Continuous Device Fingerprinting for Session Hijacking Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing systems are vulnerable to session hijacking due to the use of session cookies, which can be stolen by hackers, allowing unauthorized access and posing a security threat.

Innovation Solution

Implement continuous fingerprinting methods within zero trust private networks to detect session hijacking by comparing device attributes with a master fingerprint, using predefined time intervals to collect additional fingerprints, and taking actions based on the comparison, such as blocking the user or sending alerts.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If session cookies are used for user authentication, then user access convenience is improved, but system security deteriorates due to vulnerability to cookie theft and session hijacking

Engineering Contradiction:

Improveuser access convenienceVSAvoidsession security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The system performs preliminary fingerprinting of the device during initial session establishment, creating a baseline master fingerprint before authentication occurs. This preliminary action enables continuous verification throughout the session without requiring re-authentication, thus maintaining both convenience and security

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements continuous feedback by periodically collecting additional fingerprints during the session and comparing them against the master fingerprint. This feedback mechanism detects deviations that may indicate session hijacking, allowing the system to respond to security threats while maintaining legitimate sessions

Inventive Principle:

Principle #23Feedback

2Reliability

If continuous fingerprinting is implemented to detect session hijacking, then session security is improved, but system complexity increases

Engineering Contradiction:

Improvesession securityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The fingerprinting system serves multiple functions: it establishes device identity during authentication, continuously verifies session integrity, detects session hijacking attempts, and provides audit information. This multi-functionality reduces the need for separate security mechanisms, managing complexity while enhancing security

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system creates a copy of the device's identifying characteristics (master fingerprint) and stores it for comparison purposes. This copying approach allows continuous verification without requiring the original device to be constantly communicated with, reducing system complexity while maintaining security

Inventive Principle:

Principle #26Copying

3Measurement precision

If additional fingerprints are collected at predefined time intervals, then detection accuracy is improved, but loss of time increases due to continuous monitoring overhead

Engineering Contradiction:

Improvesession hijacking detection accuracyVSAvoidsession monitoring time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system collects additional fingerprints at predefined periodic intervals during the session rather than continuously. This periodic approach balances detection accuracy with time efficiency, allowing the system to detect session hijacking while minimizing monitoring overhead and preserving session performance

Inventive Principle:

Principle #19Periodic action

Data Source

PatentUS12563011B2Systems and methods for continuous fingerprinting to detect session hijacking inside zero trust private networks

Publication Date: 2026.02.24 ZSCALER INC

AI summary

Systems and methods include responsive to a user initiating a session with a resource, determining a master fingerprint of a device associated with the user; collecting, at predefined time intervals, one or more additional fingerprints during the session; comparing the one or more additional fingerprints with the master fingerprint; and performing one or more actions based on the comparing.