Super-Cookie Identification Using Sequential Storage Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Stolen cookies pose a significant security risk as attackers can impersonate users and gain access to secure information without manual authentication, compromising the security of user accounts.
Innovation Solution
Implement a super-cookie identification system that uses sequential encryption to link cookie values across storage locations based on fraud risk, distinguishing between new and recurring visitors, and employing a private encryption key to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If cookies are stored on user devices for authentication convenience, then user login efficiency is improved, but security against stolen cookie attacks deteriorates
Solution Approach 1:
The cookie storage is segmented into multiple storage locations (e.g., httpOnly cookies, localStorage, sessionStorage, IndexedDB) rather than relying on a single cookie. This segmentation allows the system to detect when cookies are stolen by comparing values across locations, as attackers typically can only access one location. The authentication system checks multiple segments to verify cookie integrity.
Solution Approach 2:
A server-side verification mechanism acts as an intermediary between the client cookie and the authentication decision. The server receives authentication requests with cookies, verifies them against stored expected values, and determines whether to grant access. This intermediary layer prevents direct trust in client-provided cookies and enables detection of stolen cookies.
2Ease of operation
If traditional cookie authentication is used, then ease of operation is improved, but vulnerability to fraud increases
Solution Approach 1:
The system performs preliminary verification of cookies before granting authentication. Instead of directly accepting cookies for login, the system first checks whether the cookie values match expected values stored on the server. This preliminary action prevents stolen cookies from successfully impersonating users while maintaining convenience for legitimate users.
Solution Approach 2:
The authentication system implements feedback by comparing actual cookie values against expected cookie values and using this comparison to determine authentication outcomes. When cookie values don't match (indicating potential theft), the system rejects authentication. This feedback loop enables dynamic security responses based on cookie integrity verification.
Data Source
AI summary
Methods and systems are presented for stolen cookie detection. An authentication request is received for a user to access a website using a web browser executable at the user's device. A series of storage locations available on the device for storing web cookies is identified and sorted in order of increasing fraud risk starting from a first storage location. A cookie value for each storage location is retrieved from the device. For each storage location after the first: an expected cookie value is calculated based on the cookie value of a preceding storage location; the expected cookie value is compared with the value retrieved for the storage location; and a score representing a level of fraud risk for the storage location is assigned. The authentication request is processed based on whether the assigned score for at least one of the storage locations exceeds a predetermined risk tolerance for fraud detection.