Patent ID: 8079076

Claim:
An apparatus comprising: one or more processors; and logic encoded in one or more tangible media for execution and when executed operable to: establish a first Transmission Control Protocol (TCP) connection between a client and a gateway server, wherein the first TCP connection is authenticated by the gateway server, wherein a first authentication cookie is associated with a client session, between the client and the gateway server, that includes the first TCP connection; while keeping the first TCP connection open: establish a second TCP connection at the gateway server; wherein the second TCP connection is between the gateway server and a different source than the client of the first TCP connection; receive a HyperText Transfer Protocol (HTTP) request at the gateway server over the second TCP connection, wherein the HTTP request includes the first authentication cookie to associate the second TCP connection with the client session; generate a second authentication cookie for the client session; in response to the HTTP request, return the second authentication cookie over the second TCP connection; after returning the second authentication cookie over the second TCP connection and without returning the second authentication cookie over the first TCP connection, determine whether subsequent requests received over the first TCP connection include the second authentication cookie; and detect an attack in response to determining that the subsequent requests do not include the second authentication cookie.