NETWORK AND EDGE ANALYSIS:
THE BORDER BEFORE THE APP.
Most attacks never need to touch application logic if the network edge lets a malformed, replayed, or unsigned request through. NonaShield's edge runs nine enforcement stages before a request reaches business code.
The Edge Pipeline.
Header & Token Validation
Combined token format, ±60s clock skew, ≥256-bit nonce entropy, expiry, action allowlist.
Local Replay Guard
In-process rejection outside a 300-second window or a repeated nonce.
Distributed Replay Guard
Cross-instance check against Redis so a request can't be replayed via a different edge node — L1 local-dict fast path, fails open only on a Redis outage.
Signature Verification
ECDSA P-256-SHA256 over the canonical signed input, checked against that device's registered public key. Algorithm-agile branch stubbed for post-quantum ML-DSA-65.
Attestation & Binding Checks
Hardware attestation cert-chain validation and device-binding token correlation.
Bot Scoring
Composite 0–100 score: request-burst rate (30 req/10s), User-Agent fingerprinting, missing SDK headers — published for downstream fusion, never blocks alone.
ASN / IP Reputation
Blocks Tor exit nodes, anonymous VPNs, and hosting-provider IPs against a maintained hostile-ASN table on registration routes — 10-minute edge cache.
Rate Limiting
Per-IP (20r/s), per-user and per-device (10r/s) zones, plus dedicated login (20r/m) and device-enrollment (2r/m) throttles.
Backend Trust Orchestration
Final 8-element fail-closed assertion before a verified request is ever released to business logic.
// Coordinated Attack Detection
- Botnet Correlation — cross-device signal correlation for coordinated traffic.
- Organized Crime Cluster Detector — Neo4j graph scan for shared-IP / coordinated-timing rings, run every 15 minutes.
- Bot Velocity Tracker — backend counterpart to edge bot scoring.
// Backend-Side Guards
- Rate Limiter — Redis sliding-window, 20 req/device, 60 req/IP per 60s.
- OCSP Checker — live certificate-revocation check per chain, fail-soft on OCSP-server outage only.
- SSRF Guard — blocks outbound calls resolving to internal/metadata/private IP ranges.
30+ Network, Edge & API Vectors.
Man-in-the-middle, anonymization, reputation, rate abuse and API-layer attacks — each a real, individually-named check in the network taxonomy, not a marketing category.
// Man-in-the-Middle & TLS
// Proxy, VPN & Anonymization
// Network Reputation & Routing
// API Abuse
// Payload & Business Logic Abuse
The edge terminates standard server-side TLS with live OCSP revocation checking — it does not currently enforce mutual TLS (client certificates). Device authenticity is instead established through the ECDSA-signed token and hardware attestation chain described above, which is where the actual device-identity guarantee comes from.
The Verdict.
"A firewall asks 'is this port open?' NonaShield's edge asks 'is this exact device, this exact second, cryptographically who it claims to be?'"
Frequently asked questions
What does the edge check?
TLS, replay protection, signed request headers, proxy and VPN indicators and rate limits, before the request reaches the backend.
How does NonaShield stop replayed requests?
Every request carries a one-time nonce bound to the payload and device. A reused nonce is rejected.
Where does the edge run?
As an NGINX gateway deployed in your own cloud account or on-premises.