Cookie-proxy: a scheme to prevent SSLStrip attack

Authors:
Sendong Zhao;Ding Wang;Sicheng Zhao;Wu Yang;Chunguang Ma
Affiliations:
College of Computer Science and Technology, Harbin Engineering University, Harbin City, China;College of Computer Science and Technology, Harbin Engineering University, Harbin City, China;School of Computer Science and Technology, Harbin Institute of Technology, Harbin City, China;College of Computer Science and Technology, Harbin Engineering University, Harbin City, China;College of Computer Science and Technology, Harbin Engineering University, Harbin City, China
Venue:
ICICS'12 Proceedings of the 14th international conference on Information and Communications Security
Year:
2012

Citing 7
Cited 0

Dos and don'ts of client authentication on the web

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
Man-in-the-Middle Attack to the HTTPS Protocol

IEEE Security and Privacy
SSLock: sustaining the trust on entities brought by SSL

ASIACCS '10 Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security
Secure session management with cookies

ICICS'09 Proceedings of the 7th international conference on Information, communications and signal processing
HProxy: client-side detection of SSL stripping attacks

DIMVA'10 Proceedings of the 7th international conference on Detection of intrusions and malware, and vulnerability assessment
An empirical study of visual security cues to prevent the SSLstripping attack

Proceedings of the 27th Annual Computer Security Applications Conference
A secure cookie scheme

Computer Networks: The International Journal of Computer and Telecommunications Networking

Quantified Score

Hi-index	0.00

Visualization

Abstract

A new Man-in-the-Middle (MitM) attack called SSLStrip poses a serious threat to the security of secure socket layer protocol. Although some researchers have presented some schemes to resist such attack, until now there is still no practical countermeasure. To withstand SSLStrip attack, in this paper we propose a scheme named Cookie-Proxy, including a secure cookie protocol and a new topology structure. The topology structure is composed of a proxy pattern and a reverse proxy pattern. Experiment results and formal security proof using SVO logic show that our scheme is effective to prevent SSLStrip attack. Besides, our scheme spends little extra time cost and little extra communication cost comparing with previous secure cookie protocols.