Hrithik.Security.Pro 1.2.0

Hrithik.Security.Pro

Enterprise-ready request signing and distributed replay protection middleware for ASP.NET Core.

Prevent replay attacks and forged API requests before they reach your business logic.

Hrithik.Security.Pro provides cryptographic request integrity, replay attack prevention, and tamper-resistant commercial licensing for high-trust API environments.

Designed to integrate seamlessly into the ASP.NET Core middleware pipeline without requiring an external API gateway.

---

Executive Summary

Modern distributed APIs require stronger guarantees than authentication alone.

Hrithik.Security.Pro enables:

• Deterministic HMAC request validation\
• Distributed replay attack prevention\
• Secret rotation without downtime\
• Constant-time signature comparison\
• RSA-signed commercial license enforcement

Built for internal APIs, B2B integrations, financial systems, and service-to-service architectures.

---

Security Capabilities

Request Integrity

• HMAC-SHA256 request signing
• Full body hash validation
• HTTP method + path binding
• Constant-time signature comparison (timing-attack safe)

Replay Protection

• Unique request ID enforcement
• Configurable timestamp skew validation
• In-memory or Redis-backed replay store
• TTL-based replay window control

Secret Management

• Multiple active secrets
• Versioned secret header (X-Secret-Version)
• Zero-downtime key rotation

Licensing Security

• RSA-signed license payload
• Application-bound enforcement
• Time-limited validation
• Tamper-resistant verification

---

🏗 Validation Pipeline

┌──────────────┐
│   Client     │
│ HMAC Sign    │
└──────┬───────┘
       │
       ▼
┌──────────────────────────────────┐
│ ReplayProtectionMiddleware       │
│                                  │
│ 1. License Validation            │
│ 2. Timestamp Validation          │
│ 3. Signature Verification        │
│ 4. Replay Store Check            │
└──────────────┬───────────────────┘
               │
               ▼
        ┌──────────────┐
        │  Controller  │
        └──────────────┘

Replay validation occurs before business logic, preventing tampered or replayed requests from reaching application code.

---

⚡ Performance Characteristics

Benchmarked on:

• .NET 8
• 4-core development machine
• 1KB JSON payload
• In-memory replay store

Observed:

• ~0.4--0.8ms average overhead per request\
• ~15,000--20,000 requests/sec (in-memory mode)\
• Redis-backed mode adds only network latency

Replay lookup is O(1).
Signature comparison uses fixed-time equality to prevent timing attacks.

Benchmarks are illustrative and may vary by environment.

---

Installation

dotnet add package Hrithik.Security.Pro

---

Minimal Configuration

builder.Services.AddHrithikSecurityPro(
    license =>
    {
        license.LicenseKey = "YOUR_LICENSE_KEY";
        license.AppName = "MyApi";
    },
    replay =>
    {
        replay.ValidSecrets.Add("PRIMARY_SECRET");
        replay.AllowedClockSkew = TimeSpan.FromMinutes(2);
        replay.ReplayEntryTtl = TimeSpan.FromMinutes(5);
        replay.MaxBodySizeBytes = 1_000_000;
    });

app.UseMiddleware<ReplayProtectionMiddleware>();

---

Distributed Deployment

builder.Services.AddRedisReplayStore("localhost:6379");

Recommended for multi-instance production deployments.

---

Observability & Operations

Health Checks

builder.Services.AddReplayStoreHealthCheck();
app.MapHealthChecks("/health");

Metrics

OpenTelemetry-compatible counters:

• replay_rejected_total
• invalid_signature_total
• expired_timestamp_total

---

When To Use This

Ideal for:

• Service-to-service authentication
• Fintech and payment APIs
• B2B integrations
• Webhook verification
• Internal distributed systems

---

When Not To Use This

Not recommended if:

• You rely exclusively on OAuth2/JWT and do not control the client
• HMAC validation is already enforced at an API Gateway
• Client-side signing cannot be implemented

---

Commercial Licensing

Hrithik.Security.Pro is distributed under a commercial license.

Pro Plan --- $99/year (per application)

Includes:

• Full middleware functionality
• Distributed Redis replay support
• Secret rotation features
• RSA-signed license enforcement
• Ongoing updates

Licenses are application-bound, non-transferable, and valid for 12 months.

💳 Purchase

🌍 International Customers

Pay securely via PayPal (USD $99 – yearly license):

👉 https://paypal.me/hrithikkalra/99

🇮🇳 Indian Customers

Please email hrithikkalra11@gmail.com to receive UPI / bank transfer payment options.

