Secure Cookies on the Web JOON S. PARK AND RAVI SANDHU George Mason University he World Wide Web facilitates e-commerce on the Internet via its underlying hypertext transport protocol, which carries all interactions between Web servers and browsers. 1 Since HTTP is stateless, however, it does not support continuity for browser-server interaction between successive user visits. Without a concept of a session in HTTP, users are strangers to a website every time they access the Web server. Cookies were invented to maintain continuity and state on the Web. They contain text-character strings encoding relevant information about the user. Cookies are sent to the user's hard drive or RAM via the browser while the user visits a cookie-using website. The Web server retrieves the user's information from those cookies when the user later returns to the same website. The cookie's purpose is to acquire information for use in subsequent server-browser communications without asking for the same information. It is not technically difficult to encode cookies with relevant information. For instance, a merchant Web server could use a cookie that contains the user's name and credit card numbers. Although this would be convenient for users, it would also be risky. Because they are stored and transmitted in clear text, cookies are readable and easily forged. One way to solve this problem is to make cookies secure, and in this article we discuss several techniques that render cookies secure for carrying and storing sensitive data. We show how secure cookies enable secure attribute services between (and without modifying) existing Web servers and browsers, and identify representative applications for this technology. Secure cookies are constructed using well-known cryptographic techniques such as message digests, digital signatures, message authentication codes, and encryption. The detailed mechanism depends on how these techniques are applied to implement secure cookies and to which Web services secure cookies are applied. Notably, secure cookies can be issued by one Web server for use by another, which facilitates secure attribute services. Different techniques for secure cookies are needed to provide tradeoffs between security and convenience for end users, system administrators, and application developers. Since cookies are inherently userpull, 4 we focus on the user-pull architecture in this article. Our focus is on integrity, authenticity, and confidentiality for nonanonymous Web transactions.
In 2000, REF suggested address-based (IP_Cookie), password-based (Pswd_Cookie) and digital signature (Sign_Cookie)-based secure cookies for the user authentication.
Secure Cookies on the Web
IEEE Internet Computing
Computer Science