One-Time URL Design

Print this Page	2.6 Business Continuity 05 One-Time URL Design	Close this Page

26.05 One-Time URL Design:

1. URL is a Uniform Resource Locator that means the address of a web page, including any parameters passed to that web page.

2. A web page address may contain three parts as:

(1) Domain such as https://www.123bim.co.uk

(2) Program as a name to imply the owner with a ".c2" suffix.

(3) Parameter such as /1234567890123.

3. The third parameter is optional and not used when to show the owners home page.

4. Any number of unique owners may be supported, each with their own unique program name.

5. To many criminals, the program name will imply a web page, so all transactions in a session will be for the same program name and imply the same web page.

Problem:

1. Agencies in all parts of the world have devised ways to steal URL data, to process vast amounts of URL data and sell the results for their own benefit. The problem is that URL design can leak valuable business information.

2. Anti-virus programs have been upgraded to take a copy of all browser URL addresses used because valuable information is leaked. Not only are the URL addressed copied, they are reused by those agencies to view the private results of using the URL address.

3. A copy of all the information that Google holds about a person has identified that even private web page information is not private and may be sold by search engines to other parties. These are facts that have been proven by due dilligence, experience and in depth analysis.

4. A minor issue is that a person may bookmark a private web page address or may take a screen shot of a private web page that discloses the URL in the address bar. It is critical that the information leaked in the browser address bar is not reusable and does not contain any business information.

5. A policy is never to leak primary key data by showing it in a URL address bar, but even encrypted keys will eventually be discovered and reused. Every click on a diary item must pass the date and type of item as part of the URL address - this is a data leak to be eliminated.

Solution:

1. URL address design must evolve to use a One-Time URL Design address that cannot be reused, is unique and does not imply any business information. The URL address will be copied by agencies around the world, but those agencies will not be able to reuse the URL and will not be able to imply any business information from a URL parameter.

2. Rather than encrypting many parameters into a long and complex URL parameter, a simple URL one-time parameter key is used that points to any number of internal parameters.

3. The URL parameter is designed to be only used by one specific session with a known computing device and cannot be reused in any other session using any other computing device.

4. When any one link is used on a web page, then every link on that web page become unusable so a copy of a web page with imbedded links has no value - the links become expired and unuable. When an unusable or expired link is clicked, the home page is shown as if the link parameter did not exist.

How does it work:

0. Application_Top:

1. When a new session is created, a session variable known as URL is created as an empty string.

2. When a new transaction arrives with a parameter, the parameter is looked up in the URL session variable.

(1) If the parameter is not found, the home page is shown.

(2) if the parameter is found, the stored data is loaded into URL fields for normal processing.

3. When the make_URL process is called, a unique key and string of field variables are appended to the URL session variable. The unique key is used with the domain and program name as a paramter on the displayed link.

URL Session Variable:

1. This is a pseudo array stored as a string with a tilde as a record separator and bar as a field separator where the first field in a record is the unique key terminated by an equals symbol.

2. The unique key shown as a URL address parameter is a slash and 13 digits that are made up from:

(1) Number of time units (like 17 second units) from a historic event (like when Joe was born).

(2) Sequence number of links on the web page salted by the user request number.

3. Design is optimised for rapid appending of another link and rapid lookup of the key that is stored with a unique equals symbol terminator. The time part of the key is calculated once for all links on the same web page. This time part of the key never needs to be decoded - it simply needs to be unique for every transaction.

4. The actual value of the parameter key is of no significance, other than it is unchangeable and unique Each hour, a different scramble method is applied to increase obfuscation of the key make up.

Benefits:

1. Faster and a lot less to maintain.

2. The original design had to encrypt every URL address that was shown on a web page. The complexity of this procedure cannot be overstated because the URL is the most vulnerable part of the application.

3. The new design does no encryption because all the parameters are stored internally and the external key is a simple unknowable number.

