Robust and low-cost solution for preventing sidejacking attacks in wireless networks using a rolling code

Abstract

With the recent explosion in wireless hotspots, more and more users find themselves browsing the internet in an insecure manner. This is due to the typical lack of security in the Wi-Fi Access Points at popular hotspots such as coffee shops and airports. A common vulnerability in this scenario is when a user's cookie information is transmitted in plain-text, exposing potential session information. This would typically include the session id, which, if stolen, could lead to session hijacking, also known as sidejacking. In this paper, we present a novel way of authenticating the client to the server using what we call a Rolling Code, much like the rolling code technology used to prevent perpetrators from recording a code and replaying it to open a garage door. By using this technique, the client is able to prove to the server with each request that they are the legitimate client and no other person could have hijacked the session. Our protocol also offers optional payload integrity and confidentiality via a multilevel security model. Our Rolling Code protocol is efficient and is particularly suitable for mobile devices used in wireless networks. We implemented a benchmark of the Rolling Code authentication and used it to evaluate the performance of the scheme for different hardware platforms. Our tests have shown that the Rolling Code protocol is more computationally efficient than the hash chains approach used in a recent cookie security protocol to prevent session sidejacking.

A hierarchical two-tier one-way hash chain protocol for secure internet transactions

“…The hash chain approach used by the OTC scheme generates a sequence of values to be used as authentication tokens which cannot be reused once recognized by the web application. Another approach, the Rolling Code protocol [8], replaces the hash chain by two hash operations in each transaction: one to compute a randomized value d and the other to produce a one-time authentication token by applying a hash function on the Exclusive-OR of a secret seed and the random value d. The protocol is less secure than OTC but is lightweight and more suitable for devices with low memory capabilities. The SCRHC protocol [9] also uses a similar OHC approach equipped with different levels of caching to suit various environments with different memory capacities.…”

“…In this case, the dynamic TTOHC configuration would be practically acceptable because the early (more certain) transactions would be authenticated by second-tier chains of small lengths (e.g., 1,2,4,8) and are therefore given good performance. …”

Protocol for Mitigating the Risk of Hijacking Social Networking Sites

“…In [6], we presented a protocol to prevent cookie hijacking in wireless networks. The protocol, called Rolling Code, utilizes the initial secure HTTPS authentication to exchange a shared secret between the server and the user browser.…”

“…In this section, we extend our work in [6] and present a security authentication protocol for mitigating the risk of hijacking social networking sites. It is important to stress that our protocol is only intended to prevent attacks related to cookie hijacking in social networks.…”

“…miniCacheInterval := √k //square root of k miniCacheK := k -miniCacheInterval //highest item miniCacheIndex := cache.size -1 //point to last item cache[0] = s; For i := 1 to miniCacheIndex Do cache[i] := hash miniCacheInterval (cache[i-1]) End-For For example, if k is 100, then miniCacheInterval = 10, miniCacheK = 90, and miniCacheIndex = 9. The For-Loop essentially achieves the following: cache[0] = hash 0 (s), cache [1] = hash 10 (s), cache [2] = hash 20 (s), cache [3] = hash 30 (s), cache [4] = hash 40 (s), cache [5] = hash 50 (s), cache [6] = hash 60 (s), cache [7] = hash 70 (s), cache [8] = hash 80 (s), and cache [9] = hash 90 (s).…”