Preventing extraction of secret information over a compromised encrypted connection
AssigneeJuniper Networks, Inc.
InventorsKyle Adams, Daniel J. Quinlan
Life of this patent
Estimating the term…
Abstract
A device may receive, from a first device, a first message that includes a first random cookie and a session cookie. The device may provide the first message to a second device. The device may receive, from the second device, a second message that includes a response to the first message. The device may generate a second random cookie. The second random cookie may be different from the first random cookie. The device may provide, to the first device, the second random cookie, the session cookie, and the response.
Claims21
A device, comprising:
- a memory storing instructions;
- and
- one or more processors, at least partially implemented in hardware, to execute the instructions to:
- receive, from a first device, a first message that includes a first random cookie and a session cookie;
- provide the first message to a second device;
- receive, from the second device, a second message that includes a response to the first message;
- determine a length of the first random cookie;
- generate a second random cookie based on the length of the first random cookie,
- the second random cookie being of a different length than the length of the first random cookie, and
- the second random cookie being generated using one or more characters included in the session cookie;
- and
- provide, to the first device, the second random cookie, the session cookie, and the response.
A method, comprising:
- receiving, by a security device and from a client device, a first request that includes a first random cookie and a session cookie associated with an encrypted communication session;
- providing, by the security device, the first request to a server device;
- receiving, by the security device and from the server device, information associated with a response to the first request;
- determining, by the security device, a length of the first random cookie;
- generating, by the security device and based on the length of the first random cookie, a second random cookie associated with the encrypted communication session,
- the second random cookie being of a different length than the length of the first random cookie, and
- the second random cookie being generated using one or more characters included in the session cookie;
- and
- providing, by the security device and to the client device, the second random cookie, the session cookie, and the information associated with the response to the first request.
A non-transitory computer-readable medium storing instructions, the instructions comprising:
- one or more instructions that, when executed by one or more processors, cause the one or more processors to:
- receive, from a first device, a first message that includes a first random identifier and a session identifier,
- the session identifier identifying an encrypted communication session associated with the first message;
- provide the first message to a second device,
- the second device being different from the first device;
- receive, from the second device, a second message that includes information associated with a response to the first message;
- determine a length of the first random identifier,
- generate a second random identifier based on the length of the first random identifier,
- the second random identifier being of a different length than the length of the first random identifier, and
- the second random identifier being generated using one or more characters included in the session identifier;
- and
- provide, to the first device, the second random identifier and the information associated with the response, without providing the first random identifier.
Dependencies are inferred from the claim text.