Secure Cookie Authentication via High Trust Process Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cookies used for secure sessions between users and websites are vulnerable to theft, allowing malevolent actors to hijack accounts or steal private data, as they can be reused even if stolen.
Innovation Solution
Implementing a secure cookie system where a high trust process, running in a secure context, generates an authentication proof using a secure key, which is then used to create a secure cookie that expires quickly, limiting the value of stolen cookies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a cookie is used to maintain a secure session between user and website, then the user can access the website conveniently, but the cookie becomes vulnerable to theft and can be reused by malevolent actors
Solution Approach 1:
The authentication mechanism is segmented into multiple components: a cookie for session identification and a separate authentication proof for verification. The authentication proof is further segmented into a signature portion (generated by high trust process using secure key) and a nonce portion (generated by low trust process), which are combined to create a tamper-resistant authentication token that cannot be reused.
Solution Approach 2:
A trusted execution environment (TEE) or secure enclave acts as an intermediary between the low trust web browser process and the authentication service. This intermediary generates and protects the secure key, creates the authentication proof, and verifies the nonce, preventing malevolent actors from accessing or reusing authentication credentials while maintaining convenient web access.
2Loss of time
If a cookie with long validity period is used, then the user can access the website without frequent re-authentication, but the stolen cookie remains useful for longer period
Solution Approach 1:
The authentication mechanism dynamically combines a static cookie with a dynamic nonce that changes with each authentication request. The authentication proof includes both the cookie value and a unique nonce generated by the low trust process, ensuring that even if a cookie is stolen, it cannot be reused because the complete authentication proof (cookie + nonce + signature) is required for each session.
Solution Approach 2:
The authentication proof is designed as a short-living, disposable credential that is valid for only one authentication request. After verification by the authentication service, the proof becomes invalid, preventing replay attacks. This allows the system to use longer-lived cookies for convenience while maintaining security through single-use authentication proofs.
3Reliability
If a secure key is stored in a high trust process to generate authentication proof, then the security against cookie theft is enhanced, but the complexity of the system increases
Solution Approach 1:
The secure key and authentication proof generation are nested within a trusted execution environment (TEE) or secure enclave, which is itself nested within the operating system, which is nested within the web browser. This nested structure allows the high trust process to provide strong security while the low trust web browser process handles user interaction, managing complexity through hierarchical isolation.
Solution Approach 2:
The trusted execution environment automatically generates and manages the secure key without requiring user intervention or manual configuration. The high trust process self-manages the cryptographic operations, key protection, and authentication proof generation, reducing system complexity by automating security-critical functions rather than requiring manual security management.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one embodiment, a user device may access a network service using a secure cookie. A high trust process may create an authentication proof using a secure key. The high trust process may provide a browsing token and the authentication proof to a low trust process to send to an authentication service.