Prevent session hijacking by binding the session to the cryptographic network credentials

Abstract. Many cyber-physical applications are responsible for safety critical or business critical infrastructure. Such applications are often controlled through a web interface. They manage sensitive databases, drive important SCADA systems or represent imperative business pro-cesses. A vast majority of such web applications are well-known to be vulnerable to a number of exploits. The focus of this paper is on the vul-nerability of session stealing, also called session hijacking. We developed a novel method to prevent session stealing in general. The key idea of the method is binding the securely negotiated communication channel to the application user authentication. For this we introduce a server side reverse proxy which runs independently from the client and server soft-ware. The proposed method wraps around the deployed infrastructure and requires no alterations to existing software. This paper discusses the technical encryption issues involved with employing this method. We de-scribe a prototype implementation and motivate the technical choices made. Furthermore, the prototype is validated by applying it to secure the particularly vulnerable Blackboard Learn system, which is a im-portant and critical infrastructural application for our university. We concretely demonstrate how to protect this system against session steal-ing. Finally, we discuss the application areas of this new method