EP3311552A2

EP3311552A2 - Network control device

Info

Publication number: EP3311552A2
Application number: EP16745408.1A
Authority: EP
Inventors: Christian BENNEFELD
Original assignee: Eblocker GmbH
Current assignee: Eblocker GmbH
Priority date: 2015-06-22
Filing date: 2016-06-14
Publication date: 2018-04-25
Also published as: WO2016206671A3; DE102015007876A1; US20180204225A1; WO2016206671A2

Abstract

The aim of the invention is to create a separate network device for end consumers, which can be put into operation with low installation effort and without software installation and allows all terminals, which are connectable to the residential local area network (3, 103, 203, 303), the use of Internet offers without undesired advertising and without uncontrolled transmission of user profile data to third party providers. According to the invention, the problem is solved by a network control device (1, 101, 211) having at least one data communication interface for wireless or wire-bound data communication with a local area network (3, 103, 203, 303) and at least one memory device (1b, 101b) with resource information regarding advertising contents and analysis services, wherein the network control device (1, 101, 211) is configured in a separate housing and is programmed for transmission of data traffic of at least one client of the local area network (3, 103, 203, 303) to external servers (7, 8, 208, 209, 210) in the Internet (5, 105, 205); for analyzing outgoing requests on application protocol level by identifying resource information regarding advertising contents and analysis services and by comparing with the stored resource information; for the unmodified or modified forwarding of requests or the prevention thereof to external servers (7, 8, 208, 209, 210) as a function of the result of the analysis or generating a dedicated response to a hindered request to the client; for analyzing incoming responses on application protocol level and identifying resource information and tracking information and for the unmodified or modified forwarding or replacement of the responses to the client as a function of the result of the analysis.

Description

Network control device

Technical area

The invention relates to a network control device for controlling and controlling

Advertising content and user-related data in Internet data communication.

State of the art

Monetization and financing of Internet-based information and communication

Entertainment media are diverse forms of text, image, video or

Audio advertising media (advertising media) known in various forms in the

Media content are integrated and transmitted with the retrieval of the medium to the user and displayed on the terminal of the user (client) together with this. Media (part) content or advertising media integrated into web pages or mobile apps can also be accessed by third-party sources that are not identical to the provider of the media content (content provider or publisher) desired by the user when the desired media content is called up. Such third party sources may be third parties (advertisers), ad servers, social media or advertising networks, which serve corresponding defined advertising spaces within the media content via technical interfaces in real time directly or via further service providers. In the websites or mobile app content, for example, placeholders for advertising are integrated as referrals (ad tags) and filled with advertisements when a page is called up. This allows various advertising media and advertisers to rotate in the same place. Today, online advertising (display, video, text) is often integrated into websites or mobile app content in an environment-specific manner and delivered to the user of the website via ad servers. To get users of a website A, for example, information about

Financial services, such as stock prices, etc., offers corresponding advertising

CONFIRMATION COPY to affine products such as depot management or investment products. The line items are usually booked by the advertising company (advertiser) for a fixed period of time and / or for a certain number of users or advertisements directly from the website A (content provider or publisher) or their marketer. The technical implementation of internet-based advertising and the technical coordination of the participating agencies and providers (content providers,

Advertisers, media agencies, advertising networks, adserver operators) have become international technical standards for advertising formats and processes through the IAB (Interactive

Advertising Bureau).

The retrieval of each piece of content or advertising media integrated into a web page or mobile app content over the Internet may also be logged by the respective offering source or an affiliated web analytics service or social media or ad network. For this purpose, the server from which the advertising medium is retrieved, set cookies in the client, which are read in a later, further retrieval of advertising media and used to identify the client, as a rule. With the aid of these cookies and possible JavaScript functions, apart from the IP address of the calling client and the retrieved content, further technical features of the client (such as screen size, color depth, installed plugins, rendering time, etc.) can be read out, as well as all from the client via HTTP or HTTPS data included in the protocol header can be captured and stored. When successively or repeatedly retrieving

Media (part) content or advertising media from identical sources is the client from the respective source via cookies or by specific, specific hardware and

Software environment of the client representing data or specific combinations of such data identifiable, which is why logged data on user profiles

can be summarized (tracking). Another way of

Recognition of visitors without the setting and reading of cookies here is the so-called "browser fingerprinting" (also called "Canvas Fingerprinting"), in which a recognition can be retrieved only by the over the HTTP protocol

Properties of the concrete system installation (eg the used browser version and installed plugins and system fonts, etc.) takes place. Third party, in a plurality web sites or mobile app content, such as

Media agencies, ad server operators, web analytics services, or social media or ad networks can engage in such rich web site and cross-session content

Create user profiles. The integration of pure technical service providers such as web analytics services takes place, for example, via the integration of partial contents not visible to the user, for example a color-neutral or transparent graphic with a small size (counting pixels, webbug, web beacon or zero pixels). User profiles created in this way can be used as a basis for personalized advertising forms and processes.

