Hypertext transfer protocol (HTTP) cookies are used to store user-related information sent by a website, and they can be read again later to maintain a link between a user's computer and the website and to remember the user's previous state on the website. In cloud services, cookies are used by service providers to maintain smooth operation for users. As cookies are sent in a public networking environment and saved on users' browsers, two problems are encountered when using cookies: (a) how to protect sensitive information on a cookie from disclosure and (b) how to determine whether cookies have been modified maliciously. Several studies have been conducted on web security to assess problems that occur when cookies are injected and hijacked. In the present study, a secure and efficient cookie protection scheme is proposed. The scheme is designed with the following principles: (a) a key is hidden within a cookie, (b) the integrity of the cookie is verified by both the web server and the web browser, and (c) the key and sensitive information in the cookie can only be read by the website. The proposed method was analyzed for its security and efficiency. Moreover, the methods from related studies and the proposed method were compared. The results revealed that the proposed cookie scheme is effective at improving cookie security.

Phishing is a popular technique that attackers use for the obtainment of sensitive information about users. Last year, over 44 million users became victims of phishing websites. Mutual authentication between user and server is an essential part of anti-phishing mechanisms. Lee et al. proposed a scheme that achieves mutual authentication to protect users from phishing attacks. However, a sensitive key table is necessary if users want to achieve mutual authentication on different servers. This attracts attackers' attention and increases the cost of maintaining the key. In this paper, a novel anti-phishing authentication scheme without a sensitive key table is presented. No sensitive key table is needed if the user is present at that time. Moreover, the proposed scheme can prevent guessing and replay attacks, which are serious threats to user authentication.