Scrambled Cookie Name Generator for Session Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cookie security mechanisms are inefficient against cookie stealing and cookie-tossing attacks, as cookie names are predictable, allowing attackers to impersonate users and gain unauthorized access.
Innovation Solution
A server-side solution that generates scrambled, unpredictable cookie names using a correspondence mechanism, associating these names with connection attributes, making it difficult for attackers to predict or forge cookie names, thereby enhancing security by modifying the cookie content with a random key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If predictable cookie names are used, then cookie compatibility and ease of operation are improved, but security is worsened due to vulnerability against cookie stealing and impersonation attacks
Solution Approach 1:
A proxy server is introduced as an intermediary between the web server and the client browser. The proxy server intercepts cookie names, scrambles them using a cryptographic function, and transmits the scrambled names to the client. The proxy also decrypts incoming cookie names and forwards them to the web server. This intermediary layer enables predictable cookie names to be transformed into unpredictable scrambled names without modifying the original application logic, thus resolving the contradiction between compatibility and security.
Solution Approach 2:
The cookie name parameter is transformed from a predictable, human-readable string into an unpredictable scrambled string through cryptographic functions. The scrambling process changes the parameter's form while maintaining its functional equivalence. The correspondence mechanism stores the mapping between original and scrambled names, allowing the system to maintain cookie functionality while enhancing security through parameter transformation.
2Reliability
If cookie names are scrambled and made unpredictable, then security against cookie stealing is improved, but device complexity increases due to the need for scrambling mechanisms and correspondence tables
Solution Approach 1:
The proxy server acts as a dedicated intermediary that handles all scrambling and unscrambling operations. By isolating the complexity into a separate proxy layer, the original web server and client applications remain simple and unchanged. The proxy maintains the correspondence mechanism locally, managing the mapping between original and scrambled cookie names without adding complexity to the core application logic.
Solution Approach 2:
The security function is segmented into a separate proxy server component rather than being integrated into the web server or client. This segmentation allows the scrambling mechanism to be implemented as a standalone service that can be configured and managed independently. The correspondence mechanism is maintained as a separate data structure in the proxy, separating the security logic from the application logic.
3Ease of operation
If a correspondence mechanism storing application-defined cookie names is implemented, then transparency to application operations is improved, but loss of information may occur if the correspondence table is not properly managed
Solution Approach 1:
The proxy server maintains the correspondence mechanism as a local intermediary structure that maps between original and scrambled cookie names. This correspondence table is stored and managed within the proxy, ensuring that the mapping information is preserved and available for both encryption and decryption operations. The proxy's intermediary position allows it to manage the mapping without exposing it to the application layer, preventing information loss while maintaining transparency.
Solution Approach 2:
The system implements feedback mechanisms where the proxy server receives scrambled cookie names from clients, decrypts them using the correspondence mechanism, and forwards the original names to the web server. Conversely, when the web server sends cookies, the proxy scrambles them and sends the scrambled versions to clients. This feedback loop ensures that the correspondence mapping is continuously maintained and validated, preventing information loss through proper bidirectional translation.
Data Source
Figure 1~4
AI summary
The present invention relates to a server (1) comprising at least an application (10) outputting at least one cookie (C=CN,CV), said server (1) being characterized in that it further comprises a scrambled cookie names generator(11), a correspondence mechanism (12) associating connections attributes for the application (10) with an unpredictable scrambled cookie name(SCN), said scrambled cookie name (SCN) being the one provided in the cookie (C=SCN,CV) sent to client side (2) for use in the next connections to the application (10).