On the basis of such user profiles, besides the direct booking of advertising spaces, a new market for advertising inserts has been established that does not (or not only) target the environment of the website, but (also) the behavior or the interests of the respective user (so-called. behavioral or interest based advertising). The

Advertisements are auctioned by publishers in the so-called Real Time Advertising (RTA) between the bidding advertisers. In doing so, the publishers place the advertising space (so-called inventory) to be used with advertising in an AdExchange or Sell-Side Platform (SSP). The bid amount is determined by the respective advertiser based on the user profile data of the respective user located on the website and negotiated via the AdExchange or the RTA system used. As a rule, the user is recognized via cookies by the advertising platforms or advertisers. The assignment to the user profile takes place either via a user-unique ID in the user cookie (usually an MD5 hash via the user's e-mail address, if the user has a user account with the respective service provider), which is connected to a user profile database in the SSP (or a connected data management platform / DMP) or the user profile is stored directly in the cookie itself. Today, user profiles are typically captured implicitly by tracking the user through the websites they visit and deriving their potential interest. For example, if user X visits site A, which offers only financial services products, X's interest in financial services products is noted in the X user profile. This interest is often recorded in terms of probabilities, with the likelihood of interest over the number of visits and the number of theme-specific websites or websites visited is calculated using stochastic procedures. Likewise, by implicit derivation often with the aid of stochastic methods also

derived socio-demographic characteristics of the user. Visits user X frequently

Websites that are primarily aimed at female target customers, which increases the

Likelihood that this user is female. Since implicitly collected user profile data on the visited sites and stochastic

Based on the methodology, it is never completely certain that the detected characteristics correspond to the real interests of the user at all. Cookies also have the disadvantage that they only mark the browser used, but not the real user. If the browser is used by two or more members in the household, the user can not be clearly identified and the user profile data is very inaccurate and therefore worthless for targeted advertising in the RTA. Advertising content integrated in websites or mobile app content is often perceived as disturbing by users. Similarly, an uncontrolled collection, storage, aggregation and analysis of collected user data is often not desired by the user. In addition, the personalized advertising offered on the basis of user profiles often does not correspond to the actual interest and preferences of the users in practice. Therefore, there is a need to avoid unwanted advertising in the

To prevent the use of internet-based information and entertainment services, to protect privacy and to prevent the uncontrolled aggregation of personal or personal information. Various approaches for filtering advertising and analysis and tracking services are known in the prior art: additional programs for browser applications, so-called plug-ins or add-ons, such as the known under the brand name Adblock Plus program for the suppression of advertising on websites (ad blocker ) or the program known under the brand name Ghostery for the identification and blocking of analysis and tracking services on web pages. These plugins have the disadvantage that they each have only one of the desired functions and separately installed and configured by the user on each device and for each browser application used Need to become. A central, cross-device and cross-browser configuration, for example, to turn off the Ghostery or Adblock function on a particular page (so-called whitelisting), is not possible. Your installation and especially configuration also require a basic technical understanding from the user. Furthermore, these programs are not available for all terminal platforms and browser applications. The well-known under the brand name Apple iOS

Operating system as well as several SmartTVs and game consoles generally do not allow the installation of plugins. Finally, plugins per se are not suitable for use by multiple users and can be used separately only by the user management of the respective terminal operating system by multiple users. In addition to plugins, there are various proxy servers to be installed locally on the respective terminal, such as the programs known under the brand names webwasher or adGuard for the Microsoft Windows operating system (brand name). These solutions require technical know-how from the user for installation and configuration. They have the advantage that all browsers on the terminal - after appropriate proxy configuration of the browser - can use the solution. However, these solutions are not always available for all devices and browser applications. Proxy server services on the Internet, such as the service offered under the disconnect.me URL, have the advantage of being of all