4. The benefits are much greater than was expected and its hard to imagine a more simple and elegant solution to URL design.

NOTE:

5. The life of a session exceeds what was expected - the application page can be closed and reopened and the session will be restored because the cookies are unchanged - while another browser page is open.

6. The session is only killed off when the browser page closes, not when a browser application page is closed while other pages are open.

Background:

1. A critical method of criminal behaviour is URL manipulation - adequate control measures are mandated to mitigate this known threat.

2. In particular, every URL will be copied to many third parties for processing for their own benefit. UK law demands that every ISP copy every URL and share that information with many other parties. Many browsers, antivirus programs and software products will copy every URL for processing by third parties.

3. The stated objective of these other parties is to be able to identify what web pages are viewed, how long they are viewed and what paramters are used with each web page. The design of the one-time URL is to purposefully thwart such objectives as an extra layer of privacy and security.

4. One-time URL design prevents any third party from making any assumptions about the internals of the private bespoke application service. It prevents URL history from helping a criminal to gain access to business data by manipulating URL parameters.

5. Monitoring of URL data by third parties is made to be worthless with a one-time URL. The fact that monitoring takes place in every country in the world proves that URL monitoring had commercial value to third parties.

One-Page Application Design:

1. To optimise an application for use by a smart phone, the architecture will evolve from a multi-page design to a one-page design.

2. The use of JavaScript to open windows of a specific size will evolve to simple HREF links that replace the current page.

3. The use of the "close" page button will evolve to a "home" or "welcome" page button as the root of what can be navigated by a simple button click.

4. All web pages will use the "container" design method where the contents of a page is changed without changing the container. Multiple containers may exist on the same web page and the content of each container may change independetly.

5. The "close" button will be eliminated.

6. The "sign-off" button serves no purpose and has been eliminated.

7. Every link is totally dependent on the session and cannot be reused by a criminal.

8. The one-page design will use less memory on a smart phone, but will increase the number of transactions because a dashboard page cannot remain open for the majority of the day. Desktop applications can still work in a more effective and productive way with multiple-pages open at the same time.

9. A smart phone is not able to view a small popup guide page alongside a data entry form at the same time. Smart phone applications must evolve to use voice commands for navigation and data entry so screen size is not an issue.

Go-Back Design:

1. The one-page design has a problem that each web page needs to know where it was linked from so the approved person can navigate back to where they came from.

2. A constant is assigned as the domain name - this is fixed.

3. A session variable is assigned as the program name - this is unchangeable within a session.

4. A session variable is assigned as the welcome page number assigned to the approved person when they sign in. A link page number of 2000 means use the approved persons welcome page.

One Web Page Design:

1. The one-web-page design means that popup pages cannot be designed because the URL array for the popup web page will destroy the URL array for the primary web page.

2. It is complex to retain some URLs and purge others depending on the web page that generated the URL.

3. When a new web page request is processed, the URL points to a URL array entry that was generated for a specific web page number - all other URL array entries for the same web page number are purged.

secret:

1. The microtime function returns 2 numbers as (1) a decimal microseconds in 9 characters with a space and (2) an integer timestamp of 10 digits.

2. When a new session begins, a unique identifier is generated by merging selective digits from the above two numbers. This session identifier is knowable and unpredictable. This function can be executed one million times in 3 seconds so its overhead is trivial.

3. For each transaction, a URL address component is generated by Application_Top as a 8 or 9 digit unknowable number using different parts of the microtime data.

4. Make_URL appends a request number salted sequence number to complete each unique link URL address and key to the applicable parameters.

Document Control:

1. Document Title: One-Time URL Design.

2. Reference: 162605.

3. Keywords: ITIL, One-Time URL Design.

4. Description: One-Time URL Design for Business Continuity without data leaks.

5. Privacy: Public education service as a benefit to humanity.

6. Issued: 11 Jul 2018.

7. Edition: 1.2.