Method and system for identifying a user on a web resource

Abstract

The present solution relates to the field of computer technology, and more particularly to methods for identifying a user on a web resource. The technical result is that of enabling the identification of a user in authorized and unauthorized areas of a web resource. In a preferred embodiment, the claimed solution consists in a method for identifying a user on a web resource, which comprises the steps of: a) obtaining information about an incoming TCP connection of a user; b) obtaining a data tuple from an incoming TCP packet, said data including: the IP address of the user, the IP address of the web resource, the TCP port number of the user, the TCP port number of the web resource, and the stable identifier (SID) of the user; c) transmitting the obtained data tuple to a user identification system; d) writing the data tuple to a buffer memory; e) establishing a TCP / HTTPS connection, in the process of which the SID for the corresponding data tuple is added to the HTTPS headers; f) identifying the user on the web resource from the TCP / HTTPS connection established.

Description

METHOD AND SYSTEM FOR IDENTIFYING A USER ON A WEB RESOURCE TECHNICAL FIELD

[0001] This solution relates to the field of computer technology, namely to methods of user identification on web-recipes. LEVEL OF TECHNOLOGY

[0002] A technology for generating a stable user identifier—Stable ID (SID)—is known. This technology allows for the replacement of cookies for user authorization purposes with a web-based resource when accessed by the user (see https: / / qt.media / stable-id). The SID is typically transmitted by the endpoint equipment operator (e.g., a mobile operator) in the TCP protocol service fields.

[0003] A current challenge with this technology is its use in multi-threaded tasks on multiprocessor systems, where there are a large number of requests to authenticate users when connecting to a web resource via TCP / IP. This issue arises on multiprocessor systems with a large number of cores and when using servers (such as Nginx) that internally load balance TCP connections between different application instances.

[0004] To solve the above problem, it is proposed to extract the SID when the user connects and associate it with the corresponding data tuple identifying the route and the connection parties, for subsequent transmission to the consuming resource in the HTTP protocol headers or another method preferred by the application. ESSENCE OF THE INVENTION

[0005] The claimed invention allows solving a technical problem in terms of implementing an effective user identification procedure in multiprocessor systems.

[0006] The technical result is to ensure user identification on the web-site in authorized and unauthorized zones.

[0007] Another technical result is the optimization of the user identification speed by forming a SID issuance queue using the identification system's buffer memory.

[0008] The claimed solution, in its preferred embodiment, is a method for identifying a user on a web-site, which contains the following steps: a) receive information about the user's incoming TCP connection; b) receive a data tuple from the incoming TCP packet, including: the user's IP address, the web-pecypca's IP address, the user's TCP port number, the web-pecypca's TCP port number, and the user's stable identifier (SID); c) transmit the received data tuple to the user identification system; d) write the data tuple to the buffer memory; e) make a TCP / HTTPS connection, during which the SID for the corresponding data tuple is added to the HTTPS headers; f) perform user identification on the web-site within the established TCP / HTTPS connection.

[0009] In one particular implementation example, the incoming TCP connection comes from the user's web browser.

[0010] In another particular implementation example, the SID is transmitted from the user's carrier system.

[0011] In another particular implementation example, the buffer memory is associated with a SID store that contains short-term record data storage and long-term record data storage.

[0012] In another particular implementation example, the SID is written to short-term data storage.

[0013] In another specific implementation example, the SID is moved from short-term to long-term data storage.

[0014] In another particular implementation example, the SID is stored in the short-term record data store until the maximum TCP connection establishment time expires.

[0015] In another particular implementation example, the SID is stored in the long-term record data store for the maximum lifetime of the established TCP connection.

[0016] In another particular example of implementation, entries in the buffer memory form a queue.

[0017] In another preferred embodiment, a user identification system on a web-site is claimed, comprising at least one processor and one memory associated with the processor, which contains machine-readable instructions that, when executed, cause the processor to: receive information about the user's incoming TCP connection; receive a data tuple from an incoming TCP packet, including: the user's IP address, the web-pecypca's IP address, the user's TCP port number, the web-pecypca's TCP port number, and the user's stable identifier (SID); transmit the received data tuple to the user identification system; write the data tuple to the buffer memory; perform a TCP / HTTPS connection, during which the SID for the corresponding data tuple is added to the HTTPS headers; perform user identification on the web-site within the established TCP / HTTPS connection. BRIEF DESCRIPTION OF DRAWINGS

[0018] Fig. 1 illustrates the general scheme for implementing the claimed solution.

