Login Cookie Verification Data for Fraud Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for preventing login cookie theft are inadequate, especially in scenarios involving third-party sites, as they require significant user training, security software installation, and frequent updates, and are difficult to implement and maintain, leading to potential unauthorized access to protected resources.
Innovation Solution
A computerized method that involves validating user credentials by including verification data in login cookies, allowing access points to continuously verify the legitimacy of subsequent requests by comparing stored verification data with data from the request, using cryptographic hashes and risk-based analysis to detect and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If verification data is added to login cookies to enable continuous validation, then fraud detection capability is improved, but cookie size and processing overhead increase
Solution Approach 1:
The verification data is segmented into multiple components including cryptographic hash values of device characteristics, timestamp ranges, and risk scores. These segmented elements are distributed throughout the cookie structure rather than stored as a single block, enabling incremental validation at different access points without requiring complete re-verification of all parameters.
Solution Approach 2:
Device characteristics and verification parameters are captured and hashed during the initial login phase before the user accesses protected resources. This preliminary action creates a baseline fingerprint that is stored in the cookie, allowing subsequent access points to perform rapid comparative validation without conducting full device analysis during each resource access.
2Reliability
If strict verification of login cookies is implemented at all access points, then security against stolen cookies is improved, but access speed and user experience deteriorate
Solution Approach 1:
Access points perform partial verification by checking only critical verification parameters such as cryptographic hash matches and timestamp validity rather than conducting complete device fingerprint analysis on every request. This partial action maintains security for stolen cookies while allowing legitimate users with valid verification data to access resources with minimal delay.
Solution Approach 2:
Full device verification and re-validation occurs periodically or under specific conditions such as suspicious activity detection, rather than on every single resource access. Between these periodic full verifications, access points perform lighter-weight checks that validate against the stored verification data in the cookie, maintaining security while improving access speed for legitimate users.
Data Source
AI summary
Method and systems for validating a client user in a secured network are provided. Upon authentication, a user is supplied a login cookie that includes verification data. When requesting access to a secured resource, the verification data is compared to the data in the request to confirm that the requestor is a legitimate user and not a user who has stolen the login cookie.