Access Request Capturing with Split Session Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current web protection software struggles to accurately differentiate between normal and malicious access requests, often detecting threats too late to prevent infiltration by virus programs or other malicious operations.
Innovation Solution
An access request capturing method that includes returning session response information with a session control identifier and auxiliary authentication data, which are stored at different locations, and subsequently capturing non-initial access requests that lack auxiliary authentication data or match predefined trap criteria, thereby enhancing security by authenticating each access request comprehensively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If web protection software determines access behavior based on process and service, then the detection is simpler to implement, but the detection is performed late and cannot effectively block virus programs from infiltrating the host
Solution Approach 1:
The patent embeds trap APIs and false database interfaces into the website code in advance, before any attack occurs. When malicious requests are sent, these pre-planted traps are triggered, allowing early detection of attacks at the request level rather than waiting for process-level detection. This preliminary preparation enables the system to catch attacks at their inception.
Solution Approach 2:
The patent introduces session control identifiers and auxiliary authentication data as intermediary elements between the user and the website resources. These intermediaries are embedded in the webpage code and used to verify the legitimacy of access requests. By adding this intermediary authentication layer, the system can detect malicious requests before they reach the actual resources, solving the timing problem without requiring complex process analysis.
2Measurement precision
If web protection software uses process and service-based detection, then the implementation is more straightforward, but it cannot accurately identify whether an access behavior is normal user access or malicious attack
Solution Approach 1:
The patent segments the authentication process into two distinct parts: session control identifiers for basic session management and auxiliary authentication data for additional verification. This segmentation allows the system to check multiple authentication factors independently, improving the accuracy of identifying legitimate versus malicious requests without requiring a single complex detection system.
Solution Approach 2:
The patent introduces session control identifiers and auxiliary authentication data as intermediary verification elements. These intermediaries are embedded in the webpage code and automatically checked for each access request. By using these intermediary elements, the system can accurately distinguish between normal user access and malicious attacks at the request level, providing high measurement precision without excessive system complexity.
3Object-affected harmful factors
If the session control identifier and auxiliary authentication data are stored at the same location, then the implementation is simpler, but attackers can more easily obtain both authentication elements to compromise security
Solution Approach 1:
The patent divides the authentication data into two separate segments: session control identifiers and auxiliary authentication data. These segments are stored at different locations within the webpage code, physically separating them so that an attacker would need to compromise multiple locations to obtain both authentication elements. This segmentation significantly reduces the security vulnerability while the underlying storage structure remains manageable.
Solution Approach 2:
The patent applies different storage characteristics to different authentication elements by placing them at different locations in the webpage code. This local differentiation ensures that even if one location is compromised, the other remains secure. The varying storage locations create a more robust security posture without requiring a fundamentally complex storage architecture.
Data Source
AI summary
An access request capturing method comprises: upon receiving an initial access request from a current user, returning session response information, wherein the session response information comprises a session control identifier and auxiliary authentication data that are stored at different locations; receiving a current non-initial access request from the current user; and when the current non-initial access request carries the session control identifier and does not carry the auxiliary authentication data, capturing the current non-initial access request.