# US 12,120,226 B2 · Preventing HTTP cookie stealing using cookie morphing

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,120,226 B2
- Document ID: US12120226B2
- Status: Granted
- Kind: B2
- Application number: 17/097,255
- Filed: 2020-11-13
- Published: 2022-05-19
- Granted: 2024-10-15
- Earliest claimed: 2020-11-13
- Assignees: Citrix Systems, Inc.
- Applicants: Citrix Systems, Inc.
- Inventors: Daniel G. Wing; Ratnesh Singh Thakur; Arkesh Kumar; Raghukrishna Hegde; Nivedita Jagdale; Ramachandra Kasyap Marmavula; Joseph Hoelbrandt; Girish Chandra Padhi
- Web page: https://patentgrep.com/patent/US12120226B2

## CPC

- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- G06F 21/606: {by securing the transmission between two devices or processes}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Described embodiments provide systems and methods for morphing or regenerating validation information. A client can receive, via a device, an authentication cookie for access to a server. The device may maintain a sequence number and a cryptographic secret. The client may use the cryptographic secret and a cookie engine to generate validation cookie information with an updated sequence number. The client may send the authentication cookie to the device via a hypertext transfer protocol (HTTP) message to validate the authentication cookie. The client may send the validation cookie information with the updated sequence number to the device via a HTTP message to validate the authentication cookie.

## Claims

### Claim 1

A method comprising:
receiving, by a client via a device, an authentication cookie for access to a server, the device maintaining a sequence number and a cryptographic secret;
receiving, by the client from the device, a cookie engine, the cookie engine being executable code that when executed generates validation cookie information;
generating, by the client using the cryptographic secret and the cookie engine, validation cookie information with an updated sequence number increased by the client by a predetermined defined value responsive to generating the validation cookie information; and
sending, by the client to the device via a hypertext transfer protocol (HTTP) message, the authentication cookie, and the validation cookie information with the updated sequence number to validate the authentication cookie.

### Claim 2 (depends on 1)

The method of claim 1, wherein generating the validation cookie information comprises:
modifying, by the client using the cryptographic secret and the cookie engine, a cookie generated by the device, into the validation cookie information which comprises a validation cookie.

### Claim 3 (depends on 1)

The method of claim 1, wherein generating the validation cookie information comprises:
generating, by the client using the cryptographic secret and the cookie engine, the validation cookie information which comprises a validation cookie.

### Claim 4 (depends on 1)

The method of claim 1, wherein the HTTP message comprises a HTTP GET message, a HTTP INFO message, or a HTTP HEAD message.

### Claim 5 (depends on 1)

The method of claim 1, wherein generating the validation cookie information with the updated sequence number comprises:
incrementing, by the client, the sequence number by a defined value.

### Claim 6 (depends on 1)

The method of claim 1, comprising:
generating, by the client using the cryptographic secret and the cookie engine, at each of a plurality of time instances, a respective validation cookie information with a respective updated sequence number.

### Claim 7 (depends on 1)

The method of claim 1, comprising:
detecting, by a browser feature of the client, that the HTTP message is to be sent; and
generating, by the client responsive to the detection, the validation cookie information with the updated sequence number.

### Claim 8 (depends on 1)

The method of claim 1, comprising:
initiating, by the client, a new secure connection; and
receiving, by the client responsive to the new secure connection, a redirect from the device to the client; and
generating, by the client upon the redirect, the validation cookie information with the updated sequence number.

### Claim 9 (depends on 1)

The method of claim 1, comprising:
storing, by the client, the updated sequence number in a local storage; and
accessing, by the client after a page refresh, the updated sequence number from the local storage.

### Claim 10 (depends on 1)

The method of claim 1, wherein generating the validation cookie information comprises:
receiving, by the client, a validation cookie and the sequence number from the device; and
obtaining, by the client using the cookie engine, a hash-based message authentication code (HMAC) of the validation cookie and the sequence number.

### Claim 11 (depends on 10)

The method of claim 10, comprising:
obtaining, by the client, the updated sequence number by incrementing the sequence number; and
causing the device to validate the HMAC and the updated sequence number.

### Claim 12 (depends on 1)

The method of claim 1, comprising:
causing the device to remove the validation cookie information from the HTTP message and to communicate the HTTP message with the authentication cookie to the server, responsive to successful validation of the authentication cookie.

### Claim 13 (depends on 1)

The method of claim 1, wherein the device is intermediary between the client and the server.

### Claim 14

A client comprising:
a memory;
at least one processor configured to:
receive, from a device, an authentication cookie for access to a server, the device maintaining a sequence number and a cryptographic secret;
receive, from the device, a cookie engine, the cookie engine being executable code that when executed generates validation cookie information;
generate, using the cryptographic secret and the cookie engine, validation cookie information with an updated sequence number increased by the client by a predetermined defined value responsive to generating the validation cookie information; and
send, to the device via a hypertext transfer protocol (HTTP) message, the authentication cookie, and the validation cookie information with the updated sequence number to validate the authentication cookie.

### Claim 15 (depends on 14)

The client of claim 14, wherein the cookie engine is received via a HTTP message from the device.

### Claim 16 (depends on 14)

The client of claim 14, wherein the at least one processor is configured to generate the validation cookie information by:
modifying, using the cryptographic secret and the cookie engine, a cookie generated by the device, into the validation cookie information which comprises a validation cookie.

### Claim 17 (depends on 14)

The client of claim 14, wherein the at least one processor is configured to generate the validation cookie information by:
generating, using the cryptographic secret and the cookie engine, the validation cookie information which comprises a validation cookie.

### Claim 18 (depends on 14)

The client of claim 14, wherein the HTTP message comprises a HTTP GET message, a HTTP INFO message, or a HTTP HEAD message.

### Claim 19 (depends on 14)

The client of claim 14, wherein the at least one processor is configured to generate the validation cookie information with the updated sequence number by:
incrementing the sequence number by a defined value.

### Claim 20 (depends on 14)

The client of claim 14, wherein the at least one processor is configured to generate, using the cryptographic secret and the cookie engine, at each of a plurality of time instances, a respective validation cookie information with a respective updated sequence number.

### Claim 21

A method comprising:
sending, by a device to a client, an authentication cookie for access to a server, the device maintaining a sequence number and a cryptographic secret;
sending, by the device to the client, a cookie engine, the cookie engine being executable code that when executed generates validation cookie information, wherein the validation cookie information is generated with an updated sequence number at the client using the cryptographic secret and the cookie engine;
receiving, by the device from the client via a hypertext transfer protocol (HTTP) message, the authentication cookie, and the validation cookie information with the updated sequence number increased by the client by a predetermined defined value responsive to generating the validation cookie information; and
determining, by the device according to the validation cookie information and the updated sequence number, whether to validate the authentication cookie.

### Claim 22 (depends on 21)

The method of claim 21, comprising:
injecting, by the device, the executable code of the cookie engine into another HTTP message, wherein sending, by the device to the client, the cookie engine comprises sending the another HTTP message.

### Claim 23 (depends on 21)

The method of claim 21, comprising:
sending, by the device responsive to initiation of a new secure connection at the client, a redirect to the client; and
causing, via the redirect, the client to generate the validation cookie information with the updated sequence number.

### Claim 24 (depends on 21)

The method of claim 21, comprising:
removing, by the device, the validation cookie information from the HTTP message responsive to successful validation of the authentication cookie; and
communicating, by the device, the HTTP message with the authentication cookie to the server.