Systems and methods for detection of session tampering and fraud prevention
The invention provides methods and apparatus for detecting when an online session is compromised. A plurality of device fingerprints may be collected from a user computer that is associated with a designated Session ID. A server may include pages that are delivered to a user for viewing in a browser at which time device fingerprints and Session ID information are collected. By collecting device fingerprints and session information at several locations among the pages delivered by the server throughout an online session, and not only one time or at log-in, a comparison between the fingerprints in association with a Session ID can identify the likelihood of session tampering and man-in-the middle attacks.
1. A method for detecting session tampering, the method comprising:
establishing a Session ID for an online session between a first computer and a second computer over a network, wherein the online session is initiated at a log-in page and terminated at a log-out page;
instructing the first computer to collect at least two device fingerprints during the online session from the second computer for the corresponding Session ID, wherein the two device fingerprints are collected during the online session from at least two different pre-selected pages displaying different content that are configured for a session tampering comparison; and
comparing, after termination of the online session at the log-out page, the two device fingerprints taken during the online session from the at least two different pre-selected pages, and if the two device fingerprints are not identical, detecting session tampering and providing an alert.
2. The method as recited in claim 1 wherein the at least two device fingerprints include IP address information for the second computer.
3. The method as recited in claim 1 further comprising the step of collecting Session ID information corresponding to the two device fingerprints at the same times as collecting the two device fingerprints.
4. The method as recited in claim 1 wherein the network is the Internet.
5. The method as recited in claim 1 wherein the first and second computers is a user client and a server for an online merchant respectively.
6. A method of detecting session tampering, the method comprising:
establishing a Session ID for an online session between a user device and a Web server;
instructing the Web server to collect at least two fingerprints, each of the two fingerprints including a time differential between an internal clock of the user device and another reference clock, during at least two different time intervals from the user device for the corresponding Session ID, wherein the two fingerprints are collected during the online session from at least two different pre-selected locations displaying different content that are configured for a session tampering comparison; and
comparing the two fingerprints taken during the at least two different time intervals from the at least two different pre-selected locations to determine whether they are identical in order to detect session tampering.
7. The method as recited in claim 6 wherein the two different time intervals coincide with the viewing of two different pages served from the Web server to the user device.
8. The method as recited in claim 6 wherein the two different pages are HTML pages, and wherein one page is a log-in page and the second page relates to activity calling for additional authentication.
9. The method as recited in claim 8 wherein the Web server is operated by a financial institution, and second page relates to authorizing the transfer of monetary funds.
10. The method as recited in claim 8 wherein the Web server is operated by a Internet retailer, and the second page relates to authorizing a charge to be made for the purchase of merchandise using credit card information to be entered from the user device.
11. A non-transitory computer readable medium containing program instructions for carrying out a method of detecting session tampering, said method comprising:
establishing a Session ID for an online session between a user device and a Web server;
instructing the Web server to collect at least two fingerprints, each of the two fingerprints including a time differential between an internal clock of the user device and another reference clock, during at least two different time intervals from the user device for the corresponding Session ID, wherein the two fingerprints are collected during the online session from at least two different pre-selected locations displaying different content that are configured for a session tampering comparison; and
comparing the two fingerprints taken during the at least two different time intervals from the at least two different pre-selected locations to determine whether they are identical in order to detect session tampering.
12. A non-transitory computer system loaded with machine readable instructions for carrying out a method for detecting session tampering, said method comprising:
establishing a Session ID for an online session between a first computer and a second computer over a network, wherein the online session is initiated at a log-in page and terminated at a log-out page;
instructing the first computer to collect at least two device fingerprints during the online session from the second computer for the corresponding Session ID, wherein the two device fingerprints are collected during the online session from at least two different pre-selected pages displaying different content that are configured for a session tampering comparison; and
comparing, after termination of the online session at the log-out page, the two device fingerprints taken during the online session from the at least two different pre-selected pages, and if the two device fingerprints are not identical, detecting session tampering and providing an alert.
13. A network security system for a financial institution that detects when an online session is compromised comprising:
a server within the financial institution network for establishing an online session between a customer computer that is designated with a Session ID;
a fingerprint collector within the financial institution network for collecting device fingerprints at predetermined intervals during the online session from the customer computer, wherein the device fingerprints are collected during the online session from at least two different pre-selected pages displaying different content that are configured for a session tampering comparison;
a session collector within the financial institution network for collecting Session ID information at predetermined intervals during the online session from the customer computer, and
a memory for storing information collected from the fingerprint collector including the pages where the device fingerprints are obtained and the session collector in order to enable a comparison between the device fingerprints collected from the at least two different pre-selected pages and the Session ID information that suggests that an online session is compromised if the device fingerprints are not identical.
14. The network security system as recited in claim 13 , wherein the online session is authenticated with a one-time password (OTP).
15. The network security system as recited in claim 13 , wherein the predetermined intervals during the online session are defined when the customer navigates to a log-in page and another page calling for further authentication provided by the server of the financial institution network.