TOTP Session Security via Segmented Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Session cookies used for securing user sessions are vulnerable to interception and hijacking, as they do not provide sufficient protection against unauthorized access, as hackers can exploit predictable cookies, session sniffing, and other attacks to impersonate users.
Innovation Solution
Implementing a time-based one-time password (TOTP) system that uses a shared secret, generated from user credentials, in conjunction with session cookies to authorize access to protected resources, requiring both the cookie and a valid TOTP for access, with TOTPs being valid only for a limited time window.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If session cookies are used for securing user sessions, then ease of operation is improved, but security is worsened due to vulnerability to interception and hijacking
Solution Approach 1:
The authentication mechanism is segmented into two separate components: session cookies for maintaining user state and TOTP for cryptographic verification. This segmentation allows each component to serve its specific function while together they provide enhanced security against session hijacking attacks
Solution Approach 2:
TOTP acts as an intermediary verification layer between the client and protected resources. The TOTP mechanism mediates the authentication process by requiring cryptographic proof in addition to session cookies, thereby preventing unauthorized access even if cookies are intercepted
2Reliability
If TOTP is required for every access request, then security is improved, but device complexity is worsened
Solution Approach 1:
TOTP verification is applied selectively rather than universally - only to access requests that require enhanced security. The system determines on a per-request basis whether TOTP validation is necessary, avoiding unnecessary complexity for routine operations while maintaining security where needed
Solution Approach 2:
The TOTP generation and verification process is self-contained within the existing access management infrastructure. The WebGate and AM server handle TOTP validation automatically without requiring additional manual intervention or complex external systems
3Reliability
If TOTP validity window is shortened, then security is improved by limiting unauthorized access duration, but loss of time is worsened due to more frequent TOTP updates
Solution Approach 1:
The TOTP validity window parameter is optimized to balance security and usability. Rather than using extremely short intervals, the system employs a moderate time window that provides sufficient security by limiting the duration of compromised TOTPs while avoiding excessive frequency that would burden users
Data Source
AI summary
Techniques for securing user sessions using a time-based one-time password (TOTP) generated from a shared secret. The shared secret can be a cryptographic hash of one or more user credentials. In response to a successful authentication based on the user credential(s), a session is created. The authentication is performed in connection with an initial access request from a client application. A subsequent access request for a protected resource during the session is processed by extracting a session cookie and a TOTP and generating a corresponding TOTP using the shared secret. The TOTP can be generated by combining the shared secret with one or more additional parameters such as a Uniform Resource Locator associated with the resource, or the session cookie. Access to the protected resource is conditioned upon the session, which is identified by the session cookie, being valid and upon the TOTPs matching.