[0019] Fig. 2 illustrates a block diagram of the identification method.

[0020] Fig. 3 illustrates the general diagram of the computing device. IMPLEMENTATION OF THE INVENTION

[0021] As shown in Fig. 1, the claimed solution is a method for identifying a user (110) when he / she accesses a web-resource (150) via a data transmission network (120), for example, a website via the Internet, on which his / her subsequent identification and / or authorization can be performed.

[0022] In parallel, at the moment of connection of the user (software), upon receipt of a TCP / IP request for connection to a web resource (150), the request is processed by the identification system (130), which can be located on a separate computing device, for example, a server, to perform the procedure for processing TCP / IP requests using a hardware and software implementation, which includes: a module (131) for analyzing a TCP connection, a buffer memory (132) and a TCP / IP stack (133).

[0023] The identification system (130) is connected via corresponding elements to the SID storage (140) and the nginx handler (160), which contains the SID processing module (161), connected to the SID storage (140). The identification system (130) analyzes the TCP / IP connections incoming from the user (software), extracts the SID, and transmits it to the SID processing module (161) for subsequent embedding into HTTPS headers, which are transmitted to the web resource (150) in parallel with the user's connection, for seamless identification of the user (110) on it. s

[0024] Fig. 2 shows a block diagram of the implementation of the claimed method (200) for user identification. In the first step (201), the user initiates a standard TCP / IP connection via their mobile or stationary device to connect to the selected web resource (150). The web resource management server (150) is connected to the identification system (130), which can be implemented on a separate computing device that carries out the exchange, for example, via an API for processing incoming TCP / IP connections.

[0025] Next, at stage (202), when processing the incoming TCP / IP request of the user (software), it is first processed by the TCP / IP connection analysis module (131), which analyzes the TCP / IP packet and forms the following data tuple within the received request, namely: the user’s IP address, the web-pecypca IP address, the user’s TCP port number, the web-pecypca TCP port number, SID.

[0026] A TCP / IP packet may look like this: < <>

[0027] Module (131) can be executed in the Linux kernel as an eBPF (Extended Berkeley Packet Filter) application mounted on an XDP (Express Data Path) point. The application analyzes the TCP SYN packet, extracts the SID from it, and then passes it to the loader application via the standard perf interface.

[0028] This implementation of the module (131) allows for the activation of a trigger that ensures the processing of a TCP packet at an early stage - immediately after the operating system interrupt handler, which allows for: Analyze TCP packet; Modify TCP packet; - pass the TCP packet further into the network stack; - delete TCP packet; - send TCP packet back to the network interface; - redirect a TCP packet to another network interface or to user space; - reject TCP packet.

[0029] The user identifier (110) within the framework of the implementation of the claimed solution is a data tuple associated with the SID, which is a static and unique identifier of the user transmitted by the communications operator that services the identification object (end user), for example, a mobile communications operator, or an operator of the end equipment through which the user (110) is connected.

[0030] The unique feature of the SID is that for a user (110), connection sessions always have the same SID. The SID is available within received TCP packets and does not require any prior authentication or authorization. The SID is typically embedded in the TCP protocol service fields, specifically in the TCP option 40 field, from which it is subsequently extracted using the TCP / IP connection analysis module (131).

[0031] The generated data tuple, obtained using module (131) at step (202), is written to buffer memory (132) at step (203). Thus, a queue is formed in buffer memory (132), which allows data tuples from SID to be transmitted to SID processing module (161). Buffer memory (132) is designed to organize data exchange according to the MPMC (multiple producers-multiple consumers) formula. Data exchange is organized according to the LMAX Disruptor pattern.

