Session Management for Load Testing Authenticated Web Servers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional packet load testing schemes fail to appropriately test devices requiring login authentication, as they necessitate repeated login processing and struggle to isolate issues with web pages accessible only after login, especially when login and web page loads are intertwined, and monitoring difficulties arise due to security measures.
Innovation Solution
A testing device with a session management unit that acquires and manages session information to configure sessions with security-protected devices, a test scenario unit that generates test packets according to predetermined scenarios, and a transmission unit that transmits test packets to increase processing load, allowing for targeted testing of devices with login authentication requirements while minimizing login processing and simulating real-world attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional packet load testing schemes are used on devices requiring login authentication, then the testing can be performed, but login processing must be repeated for each test session and the load of both the to-be-tested Web page and login page are added
Solution Approach 1:
The session management unit performs preliminary login authentication before the actual load testing begins. By establishing a valid session in advance, the system eliminates the need for repeated login processing during test sessions, thereby reducing time loss while maintaining testing reliability.
Solution Approach 2:
The session management unit acts as an intermediary between the test packet transmission and the to-be-tested device. It manages session information and cookies, inserting authentication credentials into test packets automatically, which allows the load testing to proceed without repeated login interruptions.
2Reliability
If monitoring of the login page is performed to protect the entire Web site, then security is improved, but it becomes difficult to discover problems with specific Web pages that may be accessed only after login
Solution Approach 1:
The testing system segments the monitoring function by creating separate test sessions: one for monitoring the login page (to assess security protection) and another for accessing protected Web pages (to detect specific problems). This segmentation allows independent evaluation of each aspect without interference.
Solution Approach 2:
The system adds a new dimension to monitoring by using session management to create distinct testing perspectives. Instead of a single monitoring view, it enables simultaneous monitoring at the login page level and at the protected content level, allowing problem detection in previously inaccessible areas.
3Reliability
If a Web site that displays a login page and a Web site that displays a Web page displayed after login are configured on different sites, then security isolation is improved, but it becomes hard to test only the Web site that displays the Web page displayed after login
Solution Approach 1:
The session management unit provides universal functionality that works across different sites and authentication mechanisms. It can manage session information for multiple domains and insert appropriate cookies into test packets, enabling the same testing apparatus to operate on both the login site and the protected content site without requiring separate testing systems.
Solution Approach 2:
The system copies session information and authentication credentials from the login site to the protected content site through cookie insertion. This copying mechanism allows the test packets to be recognized and authenticated at the second site without requiring physical presence or separate authentication processes.
Data Source
AI summary
A testing device (10) acquires session information to configure a session with a server (23), which is a to-be-tested device, protected by a security device (22) performing authentication of a packet. Then, the testing device (10) generates a test packet with the session information acquired, generates a test session according to a predetermined scenario when transmitting the test packet to the server (23), and transmits to the server (23) a test packet that increases processing load.