Keyed Communication Token for HTTP User Agent Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious software and non-malicious applications can evade detection by using fake user agents in HTTP protocol connections, making it difficult for network security systems to prevent rogue connections.
Innovation Solution
A method involving the use of keyed communication tokens, where a key and seed are used to generate a pseudo-random value, creating a concatenated string that is hashed into a token, which is added to the user agent of HTTP requests, allowing firewalls to differentiate between legitimate and malicious requests by changing the token over time or with the number of requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If fake user agents are used in HTTP requests, then the ability to evade detection by malware and non-malicious applications is improved, but the reliability of network security systems to detect and prevent rogue connections deteriorates
Solution Approach 1:
The patent introduces a token as an intermediary element that is inserted between the user agent string and the HTTP request transmission. This token acts as a mediator that carries authentication information, allowing the network security system to verify the legitimacy of the request without altering the user agent string itself. The token serves as a hidden credential that proves the request comes from an authorized source, thereby resolving the contradiction between maintaining fake user agents for evasion and enabling reliable detection by security systems.
Solution Approach 2:
The patent employs disposable tokens that are generated dynamically for each request or session. These tokens are single-use or short-lived credentials that are created, used, and then discarded. The tokens are generated based on cryptographic operations involving keys and timestamps, making them difficult to replicate. This approach allows the system to maintain the appearance of legitimate browser traffic while providing reliable authentication, as the tokens change with each request and cannot be reused by malicious applications.
2Reliability
If tokens are added to user agents to prevent fake user agents, then network security and detection capability are improved, but the complexity of the HTTP request processing system increases
Solution Approach 1:
The patent extracts the authentication functionality from the user agent string itself and separates it into a distinct token component. By taking out the security verification function from the user agent, the system can maintain the user agent string as a simple identifier while adding a separate token that handles the authentication logic. This extraction reduces the complexity of processing the user agent string itself, as the security checks are performed on the separate token rather than parsing and validating the entire user agent string.
Solution Approach 2:
The patent performs preliminary actions by generating and validating tokens before the actual HTTP request is processed. The token is created in advance using cryptographic operations involving keys and timestamps, and validation occurs at the point of request. This preliminary preparation of authentication credentials allows the main request processing to remain relatively simple, as the heavy cryptographic operations are performed separately during token generation and validation, rather than during the core request handling.
Data Source
Figure 1~3
Figure 2
Figure 4
AI summary
Systems and methods for keyed communication tokens. A method may include receiving a key and a seed at a computing device, calculating a pseudo-random value based, at least in part, upon the seed, creating a concatenated string using the key and the pseudo-random value, hashing the concatenated string into a token, and adding the token to a user agent issued by a web browser as part of a command transmitted by the computing device. A computer system may be configured to identify a key and a seed, generate a pseudo-random value using the seed, create a concatenated string using the key and the pseudo-random value, hash the concatenated string into a token, and allow a web command in response to the web command including a user agent having the token or block the web command in response to the web command not including a user agent having the token