[0032] The data tuple may look like this:

[0033] The SID storage (140) is located in the same operating system (OS) process as the processing module (161) and contains short-term storage of record data (141) and long-term storage of record data (142), with the SID being written first to the short-term data storage. When accessing the SID storage (140) from the processing module (161) to search for a SID, the search is first performed in the short-term storage (141), and if the SID is found there, the SID is moved to the long-term storage (142), and the request returns the found SID. Otherwise, the search is performed in the long-term storage (142). This allows for regulating the amount of RAM consumed by the SID storage (140) in multi-processor systems (in the case of multiple instances of nginx and, together with it, the handler, the processing module, and the SID storage), due to the fact that the SID is stored in the short-term storage (141) of record data until the maximum time for establishing a TCP connection expires, and in the long-term storage (142) of record data for the maximum lifetime of the established TCP connection.

[0034] At step (204), the received TCP packet is sent without modification to the network stack of the nginx handler (160) using the TCP / IP stack (133) of the identification system (130). Then, the TCP / IP stack (133) establishes a TCP / IP connection with the user's browser (110) and passes the connection to the nginx handler for servicing. When the connection initiated by the TCP packet reaches the nginx handler (160), the SID processing module (161) is activated, which, based on the received connection, accesses the storage (140) to search for the SID corresponding to the connection, and also reads data from the queue in the buffer memory (132) with subsequent updating of the data in the storage (140).

[0035] At step (205), the SID processing module (161) embeds the SID for the corresponding data tuple into the headers of the HTTPS request processed in the standard mode by the nginx handler (160) (for example, using ngx_proxy), thereby performing at step (206) the identification of the user (101) on the corresponding web-site (150).

[0036] Example of an HTTPS request after inserting headers I I > > > _ [

[0037] On multiprocessor systems with a large number of cores and when using servers (for example, nginx) that balance TCP connections between different application instances internally (i.e. there is no socket address -> instance binding visible to the external service), a problem with Efficient and fast processing of user identification requests (101), which occurs because the SID and the data tuples corresponding to it must be replicated to all instances within a single virtual machine. It is impossible to determine at the connection processing stage which specific instance will subsequently handle a given connection, while the SID can only be consumed by one instance—the one actually handling the current connection—while in all other instances, this SID will not be used and will be stored idle. Each TCP connection can exist for quite a long time (minutes or even hours), and several (generally, an unlimited number) HTTP requests can be sent over it. This leads to inefficient use of the SID storage resource (140) and RAM.

[0038] To solve the above problem, it is proposed to use two storage modes in the SID storage (140): "long-term" (141) and "short-term" (142). Each mode has its own maximum record lifetime (TTL): in the short-term mode, the TTL is typically equal to the maximum time to establish a TCP connection (30 seconds by default)—this is the maximum time between the TCP SYN event and the SID request from the SID processing module (161), assuming that the end user's browser (101) sends the first HTTP request immediately after establishing the connection. In the long-term mode, the TTL is typically equal to the maximum lifetime of an established TCP connection (30 minutes by default); after this TTL expires, information about the connection is completely deleted.

[0039] When a SID is requested by the SID processing module (161), the SID storage (140) is accessed, during which a check is made to determine whether information on the given user connection (110) is available in the short-term storage (141). If the information is found, the record is moved from the short-term to the long-term storage (142), and the found SID is returned to the user (110). If information on the SID for the given connection is not available in the short-term storage (141), a search is performed in the long-term storage (142), and if the SID is found there, it is returned to the user. All records unclaimed within the short TTL are deleted from the short-term storage (141) during its periodic maintenance (usually with each request from the SID processing module (161)). This significantly saves RAM in the storage during user authorization, which increases the efficiency of the entire user identification process.

[0040] Fig. 3 shows a general view of a computing device (300) with which the claimed method (200) can be implemented. In the general case, the computing device (300) contains one or more processors (301), memory means such as RAM (302) and ROM (303), input / output interfaces (304), input / output devices (305), and a device for network interaction (306), united by a common information exchange bus.

[0041] The processor (301) (or several processors, a multi-core processor) may be selected from a range of devices that are widely used today, such as those from Intel™, AMD™, Apple™, Samsung Exynos™, MediaTEK™, Qualcomm Snapdragon™, etc. The processor also includes a graphics processor, such as an NVIDIA or ATI GPU, which is also suitable for the full or partial implementation of the method (200). The memory means may be the available memory capacity of the graphics card or graphics processor.

