Secure cache of web session information using web browser cookies

• US 20040117486A1
• Filed: 12/17/2002
• Published: 06/17/2004
• Est. Priority Date: 03/27/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chan, Victor, Bourne, Donald A., Khusial, Darshanand, Mirlas, Lev, Linehan, Mark H.
• Granted Patent: US 7,197,568 B2
• Time in Patent Office: Days
• US Class Current: 709/228
• CPC Class Codes: G06F 16/9574 of access to content, e.g. by caching
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A secure method and system for accessing a cache for web session is provided using web browser cookies. The cache for the web session data uses an encoded identifier, determined using for example the Keyed-Hash Message Authentication Code, based on information identifying a client. The client communication is accompanied by a cookie (persistent state object) that also includes the identifier encoded in the same manner. This encoded identifier in the received cookie is used for accessing the cached data. Where a secure communication channel is available, such as a secure socket layer (SSL connection), a second cookie which is only transmitted over SSL is used as a signature for the first cookie.

Claims

1. A computer-implemented method for a web-based system to provide data to a client from a data cache, the system comprising a server, the method comprising the following steps:

a) the server generating a cookie comprising an encoded client identifier for the client, the encoded client identifier being generated using the HMAC protocol,

b) the server delivering the cookie to the client;

c) storing the data in the data cache in association with a cache key, the cache key for the data being generated in a manner dependent on the encoded client identifier,

d) the data cache receiving a request including a copy of the cookie from the client; and

e) the data cache retrieving the data from the data cache using the encoded client identifier provided in the copy of the cookie in the request,

f) the data cache delivering said data to the client.

2. The method of claim 1 in which the client identifier comprises a contract identifier and a parent organization identifier.

8. A computer program product comprising a computer usable medium tangibly embodying computer readable program code means for implementation on a web server system, the computer readable program code means comprising code means for carrying out the steps of the method of claims 1-7.

3. A computer-implemented method for a web-based system to provide data to a client from a data cache, the system comprising a server, the method comprising the following steps:

a) the server generating a first state object comprising an encoded client identifier for the client,

b) the server generating a second state object comprising a unique value and an encoded value, the encoded value being encoded using the unique value and the encoded client identifier;

c) the server delivering the first state object to the client;

d) the server delivering the second state object to the client using a secure connection;

e) storing the data in the data cache in association with a cache key, the cache key for the data being generated in a manner dependent on the encoded client identifier;

f) the server receiving a request from the client over a secure channel, the request including a copy of the first state object and a copy of the second state object;

g) verifying the validity of the first state object by extracting the unique value and the encoded value from the received copy of the second state object, encoding said unique value from the received copy of the second state object and the encoded client identifier from the received copy of the first state object to produce a result, and comparing the result with the encoded value to verify the received copy of the first state object; and

h) in the case that the validity of the first state object is verified, retrieving the data in the data cache using the encoded client identifier, and delivering the data to the authorized client.

4. The method of claim 3 in which the first and second state objects are each a cookie and the secure connection is an SSL connection.

5. The method of claim 3 or 4 in which the encoded client identifier, the encoded value, and the result are each encoded using the HMAC protocol.

6. The method of claim 5 in which the client identifier comprises a contract identifier and a parent organization identifier.

7. The method of claim 3 in which the unique value is a nonce comprising one of a monotonically varying set of data values.