Terminals and browsers that allow a configuration of a proxy server can be used. The disadvantage of such a solution, however, is that all

Internet traffic of the user is routed through the proxy server. This slows - depending on the location and bandwidth of the proxy server service - the

Connection speed for Internet access significantly. In addition, the proxy server service can record the entire surf history of the user and the respective

Assign users personally via their login. In the case of proxy server services operated abroad, data exchange is beyond the legal jurisdiction of the legal system that governs the user. Finally, there are individual local ones

Hardware solutions for the user's home network, such as a home-ad network central ad-blocker under the AdTrap brand, or an invizBox router for the Tor network for anonymizing connection data. These devices also have the disadvantage that they only one have a specific function and do not at the same time prevent the unwanted advertising and uncontrolled aggregation of personal or personal data in the use of Internet-based information and entertainment services. They also require a high level of technical installation and

Configuration effort.

DE 10 2013 206 441 A1 discloses a network device for optimizing

Promotional content displayed on an internal network. The device intercepts data packets originating from the internal network, analyzes them and detects requests for advertising content contained therein. A promotional profile generator generates a

User profile, based on which the requests for advertising content will be transmitted modified with the data packets. The modification involves inserting keywords into the advertising content requests taken from a keyword database or user profile. The user profile can be updated using the user activity information obtained from the analyzed network traffic. Furthermore, the user profile can be provided by providing a

User interface configured configurable. The disclosed by DE 10 2013 206 441 AI network device is used to optimize advertising content by supplementing or modifying the requests for advertising content with keywords, which with the

Correlate user activity. DE 10 2013 206 441 AI therefore does not teach concrete means or rules, with or after which the execution of advertising requests or the transfer of personal or personal data to analysis and analysis

Tracking services is prohibited. Thus, it does not allow secure suppression of unwanted advertising and uncontrolled aggregation of personal or personal information in the use of Internet offers, but only their content modification based on correlated with the user activity keywords. DE 10 2013 206 441 A1 also does not define any particular initial content of the user profile, so that it is only successively created on the basis of the analyzed network traffic information regarding the user activity. However, the automated generation of a user profile based on the analyzed network traffic has the disadvantage that it is inaccurate and the captured features may not actually match the real interests of the user.

EP 2 341 479 A1 discloses a system and method for providing user control over the network usage data and personal information

Profile information of the user. According to the method, outgoing requests from applications to the Internet are continuously logged and forwarded, and incoming requests are analyzed, with the requested content including content contained therein

Advertising content is passed to the application, however, requests for user profile data for reloading further personalized advertising are extracted and suppressed. The usage profile created by the process may be used to reload advertising correlated therewith by the process itself. The system and method disclosed by EP 2 341 479 A1 enables a partial suppression of personalized advertising by third-party providers and offers protection against the disclosure of user profile data to third parties. However, it does not allow for a comprehensive one

Preventing unwanted advertising. The logging of the analyzed

Network traffic and the generation of a user profile is not necessary and unnecessarily costly for the prevention of unwanted advertising and uncontrolled aggregation of personal or personal data with third parties. The automated creation of a user profile is also inaccurate and subsequently reloaded advertising may also be undesirable by the user and disturbing for him. The implementation of the proposed system and method of EP 2 341 479 AI also takes place by installing as software either directly on the terminal of the user or connected to this computer. This requires a corresponding technical know-how from the user for installation and configuration.

US 2014/0298445 A1 discloses a method and apparatus for URL-based filtering of network traffic. The Uniform Resource Locator (URL) is the address of a resource on a network, such as a web page. The destinations (URLs) of outbound connection requests are compared with a stored filter list and forwarded if they are not locked; the incoming answers are compared again with the filter list and forwarded to the client if they do not correspond to a locked category. The filtering of the incoming

Answers may also include decoding and checking content using keywords. The method and device disclosed by US 2014/0298445 Al enables the prevention of unwanted advertising on the basis of filter lists and a content check, but offers no protection against the disclosure of

User profile data to third parties and the aggregation of personal or

personal data with third parties. DISCLOSURE OF THE INVENTION

The invention has for its object to avoid the disadvantages described. It is a separate network device for end users are provided, which can be put into operation without technical knowledge, without software installation and low installation costs and connectable to the local local network devices without separate configuration effort, the use of Internet-based information and entertainment services without unwanted advertising and without an uncontrolled transmission of user profile data to third parties. The object is achieved by a network control device according to claim 1, advantageous embodiments are described in the subclaims.

