Gateway Proxy Detection via Cookie Embedding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting proxy connections in intranets are ineffective, particularly in distinguishing between common and NAT proxies, due to reliance on IP address changes, clock offsets, User-agent field analysis, and cookie counting, which lead to inaccurate results and misjudgments.
Innovation Solution
A method and device utilizing garnished responses and cookie embedding to determine proxy usage by decomposing access requests, embedding time-stamped cookies, and reading cookie information to accurately identify proxy connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If track detection method is used to detect proxy by monitoring IP address header identification changes, then NAT proxy detection is effective, but common proxy detection becomes invalid
Solution Approach 1:
The patent segments the proxy detection process into two distinct phases: garnished response phase (embedding cookies in gateway responses) and cookie checking phase (verifying cookies in subsequent requests). This segmentation allows different detection strategies to be applied to different proxy types effectively.
Solution Approach 2:
The patent introduces cookies as an intermediary element to track user requests. By embedding unique cookies in gateway responses and checking their presence in subsequent requests, the system can identify proxy usage without relying on IP address header changes that fail for common proxies.
2Reliability
If web page redirection with cookie counting is used to detect proxy, then both common and NAT proxy detection is achieved, but detection time increases significantly to 1-2 seconds
Solution Approach 1:
The patent performs preliminary actions by embedding cookies in the garnished response before the actual proxy detection is needed. When a user requests a webpage, the gateway embeds a cookie in the response, and subsequent requests automatically include this cookie, enabling immediate detection without additional redirection delays.
Solution Approach 2:
The patent extracts the cookie embedding and checking operations from the web page redirection process. Instead of redirecting users through multiple pages to embed cookies, the system directly embeds cookies in the gateway response and checks them in subsequent requests, eliminating unnecessary redirection time.
3Reliability
If cookie counting is used to identify terminals, then proxy detection is achieved, but inaccurate counting occurs when PCs clear cookies or have randomly assigned IP addresses
Solution Approach 1:
The patent implements feedback mechanisms where the gateway continuously monitors and counts cookies associated with each IP address over time. By tracking cookie presence across multiple requests and providing feedback on detection results, the system can distinguish between legitimate users and proxy users even when cookies are cleared or IP addresses change.
Solution Approach 2:
The patent adopts a dynamic detection approach where the gateway adapts its monitoring based on observed patterns. Instead of relying on static cookie presence, the system dynamically adjusts its detection strategy by counting cookies over time periods and analyzing usage patterns to identify proxy behavior.
Data Source
AI summary
The present invention provides a method for detecting proxy at the gateway, comprising decomposing the access request from the IP need to be proxy-monitored into an access request to original address and an access request to gateway-specified address to access the original address and the gateway-specified separately; determining whether a specific cookie information is included in said access request to gateway-specified address or not to obtain a second determining result; responding to the access request to said gateway-specified address and embedding the cookie information with the time stamp into the client PC by the gateway when said second determining result is no, and reading said cookie information when said second determining result is yes; determining whether said IP is using proxy or not on the basis of said cookie information. Accordingly, the present invention also provides a device and gateway server for detecting proxy at the gateway. It can be detected accurately and secretly in the intranet whether a certain IP is using common proxy or nat proxy.