Identity Broker Forward Proxy for Privacy and Session Continuity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional forward proxies are unable to effectively manage user identities and cookies, leading to transparency issues in client-server interactions, which hinders identity-related management tasks and compromises user privacy due to the opaque nature of cookies, making it difficult to perform intelligent identity mediation and maintain end-to-end state management.
Innovation Solution
A forward proxy system that performs directed identity substitution and mapping, allowing users to control the disclosure of identifying information, aggregates individuals into groups for simplified access control and authentication, and manages cookies to protect user privacy by storing and submitting them on behalf of the user, rather than the browser, thereby maintaining anonymity and independence from the client's operating system and browser software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional forward proxies forward cookies transparently from client to server, then server can identify and personalize service for users, but user identity privacy is compromised and proxy cannot perform intelligent identity mediation
Solution Approach 1:
The patent introduces an identity broker component that acts as an intermediary between the proxy and the server. This broker manages user identities and cookies separately, allowing the proxy to forward requests without directly handling sensitive identity information. The broker mediates between the client's identity and the server's authentication requirements, enabling intelligent identity management while preserving user privacy by controlling what identity information is disclosed to the server.
2Loss of information
If proxy performs identity substitution to protect user anonymity, then user privacy is enhanced, but server cannot maintain accurate user state and session continuity
Solution Approach 1:
The patent segments the identity management functionality into separate components: the forward proxy handles traffic forwarding, the identity broker manages identity information and cookies, and the server performs authentication. This segmentation allows the proxy to substitute identities for anonymity while the broker maintains accurate user state information separately, ensuring session continuity is preserved through coordinated interaction between components rather than requiring the proxy to maintain full identity transparency.
3Ease of operation
If browser manages cookies directly, then cookie functionality works transparently, but user loses control over identity disclosure and proxy cannot perform directed identity substitution
Solution Approach 1:
The identity broker serves as an intermediary between the browser's cookie management and the server's authentication requirements. Instead of the browser managing cookies directly (which would provide transparency but lack control), or the proxy handling all identity information (which would provide control but lose transparency), the broker mediates by selectively managing which cookies are forwarded and how identity information is substituted. This enables both cookie functionality and directed identity substitution to coexist.
Data Source
AI summary
A forward proxy can perform identity substitutions and related services. The user provides the forward proxy with identity information, and the forward proxy presents itself to remote Internet sites on behalf of the user in the guize of the specified identity. From the remote site's point of view, the forward proxy is the machine being used by the user; the identity of the actual user machine can be hidden. Cookies are thus stored and updated at the forward proxy instead of being stored and updated at the user computer as they would be if a conventional forward proxy had been used. This helps preserve user privacy. The use of group identities, which are shared by multiple users, are also facilitated.