The core of the invention is a network control device with at least one

Data communication interface for wireless or wired

Data communication with a local network and at least one

Storage device with resource information about advertising content and analysis services, wherein the network control device is formed in a separate housing and

is technically set up to mediate the traffic of at least one client from the local network with external servers on the Internet; to analyze outbound requests at the application log level by identifying

Resource information about advertising content and analysis services and comparison with the stored resource information; for unchanged or modified forwarding or preventing requests to external servers depending on the analysis result or generating a separate response to a prevented request to the client; to analyze incoming replies at the application log level and identify resource information and tracking information, and to change or retransmit or replace the responses to the client as a function of the analysis result. Resource information within the meaning of the invention

Information that represents the addresses of advertising content or analysis services on the Internet (URL = Uniform Resource Locator), as well as further metadata of the request or the response that is transmitted in the copy area of the message (HTTP header). Analytical Services means any third party that collects information about visitors and websites visited, such as web analytics or tracking services, social media or ad networks, media agencies, or advertisers. Clients within the meaning of the invention are understood to mean digital terminals with which Internet-based contents can be retrieved and displayed in a browser application or an app application. App applications are different here

Application programs for retrieving and displaying Internet content for web-enabled terminals, for example smartphone devices or tablet computers.

External servers are server services on the Internet, the information and

Provide entertainment services to users. Application protocols are application layer protocols for transferring files from the Internet to a client based on the TCP transport protocol, in particular the Hypertext Transfer Protocol (HTTP). In the analysis of outgoing requests (e.g., an HTTP request) occurs in the case of a negative result of analysis, that is, if none of the resource information contained in the request is stored with the stored ones

Resource information, an unchanged forwarding to the external server. If the result of the analysis indicates that the request contains potential user profile data - for example, tracking IDs - these are removed and the request otherwise forwarded in the same way. In another partially positive

Analysis result, if the request to the external server via an analysis service - for example, a tracking service - should be redirected, the request is forwarded directly to the user actually intended, recognizable from the rest of the address information of the request, changed accordingly. In the case of a positive Analysis result, that is, if the sole or final destination contained in the request matches a stored resource information, the request is prevented from being sent to the external server, for example, to intercept pure tracking signals or avoid loading unwanted advertisements. If the request consists solely in the request for an identified advertising content, the network control device immediately generates a response with a neutral content-for example, an image from a transparent pixel-and transmits it to the client in order to prevent the display of unwanted advertising and, at the same time, a misrepresentation or error message , In the analysis of the incoming responses (eg an HTTP response), in the case of a negative analysis result, that is, if none of the resource information contained in the response matches the stored resource information, then an unchanged forwarding to the client occurs. If the result of the analysis shows that there are potential requests for answers

User profile data are included - for example, a tracking cookie - these are removed and the rest of the response otherwise passed on. In the case of a positive analysis result, that is, if one contained in the answer

Resource information with stored resource information

that is an advertising content that could not yet be identified and filtered out at the request, it is replaced by a neutral content - for example, an image from a transparent pixel - and transmitted to the client to the

Presentation of unwanted advertising and at the same time a misrepresentation or

To avoid error message. The integration of the network controller can be done easily by defining its fixed or definable IP address in a DHCP service as a network proxy or default gateway. Alternatively, the firmly defined or definable IP address of the network control device can be manually defined on the clients as a network proxy or standard gateway. The invention has the advantage that all connectable to the local local network terminals without software installation and a low

Installation effort the use of Internet-based information and

Entertaining offers without unwanted advertising and without an uncontrolled transmission of user profile data to third-party providers is possible. In addition, by configuring the network control device as a DHCP server programmatically and setting its IP address as the default gateway, it is easier to integrate the network control device without the need for a separate DHCP server. The network control device allocates dynamic IPv4 addresses to the other terminals in the local network according to the DHCP protocol and sets its own IP address as a gateway.

Alternative facilitated integration of the network controller is accomplished by the network controller being programmatically set up to provide a proxy auto-config file (PAC file) to all clients on the local network, by which it is automatically configured as a browser proxy on the clients.

A completely automatic integration of the network control device takes place in that it is set up by the program to send ARP requests to all IP addresses in the network segment of the local network, for storage as ARP requests.

