Centralized management and enforcement of online behavioral tracking policies

Patent metadata

Field	Value
Publication number	US-2017093917-A1
Application number	US-201514871106-A
Country	US
Kind code	A1
Filing date	Sep 30, 2015
Priority date	Sep 30, 2015
Publication date	Mar 30, 2017
Grant date	—

Abstract

Systems and methods for manipulating online behavioral tracking policies are provided. According to one embodiment, a hypertext transfer protocol (HTTP) response transmitted from a web server to a client is captured by a network security device. A status of the client is determined by the network security device. An online behavioral tracking policy associated with the client is identified by the network security device based on the determined status. The identified online behavioral tracking policy is enforced by the network security device by modifying the HTTP response. The modified HTTP response is transmitted by the network security device to the client.

First claim

What is claimed is:

1 . A method comprising:
capturing, by a network security device, a hypertext transfer protocol (HTTP) response transmitted from a web server to a client; determining, by the network security device, a status of the client; identifying, by the network security device, an online behavioral tracking policy associated with the client based on the determined status; enforcing, by the network security device, the identified online behavioral tracking policy by modifying the HTTP response; and transmitting, by the network security device, the modified HTTP response to the client.

2 . The method of claim 1 , wherein the status of the client comprises one or more of:
a location of the client; a visitation history; an online behavioral tracking policy acceptance history; and information regarding an amount of time that has elapsed since a last access by the client.

3 . The method of claim 2 , wherein the location of the client is determined based on an Internet Protocol (IP) address of the client.

4 . The method of claim 2 , further comprising:
capturing, by the network security device, an HTTP request transmitted by the client to the web server; detecting, by the network security device, whether an HTTP cookie is embedded within the HTTP request; when a result of the detecting is negative, then the client is treated as a first time visitor; and when the result of the detecting is affirmative, then the client is treated as a return visitor.

5 . The method of claim 2 , further comprising:
capturing, by the network security device, an HTTP request transmitted by the client to the web server; determining, by the network security device, the HTTP request comprises a web beacon request for a web beacon; checking, by the network security device, a browsing log associated with the client for the web beacon; when the web beacon is found within the browsing log, the client is determined to be a return visitor; and when the web beacon is not found within the browsing log, the client is determined to be a first time visitor.

6 . The method of claim 1 , wherein the online behavioral tracking policy includes information regarding online communication privacy regulations of a country in which the client is physically located.

7 . The method of claim 1 , wherein the online behavioral tracking policy includes indications regarding one or more of:
whether a web beacon is allowed in connection with communications with the client; whether an HTTP cookie is allowed in connection with communications with the client; whether a first-party is allowed in connection with communications with the client; whether a third-party HTTP cookie is allowed in connection with communications with the client; whether a whitelist and/or blacklist of third-party HTTP cookies; whether a privacy policy link is to be displayed by the client; whether a cookie banner is to be displayed by the client; and whether one or more user options are to be included within the cookie banner.

8 . The method of claim 1 , wherein said enforcing, by the network security device, the identified online behavioral tracking policy comprises one or more of:
removing one or more online behavioral tracking tools that are not in compliance with the identified online behavioral tracking policy from the HTTP response; and embedding one or more online behavioral tracking tools that are in compliance with the identified online behavioral tracking policy within the HTTP response.

9 . The method of claim 8 , wherein the online behavioral tracking tool comprises one or more of:
an HTTP cookie; a web beacon; a local storage of a browser; a flash cookie; a script that creates an online behavioral tracking tool when run by the client.

10 . The method of claim 8 , wherein said enforcing, by the network security device, the identified online behavioral tracking policy further comprises one or more of:
embedding within the modified HTTP response a script that causes the client to display a link to a privacy policy of the web server; embedding within the modified HTTP response a script that causes the client to display a cookie banner; and embedding within the modified HTTP response a script that prompts for an option regarding an online behavioral tracking policy within a cookie banner.

11 . The method of claim 1 , further comprising:
receiving, by the network security device, an option relating to the online behavioral tracking policy from the client; and enforcing, by the network security device, the option on subsequent HTTP traffic directed to the client.

12 . The method of claim 1 , wherein the network security device comprises or implements a reverse proxy.

13 . The method of claim 12 , further comprising:
establishing, by the reverse proxy, a first connection with the client; establishing, by the reverse proxy, a second connection with the web server; removing, by the reverse proxy, an online behavioral tracking tool from the HTTP response received on the second connection with the web server; and enforcing, by the reverse proxy, the online behavioral tracking policy on the HTTP response to be sent on the first connection with the client.

14 . A network security device comprising:
non-transitory storage device having tangibly embodied therein instructions representing a security application; and one or more processors coupled to the non-transitory storage device and operable to execute the security application to perform a method comprising:
capturing a hypertext transfer protocol (HTTP) response transmitted from a web server to a client;
determining a status of the client;
identifying an online behavioral tracking policy associated with the client based on the determined status;
enforcing the identified online behavioral tracking policy by modifying the HTTP response; and
transmitting the modified HTTP response to the client.

15 . The network security device of claim 14 , wherein the status of the client comprises one or more of:
a location of the client; a visitation history; an online behavioral tracking policy acceptance history; and information regarding an amount of time that has elapsed since a last access by the client.

16 . The network security device of claim 15 , wherein the location of the client is determined based on an Internet Protocol (IP) address of the client.

17 . The network security device of claim 15 , wherein the method further comprises:
capturing an HTTP request transmitted by the client to the web server; detecting whether an HTTP cookie is embedded within the HTTP request; when a result of the detecting is negative, then the client is treated as a first time visitor; and when the result of the detecting is affirmative, then the client is treated as a return visitor.

18 . The network security device of claim 15 , wherein the method further comprises:
capturing an HTTP request transmitted by the client to the web server; determining the HTTP request comprises a web beacon request for a web beacon; checking, by the network security device, a browsing log associated with the client for the web beacon; when the web beacon is found within the browsing log, the client is determined to be a return visitor; and when the web beacon is not found within the browsing log, the client is determined to be a first time visitor.

19 . The network security device of claim 16 , wherein the online behavioral tracking policy includes information reg

Assignees

• Fortinet Inc

Inventors

• Chandra Sekhar Sumanth Gorajala
• Wu Liming

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0407

  wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00) · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/0281 Primary

  Proxies · CPC title