Web Server Security via Session Ticket and IP Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for protecting web servers/web application servers are inadequate in preventing continuous attacks, as attackers can easily change IP addresses using tools like The Onion Router (TOR) or proxy servers, evading detection and causing limitations in blocking intelligent IP address changes.
Innovation Solution
A security management apparatus and method that utilizes a connection state table to store and inspect IP address, SSL/TLS session ticket, and web session information, determining if connections are blocked or represent web session reuse attacks, and blocking access based on these analyses to prevent continuous attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IP address blocking is used to prevent attacks, then attack traffic can be blocked, but attackers can easily change IP addresses using TOR or proxy servers to evade blocking
Solution Approach 1:
The patent transitions from single-dimension IP address blocking to multi-dimensional identification by incorporating SSL/TLS session tickets and web session cookies. This allows tracking attackers across multiple IP addresses by monitoring their session identifiers, effectively adding dimensional depth to the blocking mechanism.
Solution Approach 2:
The system implements feedback by continuously monitoring connection states, analyzing traffic patterns, and dynamically updating blocking policies based on detected attack behaviors. This enables the system to adapt to changing attacker strategies and maintain effective blocking despite IP address changes.
2Reliability
If connection state information is stored and inspected to identify attackers, then continuous attacks can be detected, but system complexity increases due to multiple inspection dimensions
Solution Approach 1:
The connection state table is designed to serve multiple functions: storing IP addresses, SSL/TLS session tickets, web session cookies, and attack detection data. This multi-functional approach consolidates what could be separate systems into a unified structure, managing complexity while enabling comprehensive attack detection.
Solution Approach 2:
The inspection process is divided into distinct segments: connection state information inspection, web session reuse attack determination, and attack pattern analysis. Each segment handles specific aspects of attack detection, making the overall complex system more manageable and maintainable through modular organization.
3Measurement precision
If multiple connection state parameters are monitored (IP address, SSL/TLS session ticket, web session), then attacker tracking improves, but processing time and computational resources increase
Solution Approach 1:
Connection state information including IP addresses, SSL/TLS session tickets, and web session cookies is extracted and stored in the connection state table during the initial connection establishment. This preliminary action prepares the data structure for rapid subsequent inspection and attack detection, reducing processing time during actual security checks.
Data Source
AI summary
A security management apparatus and method for a web server/web application server is provided. The security management apparatus includes a connection state table storage unit for, as a web client accesses a web server/web application server, storing connection state information, an access time, and a connection policy. A connection state information inspection unit inspects whether current connection state information is present in connection state information of the connection state table storage unit in which the connection policy is set to blocking. If current connection state information is not present, a web session reuse attack determination unit determines whether a current connection is a web session reuse attack. If the current connection is not the web session reuse attack, an attack pattern analysis unit analyzes whether an attack pattern is present. A blocking unit blocks a connection between the web client and the web server/web application server.