Response received device-specific MAC addresses and IP addresses of existing terminals and the regular transmission of ARP packets to the terminals, which define the network control device as an Internet access point. The Address Resolution Protocol (ARP) is a network protocol that connects to a network address of the network

Internet layer, the physical address (hardware address) of the network access layer determined and deposited this assignment for a definable period in the so-called ARP tables (ARP cache) of the participating computers. In this embodiment, the network controller first gets its IP address either from one in the local

Network existing DHCP service automatically assigned or manually defined. The network control device detects the terminals present in the local network by sending specific requests (so-called ARP requests) to all IP addresses in its network

Network segment of the local network transmitted. The devices addressed in this way each send a response (so-called ARP response) containing their device-specific hardware address (MAC address). The network controller stores the assignment of the hardware address to the IP address for each device in a local database. The network controller then periodically sends ARP packets to the terminals that define the network controller as an Internet access point. The ARP Packages instruct the terminals to first send all Internet-facing requests to the network controller, thereby assuming the role of the Internet access point, such as a router, for those requests on the local network. The terminals store this instruction for an implementation-dependent period in a local table, the so-called ARP cache. The time interval for sending the ARP packets to the terminals is chosen so that the instruction for all terminals is maintained throughout. This ensures that all

Terminals in the network segment of the local network transmit outgoing requests to the network control device instead of to the actual internet access point present in the local network, for example a router. This conveys the

Traffic through the actual Internet access point and analyze and process the requests and responses.

By configuring the network control device with a data communication interface for wired data communication and with a WLAN interface and configuring the program as an access point, it enables, in addition to its function as an advertising and analysis service blocker, the direct integration of wirelessly communicating terminals, such as tablet PCs. Computers or smartphones. The network control device is in this case integrated via the data communication interface for wired data communication - usually an Ethernet interface - with one of the aforementioned methods in the local network. At the same time, the network control device provides its own WLAN via the integrated WLAN interface as an access point for wireless end devices. The network control device can act as a bridge between the local network and the WLAN, so that it uses the same IP address range for the WLAN as it does in the local network. Is this

Network control device program itself set up as a DHCP server, it can also manage the WLAN via a separate network area and provide it with dynamic IP addresses from the address range of the WLAN. In this case, the network control device is configurable such that it provides its function as an advertising and analysis service blocker either for both network areas or only for one of the two network areas. The network control device is used to analyze and process encrypted HTTPS connections by being program-technically configured to install a root certificate in the client-side application used (for example, the used browser); providing SSL certificates for connections to clients in the local area network; for verification of SSL certificates of external servers in the Internet and for encrypted data communication with clients from the local network and with external servers in the Internet via the HTTPS protocol. Data transmitted via HTTP can be read on all devices (servers, routers, etc.) that are passed through during transmission. Therefore, the additional protocol HTTPS protocol for encrypted data transmission has been developed. Data transmitted by HTTPS can not be easily analyzed or modified by entities involved in the transfer process because the communication between the application on the terminal and the external server on the Internet is encrypted. To support HTTPS, it is necessary for the connection destination (server) to provide an SSL certificate and accept it from the client. So that the client has an HTTPS connection to the

Therefore, its internal issuer certificate (root certificate) must be manually confirmed and installed once. This process is required at most once for each client-side application. HTTPS requests from the client are then authenticated via the certificate provided by the network controller and encrypted using the standard key exchange of the SSL protocol. Thus, the network controller is able to decrypt, analyze, and manipulate traffic with the client. The network control device then establishes a new connection to the external destination server via HTTPS. Authentication of the server is performed by verifying the server certificate of the original target server by root certificates of the worldwide and generally accepted Certification Authorities (CA) installed in the network controller. The key exchange is standardized via the SSL protocol and the data exchange between

Network control device and external destination server is encrypted accordingly. In this embodiment, the network controller transmits the traffic between client and external server, thus, through two separate encrypted connections: one between the application program on the client and the network controller, the second between the network controller and the external server. In case that the network control device can not establish the HTTP S connection with the target server, eg because its certificate is invalid or untrustworthy, a corresponding error message is reported back to the client. A simple modifiability of the operation of the network control device is made possible by this program is set up with a

A configuration interface that transmits the network control device in responses to a client through the insertion of program instructions and which

