Cookie Encryption via Endpoint Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security measures, particularly those involving cookie encryption schemes, face challenges in protecting cookies from tampering and mining, and require significant computational resources and maintenance of large databases, making them vulnerable to denial of service attacks and compromising confidentiality.
Innovation Solution
A web application security device intercepts outgoing cookies, encrypts and hashes them using a secret key, ensuring confidentiality and tamperproofing, and verifies the integrity upon return, eliminating the need for maintaining state information on network security devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cookie encryption schemes are implemented to protect cookies from tampering and mining, then security against attacks is improved, but computational resources and maintenance requirements increase significantly
Solution Approach 1:
The patent extracts the security-critical operations (encryption and hashing) from the network security device and performs them at the web server and web browser endpoints. This removes the computational burden from the network security device while maintaining security protection, as the encrypted and hashed cookies are generated locally at the source and destination devices.
Solution Approach 2:
The web server and web browser perform the encryption and hashing operations themselves without requiring external security device intervention. The web server encrypts and hashes cookies before sending them to the browser, and the browser verifies them locally, making the system self-sufficient and reducing dependency on external security infrastructure.
2Reliability
If large databases are maintained for cookie encryption schemes, then protection against attacks is improved, but device complexity and maintenance burden increase
Solution Approach 1:
The patent removes the requirement for large security databases by extracting the security functionality to the endpoints. Instead of maintaining centralized databases of encrypted cookies at network security devices, the encryption and hashing are performed locally at the web server and browser, eliminating the need for complex database maintenance.
Solution Approach 2:
The security functionality is copied to each endpoint (web server and web browser) rather than being centralized in a database at a network security device. Each device performs its own encryption and hashing operations independently, eliminating the need for centralized database management and reducing overall system complexity.
3Reliability
If state information is maintained on network security devices for cookie verification, then security verification is improved, but computational overhead and vulnerability to denial of service attacks increase
Solution Approach 1:
The patent extracts the state information maintenance from network security devices and places it at the web browser endpoint. The browser stores and verifies the encrypted and hashed cookies locally, eliminating the need for network security devices to maintain state information, thereby reducing computational overhead and vulnerability to denial of service attacks.
Solution Approach 2:
The web browser performs its own verification of encrypted and hashed cookies without requiring network security devices to maintain state information. This self-service approach at the endpoint eliminates the computational burden on network security devices and reduces the attack surface for denial of service attacks.
Data Source
AI summary
An intrusion detection system and method for a computer network includes a processor and one or more programs that run on the processor for application inspection of data packets traversing the computer network. The one or more programs also obtaining attribute information from the packets specific to a particular application and comparing the attribute information against a knowledge database that provides a baseline of normal network behavior. The processor raises an alarm whenever the attribute information exceeds a predetermined range of deviation from the baseline of normal network behavior.