Multi-Factor Fingerprinting for Application Session Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting and managing unauthorized access to software applications and associated data is challenging, especially with attackers using valid credentials or exploiting vulnerabilities, as existing methods struggle to distinguish between malicious and authorized access effectively.
Innovation Solution
Implementing a multi-factor fingerprinting system that captures and compares session identifier, software, hardware, location, and user information components to generate a fingerprint, allowing for the detection of malicious access attempts and distinguishing between different types of attacks, while limiting access and potentially using an application clone to observe attacker behavior without compromising real data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control methods are used, then authorized users can access applications, but unauthorized access cannot be effectively detected or distinguished from authorized access
Solution Approach 1:
The patent segments the access control verification into multiple independent fingerprint components (device hardware fingerprint, browser software fingerprint, session identifier, location information, user information). Each component is captured and compared separately, allowing the system to detect unauthorized access by analyzing discrepancies in any single component without requiring complete system redesign.
Solution Approach 2:
The patent creates a composite verification system by combining multiple different fingerprint types (hardware, software, session, location, user) into a unified multi-factor fingerprinting approach. This composite method enhances detection reliability by cross-referencing multiple data sources simultaneously.
2Object-affected harmful factors
If access is limited to prevent unauthorized access, then data security is improved, but authorized users may experience inadvertent access limitations
Solution Approach 1:
The patent applies different verification strictness levels to different fingerprint components based on their security significance. Critical components like device hardware fingerprint and session identifier are verified with high strictness, while less critical components allow for more flexibility. This localized quality approach ensures data security while minimizing impact on authorized user experience.
Solution Approach 2:
The patent dynamically adjusts access decisions based on changes in fingerprint parameters. When authorized users legitimately change devices or browsers, the system updates their fingerprint profile accordingly, allowing future access without treating it as unauthorized. This parameter adaptability prevents inadvertent limitations on authorized users.
3Measurement precision
If multi-factor fingerprinting is implemented, then malicious access can be detected and distinguished, but system complexity and processing requirements increase
Solution Approach 1:
The patent performs preliminary fingerprint capture and baseline establishment during legitimate user sessions before attacks occur. Device hardware fingerprints, browser software fingerprints, and user behavior patterns are pre-recorded and stored as reference profiles. During security verification, the system simply compares incoming requests against these pre-established baselines, reducing real-time processing complexity while maintaining high detection precision.
Solution Approach 2:
The patent creates simplified copies of complex verification data by generating hashed representations of fingerprints and using surrogate markers for comparison. Instead of comparing raw device identifiers and software configurations directly, the system uses cryptographic hashes and normalized fingerprint profiles that are computationally efficient to process while preserving detection accuracy.
4Speed
If session monitoring and fingerprint comparison are continuously performed, then unauthorized access is detected in real-time, but computational resources and processing time are consumed
Solution Approach 1:
The patent implements partial verification by selectively checking only the most critical fingerprint components (device hardware fingerprint, session identifier) in every request, while performing more comprehensive multi-factor comparison only when anomalies are detected or at scheduled intervals. This partial action approach maintains real-time detection capability for critical threats while reducing overall computational resource consumption.
Data Source
AI summary
Systems, methods, and computer media for securing software applications are provided herein. The multi-factor fingerprints allow attackers to be distinguished from authorized users and allow different types of attacks to be distinguished. The multi-factor fingerprint can include, for example, a session identifier component, a software information component, and a hardware information component. The different components can be separately compared to components of stored fingerprints to determine whether an application session request is malicious, and if so, what type of attack, such as session cookie theft or a spoofing attack, is occurring.