Modification options for the stored resource information and / or on the network control device provides storable rules for the stored resource information. The provision of the configuration interface is carried out automatically during operation by embedded in the answers transmitted to the client corresponding program instructions, which in the respectively used

Application program on the client can be displayed together with the transmitted content. For example, if the client's request relates to a web page, corresponding HTML / Javascript components are embedded in the incoming HTML responses that represent the configuration interface options in the browser application on the client in the requested web page-for example, in an additional menu bar. With the aid of the configuration interface, modifications to the resource information can be made, for example, entries can be supplemented, updated or removed. Additionally or alternatively, the

Configuration interface for entering storable rules in relation to the

Resource information - so about the definition of filter rules, such as white or blacklisting individual addresses trained. Examples of possible rules include specifying an exception for a specific URL so that all content and tracking requests referenced by this URL are loaded unhindered, or setting an exception for specific content providers or tracking services, so that all content and tracking requests from being freely loaded by these services, or specifying a positive allowance for HTTP requests generally only to particular servers, or specifying an inhibition of HTTP requests to particular servers in general. In the above embodiment, a user-specific configuration of the

Operation of the network control device is made possible by the network control device being set up in the program with user account management, whereby each user is assigned an user account via an authentication function and each user account is assigned a separate configuration profile. This allows the definition of personalized user profiles, with which each user the

Functionality of the network control device easily and centrally adapt to his personal needs, so for example, certain resources for use share or lock additional resources for use. A simple embodiment of the authentication function is carried out by the permanent fixed assignment of a specific device to a user account, such as the MAC address. The respective user account and the corresponding configuration profile become active as soon as the device logs on to the local network. A cross-device

Authentication function, for example, simply by a

Username / password check or PIN check input / check provided. In this case, the user opens a new session by a successful authentication, which is assigned to the user. The session is automatically terminated after a definable period of time, when no further requests for this session context have been received (timeout).

In the above embodiment, parallel global as well as user-specific configuration settings are enabled by the network controller

is programmatically set up with several user account types for which

different modification and rule permissions are defined and one or more global configuration profiles are defined in addition to personal configuration profiles. Possible user account types with different modification and rule permissions are, for example, administrator, adult, guest, teenager, or child. The user account type defines preferences and defines which settings the user himself is allowed to change and which not. In addition to the

safety advantages, which are achieved by basic filter functions can only be changed by user account types with appropriate rights, this also allows the implementation of a youth protection directive (parental control), in that for adolescent or child account types, generally only access to certain servers is allowed or access to certain servers is prevented. In the two preceding embodiments, additional use advantage is achieved by the network control device being set up in terms of programming technology for storing user profile data that can be entered by the user in user accounts; for passing on these user profile data to user-definable external servers offering personalized advertising content, the network controller providing the user with a selection of possible servers from a locally stored, manually or automatically updatable database of resource information; to receive personalized advertising content based on the shared user profile data and to forward that advertising content to the client, the advertising content being obtained by inserting

Submit program statements in responses to a client and in one

definable area of the display area of the client-side application. Users who want to receive controllable and targeted advertising that is focused on their true interests and socio-demographics can enable this in their work through the user account management of the network controller. To do this, you must first deposit user profile data corresponding to your current interest in the invention, which are assigned to their user account and saved. Specifically, these may be, for example, the following data, with the characteristics of the features typically standardized from one of the network controller

Preselected select list, which may include, for example, the following information about the interest profile of the user:

A. Sociodemographic data

Age

gender

Occupational status and job

marital status

Number of children in the household household income

vocational training

Personal net income

B. Personal interests

1. cosmetics and fashion

Cosmetics and personal care products

visual aids

Fashion and clothing

watches and jewelry

Accessories (handbags, purses, etc.)

