IP Whitelisting for Signed URLs

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional systems face security issues in data sharing platforms like Snowflake, where unauthorized user devices within the same IP range can access shared data without proper authentication, compromising privacy and security.

Innovation Solution

Implementing IP whitelisting for signed URLs, where a pre-signed URL is prefixed with the identifier of the authorized user device to generate a signed URL, ensuring that only the authorized device can access the resource, thereby enhancing security and preventing unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If IP range whitelisting is used for pre-signed URLs, then access convenience for authorized users is improved, but security is worsened because unauthorized users within the same IP range can access shared data

Engineering Contradiction:

Improveaccess convenienceVSAvoidunauthorized access

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent segments the IP range whitelist into individual IP address whitelisting. Instead of allowing entire IP ranges to access data, the system creates separate whitelist entries for each authorized IP address. This segmentation prevents unauthorized users from accessing data even though they may be within the same broader IP range, while still allowing authorized users convenient access.

Inventive Principle:

Principle #1Segmentation

2Object-affected harmful factors

If individual IP address whitelisting is implemented, then security is improved, but system complexity increases

Engineering Contradiction:

Improveunauthorized accessVSAvoidwhitelist management

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The patent introduces an intermediary mechanism where the system automatically determines and stores the IP address of the user device attempting to access the data. This intermediary IP address determination process simplifies whitelist management by automatically capturing the identifier without requiring manual configuration of complex access control rules. The system uses this stored IP address to match against the whitelist during access attempts.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20250175467A1Internet protocol (IP) whitelisting for signed uniform resource locators (URLS)

Publication Date: 2025.05.29 CAPITAL ONE SERVICES LLC

AI summary

Systems as described herein may implement IP address whitelisting for signed Uniform Resource Locators (URLs). A computing device may receive, from a first user device, a first request to access a resource. The computing device may determine a first identifier of the first user device. After an authentication of the first user device, the computing device may generate a pre-signed URL indicating a location of the resource. The computing device may generate a signed URL by prefixing the pre-signed URL with the first identifier of the first user device. The computing device may receive a second request to access the resource. Based on comparing a second identifier corresponding to the second request with the first identifier in the signed URL, the computing device may grant or deny the second request access to the resource.