Web Application User Tracking via Authentication Forms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current web application security systems inadequately correlate multiple requests during attacks due to the use of network address translation (NAT) and attackers' ability to quickly switch IP addresses, making it difficult to track and identify user identities effectively.
Innovation Solution
A method is introduced to generate an application normal behavior profile (NBP) that includes authentication identifiers, which determines the success or failure of authentication requests and attaches user identification to subsequent requests, enabling robust correlation of user actions across sessions and detecting brute force attacks by analyzing HTML forms and login patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional network security techniques relying on source IP address are used for correlation, then the system is simple to implement, but the correlation accuracy deteriorates due to NAT and IP switching
Solution Approach 1:
The patent introduces an intermediary correlation mechanism that uses authentication forms and login patterns as mediators between the client and server. Instead of directly relying on IP addresses, the system uses HTML forms with hidden authentication identifiers that persist through redirects and sessions, enabling accurate tracking without being affected by IP changes or NAT
Solution Approach 2:
The patent creates copies of authentication identifiers within HTML forms that are sent with each request. These form-based identifiers are replicated and maintained across multiple requests and redirects, providing a persistent identity marker that survives IP changes and NAT transitions, unlike session cookies which can be refused by clients
2Reliability
If session-based correlation techniques are used, then the correlation mechanism is more adequate than IP-based methods, but the reliability deteriorates because session creation is controlled by the client
Solution Approach 1:
The patent inverts the traditional approach by not relying on server-created session identifiers that clients may refuse. Instead, it embeds authentication identifiers directly within HTML forms that are naturally accepted and processed by clients during normal authentication flows. The correlation is achieved through form submission patterns rather than cookie-based sessions
Solution Approach 2:
The system uses the client's own authentication form submissions as the basis for correlation. The client naturally fills out and submits authentication forms during normal operation, and the system leverages these self-submitted forms containing authentication identifiers for tracking, without requiring the client to accept additional cookies or session management mechanisms
3Measurement precision
If authentication identifiers are embedded in HTML forms, then the tracking accuracy improves, but the implementation complexity increases due to form analysis requirements
Solution Approach 1:
The patent performs preliminary analysis during a learning phase to automatically identify authentication forms and their patterns before deployment. The system pre-processes HTML content to locate forms containing authentication identifiers, extracts their structures, and builds correlation rules in advance, eliminating the need for complex real-time form analysis during operational tracking
Solution Approach 2:
The system uses feedback from analyzing authentication responses to refine its identification of authentication forms. By monitoring successful and unsuccessful authentication outcomes, the system learns which forms contain valid authentication identifiers and adjusts its tracking methodology accordingly, improving accuracy without increasing implementation complexity
Data Source
AI summary
A method for tracking and identifying an identity of a user accessing a web application. An application normal behavior profile (NBP), wherein said NBP includes a plurality of authentication identifiers of the web application is generated. It is determined using the NBP whether an authentication request submitted by the user was successful. A first actionable data on a successful authentication request is saved. A second actionable data on an unsuccessful authentication request is saved.