Method for preventing session token theft

• US 20080222299A1
• Filed: 03/07/2007
• Published: 09/11/2008
• Est. Priority Date: 03/07/2007
• Status: Abandoned Application

• Current Assignee: Trusteer Ltd (International Business Machines Corporation)
• Original Assignee: Trusteer Ltd (International Business Machines Corporation)
• Inventors: Boodaei, Michael
• Application Number:
  US11/714,932
• Publication Number:
  US 20080222299A1
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

The present invention relates to a method for preventing the theft of a session token comprising the steps of: (a) detecting a submission of a first request from the client'"'"'s browser to a protected site; (b) redirecting said first request to the traffic processor for monitoring said first request; (c) forwarding said first request from said traffic processor to said protected site; (d) receiving the response containing the session token from said protected site by said traffic processor; (e) storing said session token in the session table; (f) providing a token index for indexing said session token stored in said session table; (g) modifying the content of said response by changing said session token to said token index; and (h) forwarding the modified response from said traffic processor to said browser.

Claims

1. A method for preventing the theft of a session token comprising the steps of:

a. detecting a submission of a first request from the client'"'"'s browser to a protected site;

b. redirecting said first request to the traffic processor for monitoring said first request;

c. forwarding said first request from said traffic processor to said protected site;

d. receiving the response containing the session token from said protected site by said traffic processor;

e. storing said session token in the session table;

f. providing a token index for indexing said session token stored in said session table;

g. modifying the content of said response by changing said session token to said token index; and

h. forwarding the modified response from said traffic processor to said browser.

2. A method according to claim 1, further comprising the steps of:

i. attaching by the browser the token index to a second request intended for the protected site;

j. redirecting said second request to the traffic processor by the redirector;

k. modifying said second request by replacing said token index of said second response with the corresponding session token from the session table; and

l. forwarding the modified second request to said protected site;

3. A method according to claim 1, wherein prior to forwarding the first request modifying said first request by deleting the session token.

4. A method according to claim 1 wherein the session table stores more than one session tokens.

5. A method according to claim 1 wherein the forwarding of the request(s) by the traffic processor and the receiving of response(s) from the protected site is done using a secure path.

6. A method according to claim 1 wherein the first request from the client'"'"'s browser is the login request.