Web Server Dynamic Content Segregation via Virtual Account Caching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web hosting environments face challenges in securely serving dynamic content while allowing anonymous access, as existing solutions either compromise security or performance, and existing methods for segregating access between customers' data are inadequate, especially when dealing with large numbers of websites.
Innovation Solution
A system that segregates access to dynamic content by using a UserRetriever module to retrieve usernames and passwords from a central database, allowing the UserImpersonator module to obtain and attach logon handles to requests, ensuring that dynamic content is served under restricted user accounts, preventing access to other customers' data, and caching logon handles for inter-process sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If all anonymous web site visitors share one account, then automatic and anonymous logon is maintained, but security restrictions cannot differentiate between visitors and prevent access to individual customers' data
Solution Approach 1:
The patent segments the single shared anonymous account into multiple virtual accounts, each associated with a specific customer or website. When an anonymous visitor requests content, the system creates a segmented account context that allows access only to that specific customer's content while maintaining anonymity. This resolves the contradiction by enabling both automatic logon (through virtual account creation) and security differentiation (through account segmentation).
Solution Approach 2:
The patent introduces an intermediary account management system that sits between the anonymous visitor and the customer content. This intermediary creates temporary virtual accounts on behalf of anonymous visitors, acting as a mediator that enables access control without requiring the visitor to have actual user credentials. The intermediary resolves the contradiction by providing both automatic authentication and security enforcement.
2Reliability
If security restrictions are too stringent to prevent unauthorized access, then customer data protection is improved, but access to authorized content may be mistakenly prohibited or delayed
Solution Approach 1:
The patent performs preliminary actions by pre-configuring virtual account templates and access rules for each customer before anonymous visitors arrive. The system pre-establishes what content each virtual account can access, so when an anonymous visitor requests content, the pre-configured rules enable rapid authorization decisions without complex real-time security checks. This resolves the contradiction by providing both strong security (through pre-configured rules) and fast access (through eliminated real-time computation).
Solution Approach 2:
The patent implements self-service mechanisms where the virtual account system automatically determines access permissions based on pre-configured rules, without requiring manual security intervention. The system serves itself by automatically creating virtual accounts, applying access rules, and enforcing restrictions, which eliminates delays caused by manual security审核 while maintaining protection. This resolves the contradiction through automated security enforcement that is both strict and fast.
3Reliability
If dynamic content is served with segregated access control, then customer data security is improved, but server management complexity increases due to onerous security considerations
Solution Approach 1:
The patent creates a universal virtual account management system that handles security for all customers through a single standardized mechanism. Instead of implementing custom security configurations for each customer, the system provides a universal virtual account template that can be instantiated for any customer, automatically providing segregated access control. This resolves the contradiction by maintaining high security (through universal enforcement) while reducing management complexity (through standardization).
Solution Approach 2:
The patent changes the security model from static user accounts to dynamic virtual accounts with configurable parameters. Each virtual account can be quickly instantiated with different parameter sets (customer ID, content access rules, time limits) without requiring fundamental system changes. This parameter-based approach allows flexible security configuration through simple parameter adjustments rather than complex structural changes, resolving the contradiction between security and management complexity.
Data Source
AI summary
A system and method are provided for segregating access to dynamic content on multiple websites hosted by a web server. When a request is received for dynamic content from a website, a UserRetriever module identifies a path to the content and retrieves a username and password corresponding to the website, from a database that is separate from the web server and used for other purposes (e.g., billing). A UserImpersonator module requests a logon handle for that username from a logon cache manager. The logon handle is used to associate the request with the impersonated user account instead of the default anonymous user account with which the request was initially associated. The dynamic content is retrieved and served under the context of the restricted impersonated user account session, after which the applied logon handle is stripped off and the request is re-associated with the default anonymous user account.