Proxy Server Cookie Authentication for Shared IP Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web hosted security systems face challenges in effectively identifying and managing user identities across networks, particularly in corporate environments where multiple computers share the same IP address, limiting the proxy server's ability to filter and control access to undesirable Internet content.
Innovation Solution
A distributed proxy server system that uses a modified cookie-based authentication scheme, including a master cookie and injected domain cookies, to identify users and filter content, along with NTLM authentication and SAML identity providers, to enable efficient user identification and content filtering without requiring constant login credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional IP-based identification is used in proxy servers, then network communication is simple, but user identification precision deteriorates when multiple computers share the same IP address
Solution Approach 1:
The patent introduces cookies as an intermediary identification mechanism between the proxy server and user's web browser. Instead of relying directly on IP addresses, the proxy server stores identification information in cookies on the user's browser, which are then sent back with each request. This intermediary layer enables precise user identification even when multiple users share the same IP address, resolving the contradiction between identification precision and network simplicity.
2Reliability
If constant login credentials are required for user identification, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The patent implements preliminary authentication where the user logs in once to the proxy server, which then stores identification information in cookies on the user's browser. This preliminary action establishes the user's identity in advance, allowing subsequent requests to be automatically authenticated using the stored cookies without requiring constant re-entry of login credentials. This resolves the contradiction by maintaining security through pre-established authentication while improving operational convenience.
3Reliability
If sophisticated analysis methods are used for threat detection, then security detection capability is improved, but use of energy and computing resources increases
Solution Approach 1:
The patent performs preliminary classification and filtering of network traffic at the proxy server level using the stored cookie information. By identifying users in advance through cookies, the system can apply security policies and threat detection methods selectively based on user identity, rather than performing sophisticated analysis on all traffic uniformly. This preliminary user identification enables more efficient resource allocation for security scanning, resolving the contradiction between detection capability and resource consumption.
Data Source
AI summary
A distributed proxy server system is operable to receive a request for Internet data from a user, obtain the user's identity, store at least one cookie on the user's web browser identifying the user, and filter undesired content before forwarding requested Internet data to the user. A master cookie is associated with the proxy server including user identity information, and an injected domain cookie is associated with the domain of the requested Internet data including user identity information.