2. Consumer electronics

Computer (hardware or software) TV

Mobile (cell phone, smartphone, etc.) HiFi

3. Finance, insurance and real estate investment

Insurance

real estate

4th house and garden

Home improvement articles and devices

Energy supply (electricity, gas, water) Interior

Pet Shops

horticulture

domestic appliances

Baby items and baby equipment 5. Lifestyle, travel and leisure

Arts and Culture

Sports and fitness

to travel

6. Mobility

Public transport, air or train offers

car sharing

Automotive (New vehicle models and trends)

7. Education

Education, training and further education

C. Intent (current interests and intentions)

Purchase of a motor vehicle

Acquisition of a property

Planned move

dating service

Legal advice

Medical advice

The network control device receives a list of advertising partners (URLs of ad servers) to which they are stored through a regular automated update

User profile data can be passed. This list can be viewed by the respective user of the invention and configured individually (release / blocking of advertising partners). The changes are stored permanently in the respective user profile. Based on the user profile data, then - for example based on RTA - personalized advertising content is received by the network control device and forwarded to the client. In this case, corresponding program instructions are embedded by the network control device into the responses transmitted to the client, by means of which the advertising content is displayed in a definable area of the presentation area of the client-side application. This may be, for example, a defined area above an actual loaded (and freed by the invention of advertising) website be. The user has the option of displaying the personalized

To individually determine advertising content within the application used by him. The user thus benefits from targeted advertising, which he always finds in the same place, even though the loaded website has been exempt from other advertising by the network controller. The user always has the option to see the list of

View and edit advertisers to whom their user profile data will be transferred. The user profile information provided by the user is transmitted exclusively to the advertising partners selected by the user. In this case, various methods - even in combination - can be used, such as embedding the

User profile data in the source code of a client-side loaded web page by the network control device, the transmission of user profile data in the call a promotional URL (by GET command), the transmission of a unique user ID by

Embedding in the source code or the transmission of a unique user ID by setting an advertising partner-specific cookie. The advertising partner determines

(For example, via RTA) on the basis of the transmitted user profile data the most suitable for the user profile advertising and delivers them to a promotional URL provided for this purpose.

In the above embodiment, an increase in the relevance of the personalized advertising content is achieved by the user-input user profile data

Include relevance evaluations of specific advertising content already received. For this purpose, the user is displayed, for example, when crossing the transmitted advertising content with the mouse (roll-over) a rating scale consisting of five stars, which is displayed outside the advertising display area. If the user clicks on one of the five stars, he has, in addition to his assessment, the optional possibility to select a reason for his rating from a list of fixed reasons. The user rating of the advertising content will be saved in the user profile and in future will be forwarded with the other user profile data or sent to an evaluation server.

By the program is set up by the network control device to mediate the traffic to external servers on the Internet via an anonymization network achieved a complete anonymization of the user. Such ΓΡ-anonymization networks, such as the Tor network, disguise the origin of the user and hide his actual IP address. This also prevents a comprehensible logging of the retrieval of media content by the user directly from the respective offering source (content provider or publisher).

Further measures improving the invention will be described in more detail below together with the description of preferred embodiments of the invention with reference to FIGS. Show it:

Figure 1 is a schematic representation of a network control device within a network installation.

Figure 2 is a schematic representation of another network control device within another network installation.

Figure 3 is a common in the art data communication flow

FIG. 4 shows a data communication process involving a

Network control device.

FIG. 5 shows a further data communication process involving a

Network control device. Figure 1 shows a schematic representation of the network control device 1 with an Ethernet interface la for wired data communication and a

Storage device lb within a network installation 2. The local network 3 includes the router 4, which simultaneously provides access to the Internet 5 for terminals from the local network 3. The router 4 has the fixed address 192.168.0.1 and provides in the local network 3 at the same time a DHCP service, with which he

Terminals in the network assigns 3 dynamic IPv4 addresses according to the DHCP protocol. The network control device 1 is via the Ethernet interface la with the local Network 3 is connected and reachable under the fixed IPv4 address 192.168.0.2 and is set in the DHCP responses of router 4 as a gateway. The user wants to load on the terminal 6 the page http://example.com/. The browser application active on the terminal 6 then generates a request (HTTP request) of the form:

GET / HTTP / 1.1

Host: example.com

Accept: text / html

The router 4 forwards the request to the network control device 1. The

Network controller 1 checks for the URL http://example.com in the

Memory device la a suitable filter rule is present. If this is the case and the

Rule prohibits the user's access to the URL, the network controller 1 generates a response (HTTP response) with an HTML error page:

HTTP / 1.1 402 Forbidden

Content-Type: text / html

If the URL is permitted, the network control device 1 forwards the HTTP request for the given URL via the router 4 to the web server 7 that can be addressed via the URL example.com on the Internet 5.

The web server 7 responds with an HTTP response containing an HTML page: HTTP / 1.1 200 OK

Content-Type: text / html

...

