Access Gateway Cookie-Based Authentication Bypass
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
When users attempt to access specific enterprise resources before authentication, they are often redirected to a common landing page after authentication, leading to a less-than-positive user experience, and storing the requested resource identifier at the access gateway consumes resources and makes it vulnerable to denial-of-service attacks.
Innovation Solution
The access gateway provides an identification cookie with a redirection message to the client device upon unauthenticated requests, which includes the specific enterprise resource identifier, allowing it to be used post-authentication without pre-storing it, thus avoiding the storage of requested enterprise resource identifiers before authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the access gateway stores the requested enterprise resource identifier before user authentication, then the user experience is improved by directly redirecting to the specific resource after authentication, but the gateway becomes vulnerable to denial-of-service attacks and consumes excessive gateway resources
Solution Approach 1:
The patent extracts the resource identifier information from the server-side storage and places it in a client-side cookie (NSC_CGIR cookie). This eliminates the need for the gateway to store resource identifiers in memory, preventing denial-of-service attacks while maintaining the ability to redirect users to specific resources after authentication.
Solution Approach 2:
The patent introduces a cookie as an intermediary carrier to store the resource identifier. Instead of the gateway directly storing and managing resource identifiers, the cookie acts as a mediator that holds the information on the client side, allowing the gateway to retrieve it during the authentication process without consuming gateway resources.
2Adaptability or versatility
If the access gateway stores the requested enterprise resource identifier in memory, then the redirection to specific resources is enabled, but the gateway memory resources are consumed and the system becomes vulnerable to attacks
Solution Approach 1:
The patent removes the resource identifier storage from gateway memory and extracts it to client-side cookies. This eliminates the consumption of gateway memory resources while preserving the functionality of tracking and redirecting to specific enterprise resources after authentication.
Solution Approach 2:
The patent uses temporary cookies that are created, used for authentication redirection, and then discarded. These short-lived client-side objects replace persistent server-side storage, eliminating the need for long-term gateway memory allocation while maintaining resource access capability.
3Productivity
If unauthenticated requests are processed and stored at the gateway, then all enterprise resources are accessible via the gateway, but the gateway resources are saturated by rogue users
Solution Approach 1:
The patent extracts the request tracking information from gateway storage and places it in client-side cookies. This allows the gateway to process and redirect unauthenticated requests without consuming gateway memory resources, preventing saturation by rogue users while maintaining enterprise resource accessibility.
Solution Approach 2:
The patent implements a system where the client device itself (via cookies) manages the tracking of requested resources rather than relying on gateway storage. This self-service approach shifts the resource management burden from the gateway to the client, preventing gateway resource saturation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method is disclosed for authentication of a client when accessing enterprise resources while providing denial-of-service attack protection. The method includes receiving, at a gateway from a client device, a request for a resource, the request comprising a location identifier associated with the resource (310). The method further includes redirecting, by a redirection message, the request to an authentication device that requests credentials for authentication, the redirection message comprising the location identifier (312). The method also includes retrieving, after authentication of the credentials, the location identifier from the client device (320). The method additionally includes providing access to the resource based on the location identifier (324). The location identifier received in the redirection message is stored at the client device in a cookie (314). The method may be used in connection with single sign-on, SSO.