Method and apparatus for providing anonymity to end-users in web transactions

• US 20040088349A1
• Filed: 10/30/2002
• Published: 05/06/2004
• Est. Priority Date: 10/30/2002
• Status: Abandoned Application

• Current Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Original Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Inventors: Hofmann, Markus, Beck, Andre
• Application Number:
  US10/284,220
• Publication Number:
  US 20040088349A1
• Time in Patent Office: Days
• US Class Current: 709/203
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00

Abstract

An Internet Service Provider (ISP) intercepts HTTP requests from an end-user'"'"'s browser, which are addressed to a Web server with which the ISP has an arrangement. If the request does not already include one, the request is modified to include a temporary user ID token that is identifiable with the end-user only by the ISP and not by the Web server. In response to receiving a request from the end-user that includes a token, the Web server generates a responsive message to the ISP that includes that same temporary user ID token, and which requests the ISP to perform a user-specific action. In response to that message, the ISP identifies the user from the token, performs the requested user-specific action and provides the Web server with information relating to the result of the requested action. The Web server then generates a response to the end-user'"'"'s original request utilizing the provided information.

Claims

1. A method comprising:

at an Internet Service Provider (ISP);

receiving an end-user'"'"'s request addressed to a Web server;

inserting a temporary token into the received request if the request does not already contain a temporary token, the temporary token being generated by the ISP and stored in association with the end-user'"'"'s identity, the end-user'"'"'s identity not being determinable by the Web server from the temporary token;

forwarding the request containing the temporary token to the Web server;

performing, using the stored association of the temporary token and the user'"'"'s identity, a requested user-specific action specified in a message containing the temporary token that is received from the Web server in response to the request; and

providing information to the Web server relating to the result of the user-specific action that is used by the Web server to formulate a response to the end-user'"'"'s request.

2. The method of claim 1 wherein the temporary token is inserted into an HTTP header in the end-user'"'"'s request.

3. The method of claim 2 wherein a new temporary token is generated for each new request from the end-user that is addressed to the Web server.

4. The method of claim 2 wherein the HTTP header also includes an address at the ISP for the Web server to send the message requesting the user-specific action.

5. The method of claim 4 wherein the HTTP header also includes a protocol to be used by the Web server for sending the message requesting the user-specific action.

6. The method of claim 1 wherein the user-specific action is performed only if a determination is made that the end-user granted permission for it to be performed.

7. The method of claim 1 wherein the temporary token has an expiration date and the user-specific action is performed only if the temporary token in the message requesting the user-specific action has not expired.

8. The method of claim 1 wherein the message requesting the user-specific action also contains credentials for authenticating the Web server as the source of the message.

9. The method of claim 1 wherein the token is a random or a pseudo-random number.

10. The method of claim 1 wherein if the request already contains a temporary token, it is within an HTTP cookie.

11. The method of claim 10 wherein the cookie has an expiration data and the user-specific action is performed only if the cookie has not expired.

12. The method of claim 11 wherein the cookie remains valid until a current browsing session of the end-user has ended.

13. The method of claim 10 wherein the HTTP cookie includes an address at the ISP for the Web server to send the message requesting the user-specific action.

14. The method of claim 13 wherein the HTTP cookie includes a protocol to be used by the Web server for sending the message requesting the user-specific action.

15. A method comprising:

at an Internet Service Provider (ISP);

receiving an end-user'"'"'s request addressed to a Web server,

sending an instruction to a browser of the end-user to include a temporary token in all subsequent requests addressed to the Web server, the temporary token being generated by the ISP and stored in association with the end-user'"'"'s identity, the end-user'"'"'s identity not being determinable from the temporary token;

forwarding a subsequent request containing the temporary token received from the end-user and addressed to the Web server;

performing a user-specific action specified in a message containing the temporary token that is received from the Web server in response to the subsequent request;

performing, using the stored association of the temporary token and the user'"'"'s identity, a requested user-specific action specified in a message containing the temporary token that is received from the Web server in response to the subsequent request; and

providing information to the Web server relating to the result of the user-specific action that is used by the Web server to formulate a response to the subsequent request.

16. The method of claim 15 wherein the instruction to the browser to insert the temporary token into subsequent requests is a Set-Cookie header containing the temporary token and the subsequent request includes the temporary token in an HTTP cookie.

17. The method of claim 16 wherein the Set-Cookie header further contains an address at the ISP for the Web server to send the message requesting the user-specific action, and the HTTP cookie includes that address.

18. The method of claim 17 wherein the Set-Cookie header further contains a protocol to be used by the Web server for sending the message requesting the user-specific action, and the HTTP cookie includes that protocol.

19. The method of claim 15 wherein the user-specific action is performed only if a determination is made that the end-user granted permission for it to be performed.

20. The method of claim 16 wherein cookie has an expiration date and the user-specific action is performed only if the has not expired.

21. The method of claim 20 wherein the cookie remains valid until a current browsing session of the end-user has ended.

22. The method of claim 15 wherein the message requesting the user-specific action also contains credentials for authenticating the Web server as the source of the message.

23. The method of claim 15 wherein the token is a random or a pseudo-random number.

24. A computer readable media tangibly embodying a program of instructions executable by a computer to perform a method, the method comprising:

receiving an end-user'"'"'s request addressed to a Web server;

inserting a temporary token into the received request if the request does not already contain a temporary token, the temporary token being generated by an ISP and stored in association with the end-user'"'"'s identity, the end-user'"'"'s identity not being determinable from the temporary token;

forwarding the request containing the temporary token to the Web server;

performing, using the stored association of the temporary token and the user'"'"'s identity, a requested user-specific action specified in a message containing the temporary token that is received from the Web server in response to the request; and

providing information to the Web server relating to the result of the user-specific action that is used by the Web server to formulate a response to the end-user'"'"'s request.

25. Apparatus at an Internet Service Provider (ISP) comprising:

means for receiving an end-user'"'"'s request addressed to a Web server;

means for inserting a temporary token into the received request if the request does not already contain a temporary token, the temporary token being generated by the ISP and stored in association with the end-user'"'"'s identity, the end-user'"'"'s identity not being determinable by the Web server from the temporary token;

means for forwarding the request containing the temporary token to the Web server;

means for performing, using the stored association of the temporary token and the user'"'"'s identity, a requested user-specific action specified in a message containing the temporary token that is received from the Web server in response to the request; and

means for providing information to the Web server relating to the result of the user-specific action that is used by the Web server to formulate a response to the end-user'"'"'s request.