Server Parameter Tampering Detection via Hashed Data Strings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures are inadequate in detecting and preventing data tampering when parameter values are passed through user space in web-based e-commerce transactions, as they fail to effectively manage vulnerabilities and do not adapt to changes in data values at the client side.
Innovation Solution
A system and method that involves pre-processing and post-processing steps to detect tampering by formatting data strings with transaction labels and hashes, which are then encrypted and verified upon return, ensuring parameter values have not been altered during transmission through user space.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption and hashing techniques are used to secure data between server and client, then data security is improved, but these techniques cannot detect tampering of data while it resides at the client side
Solution Approach 1:
The server performs preliminary actions by embedding a unique identifier and hash value in the HTML code before transmitting it to the client. This pre-embedded data serves as a reference that enables subsequent detection of any tampering with price parameters during the client-side interaction, allowing the server to verify data integrity without requiring continuous monitoring of the client environment.
2Reliability
If firewall measures are employed to restrict user access, then security is improved, but access to server-based applications by remote users is restricted
Solution Approach 1:
The invention applies a localized quality control mechanism by embedding specific verification elements (unique identifiers and hash values) directly within the HTML code at the point where price parameters are displayed. This allows security verification to occur locally at the client's browser without requiring centralized firewall control or restricting user access, thereby maintaining both security and ease of operation.
3Reliability
If pre-processing and post-processing steps are added to detect parameter tampering, then security against data corruption is improved, but execution speed of server application may be impacted
Solution Approach 1:
The server creates a simplified copy of the price parameter information by embedding a unique identifier and hash value directly in the HTML code. This copy serves as a lightweight verification mechanism that requires minimal processing power compared to traditional encryption and decryption methods, thus providing robust tampering detection while maintaining fast execution speed and not unduly impacting server application performance.
Data Source
AI summary
The invention detects changes in one or more parameter values sent by a server through user space. In one embodiment, a Web server communicates with a client over the Internet. Before sending the parameter value or values to the client, the server performs a pre-processing step, creating a formatted data string. The server then transmits the formatted data string to the client in a URL or a cookie. When the client returns the formatted data string and other data to the server, the server performs a post-processing step to verify that the parameter value or values have not been tampered with. This round trip technique is a departure from approaches that merely detect tampering of data as it passes between two nodes of a network.