Cookie Morphing for HTTP Authentication Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication protocols, such as HTTP, lack equal protection mechanisms for all processes, making them vulnerable to hijacking and stealing attempts, particularly for validation information like cookies, which can lead to increased exposure of sensitive data.
Innovation Solution
A system and method that involves a server generating an authentication cookie and a device injecting executable code to the client with a cookie engine, sequence number, and cryptographic secret, allowing the client to generate and update validation cookie information, thereby enhancing protection against data theft by incrementing the sequence number and using a hash-based message authentication code (HMAC).
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If validation information (cookies) is transmitted in HTTP processes, then communication can be established, but the validation information becomes vulnerable to stealing and hijacking
Solution Approach 1:
The patent applies dynamics by making the validation information changeable through sequence numbers. The cookie engine generates validation information with sequence numbers that increment over time, transforming static cookies into dynamic, time-varying tokens. This prevents replay attacks and cookie stealing because stolen cookies with old sequence numbers become invalid.
Solution Approach 2:
The patent changes parameters of the validation information by introducing sequence numbers and cryptographic secrets. The validation information is no longer a fixed cookie but a dynamic structure with sequence numbers that change with each use. This parameter transformation makes the validation information resistant to stealing and reuse by attackers.
2Reliability
If equal protection mechanisms are applied to all HTTP processes, then security is improved, but system complexity increases
Solution Approach 1:
The patent introduces a cookie engine as an intermediary component that handles security operations. This mediator runs in the client browser and manages sequence numbers, generates validation information, and handles cryptographic operations. By centralizing security functions in this intermediary, the system achieves equal protection without requiring complex server-side implementation for every HTTP process.
Solution Approach 2:
The validation information system provides self-service security features where the client browser automatically manages sequence numbers and generates validation information without requiring server intervention for each individual cookie. The system self-updates sequence numbers and automatically protects against replay attacks, reducing the burden on server complexity.
3Reliability
If sequence numbers are incremented and validation information is regenerated, then protection against misuse is improved, but processing time increases
Solution Approach 1:
The patent applies preliminary action by pre-generating and storing validation information with sequence numbers in the client browser before actual use. The cookie engine maintains sequence numbers and prepares validation information in advance, so that when HTTP requests need validation, the process is faster because the foundation is already in place. This reduces the time penalty of continuous regeneration.
Data Source
AI summary
Described embodiments provide systems and methods for morphing or regenerating validation information. A client can receive, via a device, an authentication cookie for access to a server. The device may maintain a sequence number and a cryptographic secret. The client may use the cryptographic secret and a cookie engine to generate validation cookie information with an updated sequence number. The client may send the authentication cookie to the device via a hypertext transfer protocol (HTTP) message to validate the authentication cookie. The client may send the validation cookie information with the updated sequence number to the device via a HTTP message to validate the authentication cookie.