TLS Key and CGI Session ID Pairing for Impersonation Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cross-site scripting attacks allow malicious attackers to hijack CGI session IDs, enabling them to impersonate users and access secured web applications, which existing security measures fail to effectively prevent.
Innovation Solution
Implementing a pairing of a Transport Layer Security (TLS) session key and a Common Gateway Interface (CGI) session ID as an authentication mechanism, where the TLS key and CGI session ID are combined and used to verify the authenticity of incoming data, thereby preventing unauthorized access and impersonation attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CGI session ID is used for user authentication, then user identification is enabled, but the system becomes vulnerable to hijacking and impersonation attacks
Solution Approach 1:
The patent combines CGI session ID with TLS session key to create a paired authentication mechanism. The server stores the mapping between CGI session ID and TLS session key, and validates both during authentication. This merging of two security mechanisms ensures that even if one is compromised, the other provides protection against impersonation attacks.
2Reliability
If TLS key is used for encrypted communication, then communication security is improved, but the system cannot prevent session ID hijacking on its own
Solution Approach 1:
The patent implements a feedback mechanism where the server retrieves the TLS session key corresponding to an incoming CGI session ID, compares it with the TLS session key from the current connection, and uses this comparison result to determine whether to allow the session. This feedback loop ensures that session authentication integrity is maintained by verifying the consistency between session ID and TLS key.
3Ease of operation
If only CGI session ID validation is performed, then authentication process is simple, but the system fails to detect hijacked sessions
Solution Approach 1:
The patent performs preliminary action by pre-storing the mapping between CGI session ID and TLS session key in the server before authentication occurs. When a session ID arrives, the server has already prepared the expected TLS key for comparison, enabling rapid and accurate detection of hijacked sessions without adding significant complexity to the authentication process.
Data Source
AI summary
The prevention of impersonation attacks based on hijacked common gateway interface (CGI) session IDs is disclosed. In accordance with one embodiment, a secured communication channel is formed between a server and a client using an initial transport layer security (TLS) key. Additionally, an authenticated CGI session is formed over the secured communication channel based on an initial CGI session identifier (ID). Further, the initial CGI session ID and the initial TLS key are combined into a pair. Next, incoming data that includes an incoming CGI session ID is received via a secured communication channel. An incoming TLS key of the secured communication channel that carries the incoming CGI session ID is then retrieved. Based on the retrieved incoming TLS key, the incoming data is permitted to execute on the server when the incoming TLS key matches the initial TLS key of the pair.