Gateway Cookie Protection via Hash Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting against cookie-poisoning attacks in networked-communication applications face limitations such as high memory consumption, unnecessary processing, and vulnerability if the gateway crashes, as they require storing and managing multiple cookies and modifying cookie information.
Innovation Solution
A method that creates a protected gateway cookie by signing server cookies with a secret key generated from a seed, and validates client cookies against expected field values without storing all cookies, ensuring secure cookie verification without memory allocation and crash sensitivity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cookie information is stored on the gateway for validation, then cookie-poisoning detection capability is improved, but memory consumption increases and system reliability deteriorates if gateway crashes
Solution Approach 1:
The patent extracts the essential validation information from cookies by computing hash values of cookie parameters (name, value, domain, path, expiration, secure, httpOnly attributes). Instead of storing complete cookie information in gateway memory, only the hash values are stored and compared during validation, dramatically reducing memory consumption while maintaining detection capability
Solution Approach 2:
The gateway performs preliminary hash computation of cookie parameters when cookies are first set, storing these pre-computed hash values. During subsequent validation, the gateway only needs to re-compute hashes and compare them against stored values, avoiding the need to store and manage large amounts of raw cookie data in memory
2Measurement precision
If all cookie information is stored and compared against stored cookies, then cookie validation accuracy is improved, but processing time increases
Solution Approach 1:
The patent transforms cookie validation from comparing complete cookie objects to comparing hash values derived from cookie parameters. By changing the validation parameter from raw cookie data to computed hash values, the system maintains validation accuracy while significantly reducing processing time and computational overhead
3Reliability
If gateway stores and manages multiple cookies, then comprehensive cookie protection is improved, but system complexity increases
Solution Approach 1:
The patent extracts only the essential identifying characteristics of cookies (parameter names and their hash values) needed for validation, eliminating the need to store and manage complete cookie objects. This extraction approach maintains comprehensive protection capability while simplifying the management overhead
Solution Approach 2:
Instead of storing and managing actual cookie objects, the system creates and stores simplified hash-based representations (copies) of cookie parameters. These hash copies contain sufficient information for validation without the complexity of managing full cookie objects, including their various attributes and metadata
Data Source
AI summary
The present invention discloses methods, media, and gateways for protecting against cookie-poisoning attacks in networked-communication applications. Methods include the steps of: creating a protected gateway cookie, generated by a gateway, for a server cookie, generated by a server, wherein the server cookie is received by the gateway in an HTTP response message; and validating, by the gateway, that a client cookie from a client request has a corresponding gateway cookie with expected field values. Preferably, the field values include at least one field value selected from the group consisting of: a name, a hash value computed over the server cookie, a hash-function index, a timestamp, a nonce, a hash value computed over newly-generated values, a path, a domain, an expiration, and an HTTP-only value. Preferably, the gateway cookie is signed with a secret key. Most preferably, the secret key is generated by a secret seed.