[0042] RAM (302) is random access memory (RAM) and is designed to store machine-readable instructions executed by the processor (301) to perform the necessary logical data processing operations. RAM (302) typically contains executable instructions from the operating system and corresponding software components (applications, software modules, etc.).

[0043] ROM (303) is one or more permanent data storage devices, such as a hard disk drive (HDD), a solid-state drive (SSD), flash memory (EEPROM, NAND, etc.), optical storage media (CD-R / RW, DVD-R / RW, BlueRay Disc, MD), etc.

[0044] To organize the operation of the device components (300) and to organize the operation of external connected devices, various types of I / O interfaces (304) are used. The choice of the appropriate interfaces depends on the specific design of the computing device, which may include, but are not limited to: PCI, AGP, PS / 2, IrDa, FireWire, LPT, COM, SATA, IDE, Lightning, USB (2.0, 3.0, 3.1, micro, mini, type C), TRS / Audio jack (2.5, 3.5, 6.35), HDMI, DVI, VGA, Display Port, RJ45, RS232, etc.

[0045] To ensure user interaction with the computing device (300), various I / O information means (305) are used, for example, a keyboard, display (monitor), touch display, touchpad, joystick, mouse, light pen, stylus, touch panel, trackball, speakers, microphone, augmented reality means, optical sensors, tablet, light indicators, projector, camera, biometric identification means (retina scanner, fingerprint scanner, voice recognition module), etc.

[0046] The network communication means (306) enables the device (300) to transmit data via an internal or external computing network, for example, Intranet, Internet, LAN, etc. One or more means (306) may be used, but are not limited to: Ethernet card, GSM modem, GPRS modem, LTE modem, 5G modem, satellite communication module, NFC module, Bluetooth and / or BLE module, Wi-Fi module, etc.

[0047] Additionally, satellite navigation tools included in the device (300) can also be used, for example, GPS, GLONASS, BeiDou, Galileo.

[0048] The submitted application materials disclose preferred examples of the implementation of the technical solution and should not be interpreted as limiting other, particular examples of its implementation that do not go beyond the scope of the requested legal protection, which are obvious to specialists in the relevant field of technology.

Claims

FORMULA 1. A method for identifying a user on a web-site, comprising the following stages: a) receive information about the user's incoming TCP connection; b) receive a data tuple from the incoming TCP packet, including: the user's IP address, the web-pecypca's IP address, the user's TCP port number, the web-pecypca's TCP port number, and the user's stable identifier (SID); c) transmit the received data tuple to the user identification system; d) write the data tuple to the buffer memory; e) make a TCP / HTTPS connection, during which the SID for the corresponding data tuple is added to the HTTPS headers; f) perform user identification on the web-site within the established TCP / HTTPS connection.

2. The method according to claim 1, wherein the incoming TCP connection comes from the user's web browser.

3. The method according to claim 1, wherein the SID is transmitted from the user's communications operator system.

4. The method according to claim 1, wherein the buffer memory is associated with a SID store that contains a short-term store of record data and a long-term store of record data.

5. The method according to claim 4, wherein the SID is written into each of the data stores.

6. The method according to claim 5, wherein the SID is stored in the short-term data storage of records until the maximum time for establishing a TCP connection has expired.

7. The method according to claim 5, wherein the SID is stored in the long-term data store of records for the maximum lifetime of the established TCP connection.

8. The method according to claim 1, wherein the records in the buffer memory form a queue.

9. The method of claim 4, wherein the SID is moved from short-term to long-term data storage.

10. A user identification system on a web-based platform, comprising at least one processor and one memory associated with the processor, which contains machine-readable instructions that, when executed, cause the processor to: receive information about the user's incoming TCP connection; receive a data tuple from an incoming TCP packet, including: the user's IP address, the web-pecypca's IP address, the user's TCP port number, the web-pecypca's TCP port number, and the user's stable identifier (SID); io transmit the received data tuple to the user identification system; write the data tuple to the buffer memory; perform a TCP / HTTPS connection, during which the SID for the corresponding data tuple is added to the HTTPS headers; perform user identification on the web-site within the specified network session.

Images