Backend Verification Chain

What the Backend Actually Checks.

A "Golden Payload" has to survive every stage below, in order, before it's trusted — not one pattern-match on a JSON blob. The same pipeline also carries 50+ real fraud-pattern vectors, from digital-arrest coercion signatures to SIM-swap and mule-account correlation.

01

Token & Header Validation

Parses the signed request token, enforces ±60s clock skew, ≥256-bit nonce entropy, expiry, and an allowlisted action string — before anything downstream is trusted.

02

Replay Rejection

In-process 300-second replay window, then a cross-instance nonce check against Redis so a captured request can't be replayed from a different edge node.

03

Signature Verification

ECDSA P-256-SHA256 signature over the canonical request, checked against that specific device's registered public key — not a shared secret.

04

Crypto Gate — 8-Element Trust Orchestration

Asserts public key registry lookup, hardware attestation, device-binding token, signature, nonce + timestamp, decision log entry, policy version, and orchestrator identity — all eight, fail-closed — before a verified request is ever released.

05

Certificate Revocation

Live OCSP check on every non-root certificate in the chain — fails hard on a definitive REVOKED response.

06

IP / ASN Reputation

Blocks Tor exit nodes, anonymous VPNs and hosting-provider ASNs against a maintained hostile-ASN table, cached 10 minutes at the edge.

07

Geo-Velocity & GPS-vs-IP Cross-Check

Haversine velocity between consecutive locations flags impossible travel at ≥900 km/h; device-reported GPS is separately cross-checked against edge-derived IP geolocation.

08

Bot & Automation Scoring

Composite 0–100 score from request-burst rate, User-Agent fingerprinting, and missing-SDK-header checks — fused downstream, never a standalone block.

09

Evidence Write

Only after every check above does the decision get hash-chained and dual-signed (device + server ECDSA) into the immutable evidence ledger.

See It In Action

Watch the Attack Fail.

FAKE DATA SENT
DATA LOOKS PERFECT
HARDWARE ASKED TO PROVE IT
REQUEST REJECTED
Ready to begin.

The Verdict.

"Feedzai and Riskified are Pattern Matchers. NonaShield is a Truth Verifier"[cite: 411].

Physics Over Patterns
Hardware-Backed Non-Repudiation