HTTP Server Phishing Detection via Encrypted Session Tokens

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current HTTP protocols are vulnerable to phishing attacks, as they lack effective mechanisms to verify the authenticity of client requests and maintain user state securely, especially in stateless transactions.

Innovation Solution

Appending a specific token, such as a digital signature of client unique identifiers encrypted with a secret key, to HTTP requests and responses, and using a referer header check against known phishing URLs to validate requests and prevent unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If HTTP uses stateless transactions to simplify communication, then protocol simplicity and speed are improved, but security and user state maintenance deteriorate

Engineering Contradiction:

ImproveHTTP transaction speedVSAvoidSecurity

Core Design Contradiction:

SpeedVSReliability

Solution Approach 1:

The system performs preliminary actions by establishing user authentication state before allowing access to protected content. The server validates user credentials and stores authentication information in a database before the user accesses any protected resources, ensuring security is established beforehand rather than during transactions.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system introduces an intermediary mechanism using session tokens and cookies to maintain user state between stateless HTTP requests. The server issues session tokens after authentication, and these tokens are included in subsequent requests, acting as intermediaries that carry authentication state through the stateless protocol.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Stability of the object's composition

If HTTP uses cookies to maintain user state, then user state maintenance is improved, but security against phishing attacks deteriorates

Engineering Contradiction:

ImproveUser state maintenanceVSAvoidPhishing attack vulnerability

Core Design Contradiction:

Stability of the object's compositionVSObject-affected harmful factors

Solution Approach 1:

The system changes the parameters of state maintenance by using encrypted session tokens with expiration times and specific authentication contexts rather than traditional cookies. The token includes parameters for user ID, authentication time, and expiration, allowing the server to validate both the presence and validity of authentication state.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The system implements feedback mechanisms where the server continuously validates authentication tokens in each request and can revoke access or issue new tokens based on user activity. The server provides feedback to clients about authentication status through HTTP headers and responses, enabling dynamic state management.

Inventive Principle:

Principle #23Feedback

Data Source

PatentEP2005698B1Method for providing web application security

Publication Date: 2012.01.04 ART OF DEFENCE

Figure 1
Figure 2
Figure 3

AI summary

A method for an HTTP server to decide whether a remote client is victim of a phishing ttack, comprising: - receiving a first HTTP request from the remote client on said HTTP Server; - responding to said first HTTP request, wherein a token is added to the response submitted to said remote client; - receiving a second HTTP request on said HTTP server; - judging whether the second HTTP request includes said token; - judging whether the token originates from said remote client; - processing the HTTP request when said remote client has really issued the second HTTP request.