Techniques for protecting web-access

1. A method for identity-based access admission, comprising:

generating in a browser of a client device a unique identity key for the browser, wherein the identity key is generated in an internal frame (iFrame) thread, is executed in a main thread of the browser, and wherein the identity key includes a fingerprint characterizing in part the browser and the client device, an internet protocol address of the client device, and a public-encryption key; and

registering the identity key with an admission controller, wherein access to a protected entity by the client device is enforced using the identity key.

2. The method of claim 1 , wherein generating the identity key further comprises:

generating a seed using a random number function;

computing a pair of private-encryption and private-encryption PKI keys using the random number function;

saving the seed and the private-encryption key in a local storage of the iFrame thread, wherein the local storage is a persistent storage; and

saving the public-encryption key in a local storage of the main thread.

3. The method of claim 2 , further comprising:

generating the fingerprint based on a plurality of properties of the browser and client device; and

saving the fingerprint in a session storage of the iFrame thread.

4. The method of claim 1 , further comprising:

spawning the iFrame thread from the main thread by executing script code in the main thread, wherein the script code is retrieved from the admission controller in response to a request to access the protected entity by the client.

5. The method of claim 1 , further comprising:

including the identity key in header requests sent to the protected entity.

6. The method of claim 1 , wherein registering the identity key with the admission controller further comprises:

providing blockchain-based access authorization to the protected entity, wherein the identity key identifies the client device on a blockchain network.

7. The method of claim 6 , wherein the blockchain-based access authorization is based on any one of: bias-based admission and access tokens-based admission.

8. The method of claim 1 , further comprising:

collecting identity keys from a plurality of client devices;

analyzing the identity keys to generate at least one baseline; and

defining at least one access policy based on the at least one baseline.

9. The method of claim 8 , further comprising:

enforcing access to the protected entity based on the at least one access policy.

10. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for method for identity-based access admission, the process comprising:

generating in a browser of a client device a unique identity key for the browser, wherein the identity key is generated in an internal frame (iFrame) thread, is executed in a main thread of the browser, and wherein the identity key includes a fingerprint characterizing in part the browser and the client device, an internet protocol address of the client device, and a public-encryption key; and

registering the identity key with an admission controller, wherein access to a protected entity by the client device is enforced using the identity key.

11. A system for identity-base access admission, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

generate in a browser of a client device a unique identity key for the browser, wherein the identity key is generated in an internal frame (iFrame) thread, is executed in a main thread of the browser, and wherein the identity key includes a fingerprint characterizing in part the browser and the client device, an internet protocol address of the client device, and a public-encryption key; and

register the identity key with an admission controller, wherein access to a protected entity by the client device is enforced using the identity key.

12. The system of claim 11 , wherein the system is further configured to:

generate a seed using a random number function;

compute a pair of private-encryption and private-encryption PKI keys using the random number function;

save the seed and the private-encryption key in a local storage of the iFrame thread, wherein the local storage is a persistent storage; and

save the public-encryption key in a local storage of the main thread.

13. The system of claim 12 , wherein the system is further configured to:

generate the fingerprint based on a plurality of properties of the browser and client device; and

save the fingerprint in a session storage of the iFrame thread.

14. The system of claim 11 , wherein the system is further configured to:

spawn the iFrame thread from the main thread by executing script code in the main thread, wherein the script code is retrieved from the admission controller in response to a request to access the protected entity by the client.

15. The system of claim 12 , wherein the system is further configured to:

include the identity key in header requests sent to the protected entity.

16. The system of claim 12 , wherein the system is further configured to:

provide a blockchain-based access authorization to the protected entity, wherein the identity key identifies the client device on a blockchain network.

17. The system of claim 16 , wherein the blockchain-based access authorization is based on any one of: bias-based admission and access tokens-based admission.

18. The system of claim 11 , wherein the system is further configured to:

collect identity keys from a plurality of client devices;

analyze the identity keys to generate at least one baseline; and

define at least one access policy based on the at least one baseline.

19. The system of claim 18 , wherein the system is further configured to:

enforce access to the protected entity based on the at least one access policy.