Dynamic Cookie Re-encryption for Fraud Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting fraudulent access to web resources are inadequate as they rely solely on cookies, which can be easily stolen or impersonated, leading to unauthorized access and potential malicious activities.
Innovation Solution
A method and system that involves converting and re-encrypting cookies upon access, using a server to determine fraudulent requests by analyzing the timestamps and user device IDs, and taking restrictive actions such as denying or limiting access when fraudulent activity is detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cookies are used as identifiers for user devices, then user tracking and identification is simplified, but security is compromised as attackers can steal and impersonate cookies
Solution Approach 1:
The patent implements dynamic cookie re-encryption where the encryption key is periodically changed and applied to existing cookies. This makes the identification system dynamic rather than static, so that even if an attacker obtains a cookie, it becomes invalid after the next key rotation, thereby maintaining security while preserving tracking functionality
Solution Approach 2:
The system performs preliminary re-encryption of cookies before potential theft can be exploited. By proactively updating encryption keys and re-encrypting cookies at scheduled intervals or after security events, the system prevents future impersonation attacks while maintaining current user identification
2Reliability
If cookies are re-encrypted periodically to enhance security, then protection against cookie theft is improved, but system complexity and processing overhead increase
Solution Approach 1:
The patent implements periodic re-encryption of cookies at predetermined intervals or after a specified number of uses. This regular, scheduled approach to key rotation provides systematic security updates without requiring continuous complex processing, balancing security enhancement with system simplicity
Solution Approach 2:
The system changes the encryption parameter (the key itself) rather than changing the fundamental encryption mechanism or architecture. By rotating keys while maintaining the same cryptographic approach, the system enhances security through parameter variation without increasing overall system complexity
Data Source
AI summary
A method and system for detecting fraudulent access to a web resource is disclosed. The web resource is hosted by a server and the method being executable by the server. The method comprises: receiving, by the server, a first request to access the web resource by a first electronic device, the first request including a first cookie; converting, by the server, the first cookie into a second cookie; transmitting, by the server, the second cookie to the first electronic device for storing; receiving, by the server, a second request to access the web resource by a second electronic device, the second request including a third cookie; and determining, by the server, the second request to be a fraudulent request, the determining based on an analysis of the third cookie and the first cookie.