Meta Session Analysis for Session Hijacking Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity and access management solutions fail to effectively detect and respond to session hijacking and related attacks, leading to prolonged dwell times and high false positives, exacerbated by the complexity of managing user sessions in large enterprises and the inadequate protection of session tokens.
Innovation Solution
A Session Security System (SSS) that aggregates telemetry signals from various sources to create live session graphs, analyzing user sessions, device employment, and third-party application tokens to identify legitimate and suspicious activities, and provides automated remediation tools to address security events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional single-source detection methods are used, then implementation is simple, but detection effectiveness is low and false positives are high
Solution Approach 1:
The patent combines multiple detection sources (browser extensions, network traffic analysis, endpoint detection, cloud-based analysis) into a unified session monitoring system. This multi-source approach correlates data from different channels to distinguish legitimate from malicious activities, thereby improving detection effectiveness while managing complexity through integrated architecture
Solution Approach 2:
The patent introduces browser extensions as intermediary components that collect session data locally and transmit to centralized analysis systems. These extensions act as mediators between user sessions and detection systems, enabling comprehensive monitoring without requiring direct access to all system components, thus balancing detection capability with implementation complexity
2Ease of operation
If session tokens are stored in cookie stores or on disk for easy access, then ease of operation is improved, but security vulnerability increases
Solution Approach 1:
The patent replaces traditional mechanical storage methods (cookie stores, disk-based token storage) with memory-based session management and secure enclave technologies. Session tokens are kept in volatile memory and protected through cryptographic mechanisms rather than persistent storage, eliminating the trade-off between accessibility and security by using different storage paradigms
Solution Approach 2:
The patent changes the security parameters of session token storage by implementing short-lived tokens, rotating session identifiers, and using secure memory allocation with controlled access. These parameter changes maintain operational ease through programmatic session management while significantly reducing the security vulnerabilities associated with traditional storage methods
3Ease of operation
If prolonged application sessions are allowed for user convenience, then ease of operation is improved, but risk of session hijacking and token theft increases
Solution Approach 1:
The patent implements periodic session validation and refresh mechanisms that maintain long-duration sessions through regular security checks. Instead of allowing continuous uninterrupted access, the system periodically re-authenticates users, validates session integrity, and rotates tokens, thereby maintaining operational convenience while continuously reducing the window of opportunity for session hijacking
Solution Approach 2:
The patent incorporates continuous feedback loops that monitor session activity patterns, device states, and user behavior throughout the session duration. When anomalies are detected or session conditions change, the system automatically adjusts session parameters, triggers re-authentication, or terminates sessions, thereby dynamically balancing ease of operation with security risk mitigation
Data Source
AI summary
Methods, systems, and computer programs are presented for stitching a meta session with an underlying trail fragmented across multiple distributed sessions. One method includes receiving telemetry signals from entities in a session environment that includes at least one identity of a user engaged with applications via respective meta sessions. An underlying trail for each meta session is determined, where the underlying trail is fragmented across two or more sessions with two or more entities. For a first meta session with a first application for the identity of the user, several operations are performed, including correlating a signal hierarchy based on the telemetry signals; constructing, based on the correlated signal hierarchy, a session hierarchy underlying the first meta session distributed across the one or more entities; determining a posture of the first meta session based on the constructed session hierarchy; and enforcing a security policy based on the determined posture.