Dual Cookie User Account Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users with multiple online accounts face challenges in managing access to these accounts, particularly when accessing cached data offline, as existing solutions lack efficient mechanisms for secure and convenient access across multiple identities and devices.
Innovation Solution
The implementation of a system using both plaintext and encrypted cookies on a client device to manage user identities, where the cookies are updated in coordination with a central server to reflect login and logout actions, allowing secure and offline access to data by embedding user identifiers within application code and URLs, preventing privacy leaks by not uniquely identifying user accounts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users store multiple account identifiers in plaintext cookies for convenient access, then ease of operation improves, but security deteriorates
Solution Approach 1:
The system segments user identifiers into two separate cookie storage mechanisms: plaintext cookies for convenient access and encrypted cookies for security. Each cookie type serves a specific function, allowing the system to balance convenience and security by using both forms simultaneously rather than relying on a single storage method.
Solution Approach 2:
The system changes the encryption parameter of cookies dynamically based on the operation context. Plaintext cookies are used when convenience is prioritized, while encrypted cookies are used when security is prioritized. The server can switch between these states by issuing different cookie types based on user actions and system security requirements.
2Ease of operation
If the system provides offline access to cached data, then ease of operation improves, but control over access deteriorates
Solution Approach 1:
The system performs preliminary authentication and data caching actions while the user is online. User identifiers are stored in cookies before offline access is needed, and the server pre-approves which data can be cached. This allows offline access to proceed smoothly while maintaining security control, as the authentication decisions were made in advance when the server was available.
Solution Approach 2:
The cookie system acts as an intermediary between the user and the cached data. Cookies store authentication credentials that mediate access to offline cached data, allowing the user to access data without real-time server connection while still maintaining a layer of security control through the cookie validation mechanism.
3Ease of operation
If the system uses stable URLs for bookmarking, then ease of operation improves, but privacy protection deteriorates
Solution Approach 1:
The system changes the parameter representation in URLs from specific user account identifiers to more generic, stable identifiers that do not reveal private account information. URLs use stable paths that can be bookmarked and shared without exposing sensitive user identity data, while the actual user identification is handled through cookie-based authentication mechanisms that remain hidden from the URL.
Data Source
AI summary
The present disclosure relates to managing user accounts in one or more computer systems. In general, one aspect of the subject matter described in this specification can be embodied in methods that include the actions of storing on a client computing device a first cookie containing plaintext representations of one or more user identifications, and a second cookie containing encrypted versions of the one or more user identifications; updating the cookies in coordination with each other based on communications received from a central server system in response to actions by a user of the client computing device to log on or off of accounts managed by the computer server system; and mediating user access to data stored locally on the client computing device by using the first and second cookies and determining whether the data is associated with one of the user identifiers.