Secure Session Management in Web Farms via Token Rotation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Session management in web farms faces security issues due to the risk of session token hijacking and compatibility problems across servers with different platforms, where session tokens generated by one server may not be recognized by others.
Innovation Solution
The method involves decrypting session tokens at the first server, redirecting the request to a second server, and creating a new encrypted session token, using a common session database and session management web service to verify and update session tokens, ensuring secure and platform-independent session management across multiple servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Duration of action of stationary object
If session tokens are used for session management, then session continuity can be maintained, but security risk increases due to session hijacking
Solution Approach 1:
The patent introduces an intermediary validation mechanism where session tokens are validated through a centralized validation component rather than being directly trusted. The session token passes through multiple validation layers including format verification, database verification, and server verification, acting as an intermediary filter between the client and the session management system.
Solution Approach 2:
The patent implements preliminary validation actions before session tokens are fully processed. The validation component performs preliminary checks on token format, expiration, and authenticity before the session is fully established, preventing hijacked sessions from being accepted in the first place.
2Adaptability or versatility
If session tokens are generated by individual servers in a web farm, then each server can manage sessions independently, but compatibility problems arise across servers with different platforms
Solution Approach 1:
The patent creates a universal session token validation mechanism that works across all servers in the web farm regardless of their underlying platforms. The validation component serves multiple functions: format validation, database verification, and cross-server recognition, making the session management system universally compatible across different server environments.
Solution Approach 2:
The validation component acts as an intermediary layer between individual servers and the session management system. It translates and validates session tokens in a platform-independent manner, allowing servers with different platforms to communicate session information reliably through a common validation interface.
3Ease of operation
If session tokens are transmitted between browser and web server, then session identification is enabled, but security vulnerabilities increase
Solution Approach 1:
The validation component serves as an intermediary security layer between the transmitted session token and the session management system. It validates the token through multiple verification steps (format, database, server) before accepting it, maintaining ease of session identification while filtering out malicious tokens.
Solution Approach 2:
The system implements feedback mechanisms where the validation component continuously verifies session tokens against multiple criteria and provides feedback on token validity. This feedback loop ensures that only valid, non-hijacked sessions are accepted, reducing security vulnerabilities while maintaining operational ease.
Data Source
AI summary
A system and method for secure session management in a web farm using a session token. A session management web service updates the session token with each request received from a browser. If the request must be redirected to a new server where the requested resource is located, then the decrypted session token is transmitted to the new server and the session management web service generates a new session token to be used in place of the previous session token. The new session token is transmitted to the browser with the requested web resource.