Web hosted security system communication
View Patent ↗A distributed proxy server system is operable to receive a request for Internet data from a user, obtain the user's identity, store at least one cookie on the user's web browser identifying the user, and filter undesired content before forwarding requested Internet data to the user. A master cookie is associated with the proxy server including user identity information, and an injected domain cookie is associated with the domain of the requested Internet data including user identity information.
1. A distributed proxy server system, the system comprising:
a web security service website;
a proxy server, comprising:
one or more processors; and
a memory, wherein the memory stores instructions comprising instructions to cause the one or more processors to:
receive a request at the proxy server from a client computer, the request for internet access to a first website;
determine if a master cookie associated with user identification information is available to allow access to the website;
perform authentication for a user associated with the request when no master cookie is available;
create the master cookie associated with both the user identification information and the web security service website after performing the authentication;
allow access to the first website via the proxy server by using the master cookie at the proxy server and relaying the request to the first website;
create a second cookie that is associated with the first website, the second cookie having information for the first website and additional identity information provided by the distributed proxy server system redirecting to the first website;
inject the second cookie into a response to the client computer along with the response from the first website such that the second cookie appears to the client computer to come from domain of the first website, the second cookie in the response to the client computer containing the additional identity information; and
remove the additional identify information from the second cookie by the proxy server prior to relaying the request to the first website.
2. The distributed proxy server system of claim 1 , wherein the instructions further comprise instructions to cause the one or more processors to:
receive a request to access a second website, the second website in a different domain than the first website;
utilize the master cookie and create a third cookie that is associated with the second website; and
allow access to the second website using the third cookie.
3. The distributed proxy server system of claim 1 , wherein the instructions to cause the one or more processors to perform authentication comprise instructions to cause the one or more processors to obtain an identity of the user via the user completing a logon process.
4. The distributed proxy server system of claim 1 , wherein the instructions to cause the one or more processors to perform authentication comprise instructions to cause the one or more processors to obtain an identity of the user via an NT LAN Manager (NTLM) authentication process.
5. The distributed proxy server system of claim 1 , wherein the instructions to cause the one or more processors to perform authentication comprise instructions to cause the one or more processors to obtain an identity of the user via a Security Assertion Markup Language (SAML) identity provider.
6. The distributed proxy server system of claim 1 , wherein the instructions further comprise instructions to cause the one or more processors to send the master cookie and the second cookie to a web browser on the client computer making the request.
7. The distributed proxy server system of claim 1 , wherein future requests for internet access to the first website are serviced using the second cookie and not the master cookie when the second cookie is received along with the request for internet access to the first website.
8. The distributed proxy server system of claim 7 , wherein the additional identity information in the second cookie is removed prior to sending the future requests and the second cookie to the first website.
9. A method comprising:
receiving a request at a proxy server system from a client web browser, the request for a first internet data to be obtained from a first website and associated with a user of the client web browser;
determining that a user identity of the user of the client web browser is unknown to the proxy server system;
obtaining authentication information at the proxy server system to determine the user identity;
creating a master cookie at the proxy server system, the master cookie containing information about the user identity;
creating a second cookie by the proxy server system, the second cookie containing information about the user identity and information for the first website;
allowing access to the first internet data to be obtained from the first website using a portion of the second cookie, the portion of the second cookie excluding the information about the user identity;
receiving a request for second internet data to be obtained from a second website;
using the master cookie to create a third cookie associated with the second website without obtaining authentication information a second time, the third cookie containing information about the user identity obtained from the master cookie and information for the second website; and
allowing access to the second internet data to be obtained from the second website using a portion of the third cookie, the portion of the third cookie excluding the information about the user identity.
10. The method of claim 9 wherein the master cookie, the second cookie and the third cookie are sent to the client web browser.
11. The method of claim 9 wherein obtaining authentication information at the proxy server system to determine the user identity comprises obtaining authentication information using an NT LAN Manager (NTLM) authentication process.
12. The method of claim 9 wherein obtaining authentication information at the proxy server system to determine the user identity comprises obtaining authentication information via the user completing a logon process.
13. The method of claim 9 wherein obtaining authentication information at the proxy server system to determine the user identity comprises obtaining authentication information using a Security Assertion Markup Language (SAML) identity provider.
14. The method of claim 9 wherein future requests to the first website are serviced using the second cookie and not the master cookie when the second cookie is received along with the future requests for first internet data to be obtained from the first website.
15. A non-transitory computer readable storage medium comprising instructions stored thereon to cause one or more processors to:
receive a request at a proxy server system from a client web browser, the request for a first internet data to be obtained from a first website and associated with a user of the client web browser;
determine that a user identity of the user of the client web browser is unknown to the proxy server system;
obtain authentication information at the proxy server system to determine the user identity;
create a master cookie at the proxy server system, the master cookie containing information about the user identity;
create a second cookie by the proxy server system, the second cookie containing information about the user identity and information for the first website;
allow access to the first internet data to be obtained from the first website using a portion of the second cookie, the portion of the second excluding the information about the user identity;
receive a request for second internet data to be obtained from a second website;
use the master cookie to create a third cookie associated with the second website without obtaining authentication information a second time, the third cookie containing both information about the user identity and information for the second website; and
allow access to the second internet data to be obtained from the second website using a portion of the third cookie, the portion of the third cookie excluding the information about the user identity.
16. The non-transitory computer readable storage medium of claim 15 further comprising instructions to send the master cookie, the second cookie and the third cookie to the client web browser.
17. The non-transitory computer readable storage medium of claim 15 wherein the instructions to cause the one or more processors to obtain authentication information at the proxy server system to determine the user identity comprise instructions to cause the one or more processors to obtain authentication information using an NT LAN Manager (NTLM) authentication process.
18. The non-transitory computer readable storage medium of claim 15 wherein the instructions to cause the one or more processors to obtain authentication information at the proxy server system to determine the user identity comprise instructions to cause the one or more processors to obtain authentication information via the user completing a logon process.
19. The non-transitory computer readable storage medium of claim 15 wherein the instructions to cause the one or more processors to obtain authentication information at the proxy server system to determine the user identity comprise instructions to cause the one or more processors to obtain authentication information using a Security Assertion Markup Language (SAML) identity provider.
20. The non-transitory computer readable storage medium of claim 15 wherein future requests to the first website are serviced using the second cookie and not the master cookie when the second cookie is received along with the future requests for first internet data to be obtained from the first website.