Application security through multi-factor fingerprinting
AssigneeSap SE
InventorsCedric Hebert, Andrea Palmieri, Merve Sahin, Anderson Santana de Oliveira
Life of this patent
Estimating the term…
Abstract
Systems, methods, and computer media for securing software applications are provided herein. The multi-factor fingerprints allow attackers to be distinguished from authorized users and allow different types of attacks to be distinguished. The multi-factor fingerprint can include, for example, a session identifier component, a software information component, and a hardware information component. The different components can be separately compared to components of stored fingerprints to determine whether an application session request is malicious, and if so, what type of attack, such as session cookie theft or a spoofing attack, is occurring.
Claims20
A method for securing an application, the method comprising:
- receiving a request from a computing device for a session with the application;
- capturing information associated with the request, including:
- a session identifier, software information for the device, and hardware information for the device;
- based on the captured information, generating a fingerprint associated with the request, the fingerprint having session identifier, software information, and hardware information components;
- separately comparing the respective individual components of the fingerprint associated with the request to corresponding components of a group of stored fingerprints;
- determining that the request for the session is malicious based on results of the separate comparison of the individual components of the fingerprint;
- identifying a malicious scenario type for the malicious request for the session based on which of the separately compared individual components of the fingerprint matches a corresponding component of one or more fingerprints in the group of stored fingerprints;
- and
- limiting access to data associated with the application for the malicious request for the session.
A system, comprising:
- a processor;
- and
- one or more computer-readable storage media storing computer-readable instructions that, when executed by the processor, perform operations comprising:
- receiving a request from a browser of a computing device for a session with an application;
- capturing information associated with the request, including:
- a session identifier, browser information for the device, and hardware information for the device;
- based on the captured information, generating a multi-factor fingerprint for the request, the multi-factor fingerprint having separately comparable components including a session identifier component, a browser information component, and a hardware information component;
- separately comparing the respective individual components of the multi-factor fingerprint associated with the request to corresponding components of a group of stored fingerprints;
- determining that the request for the session is malicious based on results of the separate comparison of the individual components of the multi-factor fingerprint;
- identifying a malicious scenario type for the malicious request for the session based on which of the separately compared individual components of the multi-factor fingerprint matches a corresponding component of one or more fingerprints in the group of stored fingerprints;
- and
- upon determining, based on the comparison, that the request for the session is malicious, limiting access to data associated with the application.
One or more non-transitory computer-readable storage media storing computer-executable instructions for securing an application, the securing comprising:
- receiving a request from a browser of a computing device for a session with an application;
- capturing information associated with the request, including:
- a session identifier, browser information for the device, hardware information for the device, location information, and user information;
- based on the captured information, generating a multi-factor fingerprint for the request, the multi-factor fingerprint having separately comparable components including a session identifier component, a browser information component, a hardware information component, a location information component, and a user information component;
- comparing the respective components of the multi-factor fingerprint associated with the request to corresponding components of a group of stored fingerprints;
- and
- upon determining, based on the comparison, that the request for the session is malicious, establishing a cloned application session in which at least some of the data provided in the cloned application session is alternative data provided in place of data associated with the application.
Dependencies are inferred from the claim text.