Session Dependent URL Masking for Web Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for controlling access to web content through URLs are vulnerable to unauthorized access and management overhead, as users can easily view and manipulate URLs, leading to potential unauthorized access to sensitive data.
Innovation Solution
A URL masking system that generates a unique set of parameters for each session to mask URLs, making them unrecognizable and unalterable, thereby enhancing security by requiring authorized clients to transmit masked URLs for access, which are only unmasked by the server if the session is valid.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional URL access methods are used, then ease of operation is improved, but security is worsened as users can easily view and manipulate URLs
Solution Approach 1:
The patent introduces a URL masking service as an intermediary between the client and the actual web content. The service receives requests, masks URLs before transmission to clients, and unmasks them on the server side. This mediator prevents direct exposure of actual URLs to clients while maintaining functional access, thereby resolving the contradiction between ease of operation and security.
Solution Approach 2:
The patent transforms URLs by applying masking parameters (such as session identifiers, random strings, or encoded values) to the original URL structure. The masked URL retains the necessary functional information while changing its observable parameters. This allows the URL to remain operational for authorized access while becoming unrecognizable and unalterable to unauthorized users.
2Reliability
If URLs are masked to enhance security, then unauthorized access is reduced, but device complexity is increased
Solution Approach 1:
The patent creates a copied or simulated version of the URL (the masked URL) that functions identically to the original for authorized users but appears different to unauthorized users. The masking service maintains a mapping between masked and unmasked URLs, allowing the system to operate with the simpler masked version while internally handling the complexity of URL transformation.
3Ease of operation
If session-based URL masking is implemented, then URL manipulability is reduced, but loss of time increases due to session management
Solution Approach 1:
The patent performs URL masking in advance before the URL is transmitted to the client. The masking operation is completed during the initial request processing, and the masked URL is then used throughout the session. This preliminary action eliminates the need for repeated masking operations during the session, reducing time loss while maintaining security.
Data Source
AI summary
The present invention is directed toward a method, device, and system for enhancing web security by masking a URL embedded in at least some portion of web content. A session dependent URL is generated and masked on a server side prior to being distributed to a customer for viewing. The session dependent URL is only active during the session in which it was generated. After the session has ended information relating to the session, web content, and masking of the URL is purged from memory.