Session Cookie Segmentation for Theft Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing browser technologies lack effective mechanisms to protect session cookies from being copied or duplicated by malicious software, leading to potential account and credential theft.
Innovation Solution
The system modifies HTTP requests to include the real values of session cookies, which are stored securely outside the browser's cookie store, thereby preventing unauthorized access and duplication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If session cookies are stored in the browser's cookie store, then ease of operation is improved, but security is worsened due to vulnerability to malicious software copying
Solution Approach 1:
The patent segments the cookie value into two parts: a fake cookie value stored in the browser's cookie store for normal operations, and a real cookie value stored securely outside the browser. This segmentation allows the system to maintain ease of operation while protecting against cookie theft, as malicious software can only access the fake value.
Solution Approach 2:
The patent introduces an intermediary mechanism (the session protection system) that sits between the browser and the web application server. This intermediary intercepts HTTP requests, replaces fake cookie values with real ones, and manages the secure storage, thereby protecting against cookie theft while maintaining transparent operation for the user.
2Reliability
If real cookie values are stored outside the browser's cookie store, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent implements a self-service mechanism where the session protection system automatically manages the replacement of fake and real cookie values without requiring user intervention. The system monitors HTTP requests, performs automatic substitution, and handles secure storage management, thereby improving reliability while minimizing the perceived complexity for users.
Solution Approach 2:
The session protection system acts as an intermediary layer that automatically manages the complexity of storing and retrieving real cookie values outside the browser. This intermediary handles all the complex operations of intercepting requests, replacing cookie values, and managing secure storage, presenting a simple interface to both the user and the browser.
3Object-affected harmful factors
If the browser's natural functionality is intercepted and modified, then security is improved by preventing cookie theft, but ease of operation is worsened due to additional processing
Solution Approach 1:
The patent ensures continuity of useful action by making the cookie replacement process transparent and automatic. The session protection system continuously monitors HTTP requests and performs real-time substitution of cookie values without interrupting the user's browsing flow. This maintains ease of operation while preventing cookie theft, as the process occurs seamlessly in the background.
Solution Approach 2:
The session protection system serves as an intermediary that transparently modifies HTTP requests by replacing fake cookie values with real ones. This intermediary operation occurs automatically in the background without requiring user awareness or additional manual steps, thereby preventing cookie duplication while maintaining ease of operation for the end user.
Data Source
AI summary
Method for enhancing a user's browsing security including providing solution code on a user's device; each time a user browses to a service/webapp made available to users by a webapp server, using the solution code for removing real cookie/s sent to the user's browser by the webapp server and stored by user U's browser in a cookie store in the user's device; storing the real cookie in storage accessible to the solution code but outside the cookie store; and subsequently, e.g. when the browser on the user's device sends a request which needs to include said real cookie, toward the service/webapp, accessing the real cookie from the storage outside the cookie store, modifying the request by adding the real cookie as accessed, and sending the request as modified on to the webapp server.