TLS key and CGI session ID pairing
AssigneeMicrosoft Corporation
InventorPeter Loveless
Life of this patent
Estimating the term…
Loading patent…
AssigneeMicrosoft Corporation
InventorPeter Loveless
Estimating the term…
The prevention of impersonation attacks based on hijacked common gateway interface (CGI) session IDs is disclosed. In accordance with one embodiment, a secured communication channel is formed between a server and a client using an initial transport layer security (TLS) key. Additionally, an authenticated CGI session is formed over the secured communication channel based on an initial CGI session identifier (ID). Further, the initial CGI session ID and the initial TLS key are combined into a pair. Next, incoming data that includes an incoming CGI session ID is received via a secured communication channel. An incoming TLS key of the secured communication channel that carries the incoming CGI session ID is then retrieved. Based on the retrieved incoming TLS key, the incoming data is permitted to execute on the server when the incoming TLS key matches the initial TLS key of the pair.
A method for facilitating communication between a server and a first client, comprising:
A computer readable storage device storing computer-executable instructions that, when executed, cause one or more processors to perform acts comprising:
A server, comprising:
Dependencies are inferred from the claim text.