Secure Tunnel Session Identification via Server Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Browser cookies used for user session identification in reverse proxy systems are vulnerable to theft by malicious software, allowing unauthorized access through stolen cookies, compromising security.
Innovation Solution
Implementing a secure communication tunnel between a client and an HTTP reverse proxy server that uses a random number and secure hash for user session identification, eliminating the need for browser cookies and protecting against Trojan access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If browser cookies are used for user session identification, then user authentication and session management is simplified, but security is compromised as cookies can be stolen by Trojans
Solution Approach 1:
The patent extracts the session identification mechanism from browser cookies and relocates it to server-side tokens. The server generates unique tokens for each user session and stores them in a secure database, eliminating the need for client-side cookies that can be stolen by Trojans.
Solution Approach 2:
The patent introduces server-side tokens as an intermediary between the user and the authentication system. These tokens are generated by the server, transmitted to the client, and then used to establish sessions, creating a secure intermediary layer that prevents direct exposure of authentication credentials to malicious software.
2Reliability
If mutual SSL authentication is implemented, then security is enhanced, but authentication complexity and processing overhead increases
Solution Approach 1:
The patent segments the authentication process into distinct phases: initial SSL handshaking for secure communication establishment, followed by server-side token generation for session identification. This segmentation allows the system to achieve security through SSL while simplifying the overall authentication flow by separating encryption from session management.
Solution Approach 2:
The patent changes the authentication parameters from mutual certificate verification to a combination of SSL authentication and server-side token validation. This parameter change maintains security through SSL while reducing the complexity of the authentication process by using simpler token-based session management instead of complex mutual authentication.
3Duration of action of stationary object
If cookies are stored in browser memory, then session persistence is achieved, but vulnerability to Trojan theft increases
Solution Approach 1:
The patent employs short-lived server-side tokens that are generated for each session and automatically invalidated after use or after a predetermined time period. These tokens are more secure than persistent cookies because they are not stored in browser memory and cannot be reused by Trojans once invalidated.
Solution Approach 2:
The patent implements prior cushioning by generating and validating server-side tokens before establishing long-term sessions. The tokens are created with built-in expiration times and are validated by the server before allowing access, creating a protective layer that prevents Trojan theft even if cookies were compromised.
Data Source
AI summary
Apparatus, systems, and methods may operate to establish a secure communications tunnel between a server node and a client node, and to receive user requests from the client node at the server node via the secure communications tunnel. The user requests may be received in conjunction with a device verification token derived from nonces generated by the server node and transmitted to the client node as part of keep-alive response messages. The nonces may change according to a period of time established by the server node. Additional apparatus, systems, and methods are disclosed.