by a processor of a node other than the first node, a request to change a value of the at least one key derivation parameter.

16. The system of claim 11 wherein the computer network comprises a plurality of separate entities of homogenous network topology, each entity comprising one or more nodes, and wherein the nodes of all entities are associating in a distributed ledger configuration.

17. The system of claim 16 , wherein at least one first node of a first homogenous network entity is communicatively connected to at least one second node of a separate, second homogenous network entity over a secure connection.

18. The method of claim 16 , wherein the computer network comprises at least one processing center, separate from the plurality of entities of homogenous network topology, and wherein producing a request to set a value of at least one key derivation parameter is performed by the processing center.

19. A method of detection, by at least one processor, of an attack on a computer network comprising a plurality of nodes, the method comprising:

creating a distributed ledger recording transactions among the plurality of nodes;

creating, by at least one node, a request to set a value of at least one key derivation parameter;

voting, among a subset of the plurality of nodes, whether or not the request is valid;

detecting an attack if the outcome of the vote is that the request is not valid

loading to each of the plurality of nodes a master key;

deriving, by a first node, a secure key according to the master key and according to a key derivation parameter stored on a local copy at the first node of the distributed ledger;

encrypting, by the first node, a message according to the derived key;

sending the encrypted message, alongside an identification of the distributed ledger entry, to an at least one second node in the network;

requesting, by the at least one second node, a vote of confidence from the subset of nodes, regarding the validity of the key derivation parameter value in the identified distributed ledger entry;

if the vote of confidence passes then deriving, by the second node, a secure key according to the key derivation parameter value and deciphering the encrypted message;

if the vote of confidence fails then identifying the key derivation parameter value as pertaining to a suspected attack on the computer network and performing at least one preventive measure thereupon.