Browser Cookie Attestation Tokens Against Fraud and Replay
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing browser cookie management systems are vulnerable to fraud and data tampering, allowing malicious entities to alter or steal user data, and there is a lack of secure communication channels to manage user data stored by third parties.
Innovation Solution
Implementing attestation tokens generated by web browsers that include a set of data, a digital signature, and encrypted cookie elements, which are used to verify the integrity of requests and establish secure communication channels with other entities, ensuring the authenticity and integrity of user data management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If browser cookies are stored on user devices for authentication and data management, then user data management functionality is enabled, but the system becomes vulnerable to fraud and data tampering by malicious entities
Solution Approach 1:
The system performs preliminary actions by generating attestation tokens that include digital signatures and encrypted cookie elements before data management operations. These tokens are created in advance with cryptographic proofs of integrity, allowing recipients to verify authenticity before processing any cookie-related operations, thus preventing fraud and tampering while enabling data management functionality.
Solution Approach 2:
The patent introduces attestation tokens as intermediary elements between the browser and cookie recipients. These tokens serve as mediators that carry encrypted cookie elements and digital signatures, enabling secure data management without exposing the actual cookies to potential attackers. The intermediary token structure allows verification of integrity while maintaining the functionality of cookie-based authentication and tracking.
2Adaptability or versatility
If cookies are transmitted to multiple recipients for data management, then data management capabilities are enhanced, but the risk of data theft and unauthorized access increases
Solution Approach 1:
The patent segments cookies into encrypted cookie elements that are individually protected within attestation tokens. Each cookie is encrypted separately using recipient-specific keys, and the attestation token structure divides the data into distinct protected components. This segmentation allows multiple recipients to access their specific encrypted elements without exposing other recipients' data, enabling multi-recipient data management while preventing unauthorized access and data theft.
Solution Approach 2:
The system applies local quality by encrypting each cookie element with recipient-specific cryptographic keys and protecting them with individual digital signatures within the attestation token. Each recipient has localized access control to their specific encrypted cookie elements, while the overall token structure maintains integrity for all recipients. This approach enables enhanced multi-recipient data management capabilities while minimizing the risk of data theft and unauthorized access through granular, location-specific security measures.
3Reliability
If digital signatures and encryption are applied to protect cookie integrity, then security against tampering is improved, but the complexity of the system increases
Solution Approach 1:
The patent merges digital signatures, encrypted cookie elements, and metadata into a single integrated attestation token structure. By combining these security mechanisms into one unified token that the browser generates and transmits in a single request, the system achieves improved integrity protection while managing complexity through consolidation. The merged token structure allows all security functions to work together seamlessly without requiring separate complex systems for each security measure.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and apparatus, including an apparatus for verifying the integrity of requests. In some aspects, a method includes receiving, from an application, a request including an attestation token of the application. The attestation token includes a set of data that includes at least a public key of the application and a token creation time that indicates a time at which the attestation token was created. The attestation also includes a signature of the set of data. The signature is generated using a private key that corresponds to the public key. The integrity of the request is verified using the attestation token. The verification includes determining that the integrity of the request is valid based on a determination that the token creation time is within a threshold duration of the time at which the request was received and a determination that the set of data has not been.