Cookie and behavior-based authentication

Patent metadata

Field	Value
Publication number	US-11233802-B1
Application number	US-202016899379-A
Country	US
Kind code	B1
Filing date	Jun 11, 2020
Priority date	Jun 11, 2020
Publication date	Jan 25, 2022
Grant date	Jan 25, 2022

Abstract

A client sends a request for access to a webpage and receives a cookie and code to obtain data about the client in response to the request. The cookie may be cryptographically secured and contain first data about the client. The client subsequently sends a second request with the cookie to access the same webpage. Any additional information about the client, received in the second request, is then compared with the first data about the client obtained from the cookie to determine whether anomalous activity exists in connection with the client. That is, data about the client is compared to previous client activity history to determine whether there were any anomalous activity and the result of the comparison indicates whether the client is trustworthy.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving, from a client, a first request to access a page on a website;
in response to the first request, providing a first cookie and first code to obtain first data about the client;
receiving, from the client, the first data about the client and a second request to access the website, the second request comprising the first cookie;
generating a second cookie that is linked to the first data about the client, the second cookie being cryptographically secured;
providing the second cookie and second code to obtain second data about the client in response to the second request;
receiving, from the client, a third request to access the website, the third request comprising the second data about the client and the second cookie;
causing the second cookie to be decrypted to obtain the first data about the client;
performing a security check by comparing the first data about the client and the second data about the client; and
using a result of the security check to determine data to send to the client.

2. The computer-implemented method of claim 1 , wherein the first request is a HyperText Transfer Protocol Secure (HTTPS) request for access to the website and the second and third requests are HTTPS requests for access to the same website.

3. The computer-implemented method of claim 1 , wherein generating the second cookie comprises encrypting the first data using a private key obtained from a key management service that is managed by a web server hosting the website, wherein the second cookie comprises the encrypted first data about the client.

4. The computer-implemented method of claim 3 , further comprising:
intercepting, at a proxy, the third request;
sending an instruction, from the proxy to the key management service, to use the private key to decrypt the second cookie to obtain the first data; and
sending a second instruction, from the proxy to a validation service, to perform the security check by using a comparison algorithm to compare the first data and the second data to determine whether the client is authenticated prior to providing access to the website.

5. A system, comprising at least one computing device configured to implement one or more services, wherein the one or more services:
identify, a first request from a client to access a resource from a plurality of resources, first data about the client;
generate a cookie that is linked to the first data about the client, wherein the cookie is cryptographically secured;
identify, from a second request from the client to access the same resource from the plurality of resources, second data about the client, the second request being accompanied with the cookie;
cause the cookie accompanying the second request to be decrypted to obtain the first data about the client; and
compare the first data and the second data to determine how to process the second request.

6. The system of claim 5 , wherein the one or more services further use a proxy to:
intercept the second request;
send an instruction to a key management service to decrypt the cookie to obtain the first data about the client; and
send the first data and second data about the client to a validating service to perform a security check.

7. The system of claim 6 , wherein the validating service performs the security check by using a comparison algorithm to determine whether information from the first data matches information from the second data.

8. The system of claim 7 , wherein the validating service further determines an amount of differences between the first data and second data and compares the amount to a predetermined threshold.

9. The system of claim 8 , wherein the validating service, if the amount of differences do not exceed the predetermined threshold, sends an instruction to a backend service to provide access to the resource in response to the second request.

10. The system of claim 5 , wherein the one or more services of the system further send an instruction to a key management service to encrypt data about the client in the cookie, wherein the key management service is managed by the resource.

11. The system of claim 5 , wherein the one or more services further:
maintain a record, the record including a session identifier and information of expected behavior while the session identifier is in use; and
perform a security check by using the second data and checking it against the record to determine whether the second request is submitted by an authenticated client.

12. The system of claim 5 , wherein the resource comprises a webpage of a main website domain or multiple domains.

13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
identify, from a first request received from a client to access a resource, first data about the client;
generate a cookie to contain the first data about the client, wherein the cookie is cryptographically secured;
identify, from a second request from the client to access the same resource, second data about the client, the second request being accompanied with the cookie;
decrypt the cookie accompanying a second request from the client to access the same resource to obtain data about the client; and
operate in accordance with the results of a comparison between the first data and the second data.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to use a proxy to:
generate the cookie in response to the first request;
send the cookie to the client;
intercept the second request with the cookie;
send an instruction to a key management service to use a key to decrypt the cookie to obtain the first data about the client; and
send the first data and second data about the client to a validating service.

15. The non-transitory computer-readable storage medium of claim 14 , wherein the validating service executes a comparison algorithm to determine whether differences exists between the first data and second data.

16. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions that, as a result of being executed by the one or more processors, cause the computer system to return the cookie with a flag to the client if the differences between the first data and second data exceeds a predetermined threshold.

17. The non-transitory computer-readable storage medium of claim 16 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to use the proxy to send the client an alternative authentication method.

18. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions that, as a result of being executed by the one or more processors, cause the computer system to store expected behavioral activity about the client in a log on a web server.

19. The non-transitory computer-readable storage medium of claim 18 , wherein the instructions that, as a result of being executed by the one or more processors, cause the computer system to compare the second data with the expected behavior activity about the client in the log to determine whether the client is authenticated to access the resource.

2

Assignees

• Amazon Tech Inc

Inventors

• Rudeanu Corneliu-Gabriel-Alexandru
• Manolache Florin-Vasile
• Tronciu Alexandru

Classifications

• H04L67/14

  Session management (for real-time applications in data packet communications networks H04L65/1066) · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04L63/168

  above the transport layer · CPC title

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title