Identity-Based Address Normalization for Dynamic Security Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current URL normalization techniques are inflexible and dynamic, requiring manual implementation and lacking customization, making them ineffective against evolving hacking techniques and unable to relax normalization for specific users or services.
Innovation Solution
Identity-based address normalization methods that receive an electronic address, resolve resource and principal identities, determine patterns based on these identities, and normalize the address according to policy, allowing for real-time enforcement of security actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual URL normalization patterns are implemented, then security control is achieved, but flexibility and responsiveness to new hacking techniques deteriorate
Solution Approach 1:
The patent implements dynamic URL normalization by allowing patterns to be added, removed, or modified at runtime without requiring system restart or administrator intervention. The normalization service dynamically loads new patterns from storage when requested, enabling real-time adaptation to new hacking techniques while maintaining security control.
Solution Approach 2:
The system enables self-service pattern management where administrators can add or modify normalization patterns through a user interface without needing to hardcode changes or restart services. The normalization service automatically detects and loads new patterns from storage, allowing non-technical users to update security rules independently.
2Stability of the object's composition
If uniform URL normalization is applied to all users, then security consistency is maintained, but customization for specific users or services deteriorates
Solution Approach 1:
The patent implements local quality by associating different URL normalization patterns with specific principals (users or services). Each principal can have customized pattern sets that apply only to them, allowing trusted principals to use relaxed patterns while maintaining strict normalization for others, thus achieving both consistency within groups and customization across groups.
Solution Approach 2:
The system segments URL normalization into principal-specific pattern sets rather than applying a single uniform set to all users. Each principal has their own normalized URL patterns stored in the database, allowing the system to apply different normalization rules to different users or services based on their trust levels and requirements.
3Reliability
If pattern recognition is increased for all addresses, then security detection improves, but processing overhead and false positives worsen
Solution Approach 1:
The patent implements partial action by applying URL normalization selectively based on principal identity and requested resource. Trusted principals accessing trusted resources may bypass normalization or use relaxed patterns, while untrusted principals accessing sensitive resources undergo full normalization. This reduces processing overhead for legitimate traffic while maintaining security detection for suspicious access patterns.
Data Source
AI summary
In various embodiments, techniques for identity-based address normalization are provided. A principal attempts to access a resource via a principal-supplied address. A principal identity for the principal is used to acquire one or more address patterns. The principal-supplied address is compared against the one or more address patterns and when a match is detected, the principal-supplied address is normalized according to policy associated with the matched pattern. Additional access limitations and security restrictions are then enforced in response to the normalized address.