Smart Walled Garden Controller with Referrer-Based Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing walled garden systems struggle to permanently configure a list of allowed websites due to unknown subdomains and IP addresses, which can change, leading to unavailable or malfunctioning websites for guest users.
Innovation Solution
The smart walled garden system employs wildcards in the cleared sites list to allow access to all subdomains of a website without prior knowledge of exact subdomains and IP addresses, using a controller for DNS lookups and a firewall for dynamic rule management, ensuring continuous availability of allowed content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If administrators configure specific IP addresses and hostnames in the cleared sites list, then access control precision is improved, but the system cannot adapt to IP changes and new subdomains, leading to website unavailability
Solution Approach 1:
The patent introduces a mediator component that sits between the firewall and the internet, intercepting HTTP requests and examining referrer headers. This mediator dynamically determines whether to allow access based on the referrer domain, rather than relying on static IP address lists. The mediator acts as an intelligent gateway that can adapt to new subdomains and IP changes without requiring administrator intervention, thus resolving the contradiction between precise access control and system adaptability.
2Measurement precision
If administrators manually update the cleared sites list with new subdomains and IP addresses, then access control accuracy is maintained, but system complexity and administrative burden increase
Solution Approach 1:
The system implements self-service by automatically monitoring and identifying new subdomains and IP addresses through referrer header analysis. Instead of requiring administrators to manually update the cleared sites list, the system autonomously adapts to changes in the external website landscape. The mediator component continuously learns from legitimate traffic patterns and automatically adjusts access rules, eliminating the need for manual maintenance while preserving access control accuracy.
3Adaptability or versatility
If the system allows access to all subdomains using wildcards, then adaptability to subdomain changes is improved, but security control is weakened
Solution Approach 1:
The system implements feedback mechanisms by continuously monitoring HTTP referrer headers and using this information to dynamically adjust access decisions. The mediator component analyzes the referrer domain in each request and compares it against the cleared sites list, providing real-time feedback on whether the requested subdomain should be allowed. This feedback loop enables the system to maintain security control while adapting to new subdomains, as each access decision is based on verified referrer information rather than blanket wildcard rules.
Data Source
AI summary
A cleared sites list includes one or more hostname descriptors. A firewall includes rules associated with a cleared IP list including cleared IP addresses, and permits transfer of a cleared HTTP request from a user device to a cleared destination IP address that matches one of the cleared IP addresses. A controller examines a non-cleared HTTP request from the user device to a non-cleared destination IP address that does not match one of the cleared IP addresses, and acts as a transparent proxy between the user device and the non-cleared destination IP address when a destination host header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list. The controller further acts as a transparent proxy between the user device and the non-cleared destination IP address when a referrer header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list.