---

📩 License Activation

After payment, please email the following details to hrithikkalra11@gmail.com:

• Payment confirmation (PayPal transaction ID or payment reference)
• Company name
• Domain / Application name

You will receive your license key and shared secret within 24 hours.

Licenses are issued per company / per application, are non-transferable, and are valid for 12 months from the date of issue.

---

Security Model

Hrithik.Security.Pro – Security Model

This document explains the threat model, security guarantees, and architectural decisions behind Hrithik.Security.Pro.

---

1. Threat Model

Hrithik.Security.Pro is designed to protect ASP.NET Core APIs against:

• Replay attacks
• Request tampering
• Forged requests
• Delayed request re-submission
• Signature manipulation
• Secret rotation inconsistencies

The library assumes:

• HTTPS is enabled (TLS is mandatory)
• Clients possess a shared secret
• Server secrets are securely stored (e.g., environment variables, Azure Key Vault)

---

2. Replay Attack Protection

Attack Scenario

An attacker captures a legitimate signed HTTP request and replays it later to:

• Duplicate payments
• Re-submit transactions
• Trigger repeated operations

Mitigation Strategy

Each request must include:

• X-Request-Id
• X-Request-Timestamp
• X-Request-Signature

The system:

1. Validates timestamp within configured clock skew.
2. Validates cryptographic signature.
3. Checks replay store for existing RequestId.
4. Rejects duplicates within TTL window.

Replay entries are stored with configurable expiration (ReplayEntryTtl).

---

3. Timestamp Validation

Each request includes a Unix timestamp (UTC seconds).

The server enforces:

• Default ±2 minute skew (configurable)
• Requests outside the allowed window are rejected
• Prevents delayed replays

Rationale: A short time window significantly reduces replay viability while tolerating minor clock drift.

---

4. Signature Validation

Signature formula:

HMACSHA256(METHOD + PATH + BODY_HASH + TIMESTAMP, SECRET)

Security Properties:

• Protects against request body tampering
• Protects against method/path alteration
• Prevents signature reuse across endpoints
• Uses constant-time comparison to prevent timing attacks

Hex-encoded uppercase signature required.

---

5. Secret Rotation

Supports:

• Multiple active secrets
• Versioned secrets (X-Secret-Version header)
• Seamless migration from old → new secret

Benefits:

• No downtime during key rotation
• Backward compatibility during transition
• Enterprise-grade key lifecycle management

---

6. Distributed Replay Protection

Supports:

• In-memory replay store (single instance)
• Redis-backed replay store (distributed environments)

Redis implementation uses atomic SET NX with TTL to prevent race conditions.

This ensures replay protection remains effective in:

• Kubernetes
• Load-balanced environments
• Azure App Service scale-out

---

7. License Enforcement Security

Pro licenses are:

• RSA-signed
• Verified using embedded public key
• Bound to application name
• Time-limited
• Tamper-resistant

License format:

base64(payload).base64(signature)

Signature validation prevents license forgery.

---

8. Observability & Monitoring

The library exposes:

Metrics:

• replay_rejected_total
• invalid_signature_total
• expired_timestamp_total

Health checks:

• Replay store availability

This enables integration with:

• Prometheus
• Grafana
• Azure Monitor
• Kubernetes probes

---

9. Limitations

This library does NOT replace:

• OAuth
• JWT authentication
• mTLS
• Role-based authorization

It complements authentication by ensuring request integrity and replay resistance.

---

10. Best Practices

• Always use HTTPS
• Store secrets securely
• Rotate secrets periodically
• Use Redis in production environments
• Monitor replay metrics
• Keep system clocks synchronized (NTP)

---

11. Intended Use Cases

• Payment APIs
• FinTech systems
• B2B integrations
• Internal microservices
• Webhook receivers
• High-trust API environments

---

Hrithik.Security.Pro is designed for production APIs where tamper-proof requests and replay protection are business-critical.

---

👤 Maintained By

Built and maintained by Hrithik Kalra
Senior Backend & Azure Engineer
Focused on distributed API security and production-grade .NET systems.

• LinkedIn: https://www.linkedin.com/in/hrithik-kalra-b6836a246/
• GitHub: https://github.com/hrithikalra/
• NuGet: https://www.nuget.org/profiles/hrithikkalra

---

Support

For licensing, configuration, or security inquiries:

📧 hrithikkalra11@gmail.com