The network control device 1 checks, based on the permissions and the settings of the user account active for the terminal 6, whether program instructions are to be inserted in the received HTML page.

Based on the appropriate permissions and configuration settings, the Network Control Device 1 inserts HTML and JavaScript code to represent an on and off fade-out control panel for accessing the personal configuration profile of the user account and displaying personalized advertising content in the HTML page:

- A DIV element as a container for the control bar, which is initially hidden by a CSS statement.

Icon for showing / hiding the control bar, which is fixed by the CSS statement "position: fixed" at the top of the page.

- JavaScript code with at least the following functionality: when the control bar icon is clicked on, an IFrame element is inserted in the DIV container and the DIV container is made visible via a CSS statement. The

IFrame element has the URL http://192.168.0.2/controlbar as source attribute.

The browser application active on the terminal 6 receives the modified HTML page from the network controller 1 and, to construct the page, makes HTTP requests for the resources referenced in the page, such as images and scripts.

The HTML page transmitted to the terminal 6 references the image image.png as a resource. The browser application active on the terminal 6 makes the following HTTP request, which is transmitted to the network control device 1:

GET /image.png HTTP / 1.1

Host: example.com

Accept: image / *

Referer: http://example.com/ The network controller 1 searches in the memory device 1a for a suitable filter rule, but finds none.

The network control device 1 forwards the unchanged request via the router 4 to the web server 7 that can be addressed via the URL example.com on the Internet 5.

The web server 7 responds with a response containing an image:

HTTP / 1.1 200 OK Content-Type: image / png

The network controller 1 does not modify the response because it is not an HTML page.

The browser application active on the terminal 6 receives the image file and displays it.

The transmitted to the terminal 6 HTML page referenced as another resource the image lxl .gif. The browser application active on the terminal 6 provides the following HTTP

Request, which is transmitted to the network control device 1:

GET / lxl .gif? Id = 12345678 HTTP / 1.1

Host: tracker.com

Accept: image / *

Referer: http://example.com

The network controller 1 finds memory device la a matching filter rule for the tracking service tracker.com, which states that the URL should be blocked. The network controller 1 creates its own HTTP response containing an image from a transparent pixel:

HTTP / 1.1 200 OK

Content-Type: image / gif The web server 8 addressable on the Internet 5 via the URL tracker.com was not asked why it could not gather information about the call to http://example.com/.

The browser application active on the terminal 6 receives the image file. The layout of the HTML page does not change because the image is a transparent pixel. To use the control bar, the user clicks on the icon of the control bar. The JavaScript code inserted by the network controller 1 into the HTML page is executed and generates an IFrame element. The browser application active on the terminal 6 makes a request to the URL specified in the IFrame element:

GET / controlbar HTTP / 1.1

Host: 192.168.0.2

Accept: text / html

The router 4 passes the request to the network controller 1. This creates an HTML page, e.g. also contains the number of trackers that have been blocked on the currently loaded page. The network control device 1 sends an HTTP response with the created HTML page HTTP / 1.1 200 OK

Content-Type: text html

The browser application active on the terminal 6 displays the received HTML page in the IFrame as a control bar.

Optionally, the user can customize the global configuration settings of the network controller 1 by clicking on elements such as buttons or check boxes. The user action triggers corresponding HTTP requests via XMLHttpRequest (AJAX) in the browser application which the network control device 1 processes.

Figure 2 shows a schematic representation of the network control device 101 with a memory device 101b within a network installation 102. The local network 103 includes the router 104, which simultaneously provides access to the Internet 105 for terminals from the local network 103 and the wired to the local network 103rd connected to the terminal 106. The router 104 simultaneously provides a DHCP service in the local network 103, with which it to terminals in the network 103 assigns dynamic IPv4 addresses according to the DHCP protocol. The network control device 101 has an Ethernet interface 101a for wired data communication and a WLAN interface 101c for wireless data communication. The

Network control device 101 is program-technically set up as an access point and provides the WLAN 107 for wireless terminals via the WLAN interface 101b. The network controller 101 serves as a bridge between the local area network 103 and the WLAN 107, so that it uses the same IP address area for the WLAN 107 as in the local area network 103. FIGS. 3 to 5 show various data communication operations in FIG

Network connections with and without a network controller.

FIG. 3 shows a data communication sequence customary in the prior art between the user 201 of a browser application 202 in the local network 203 and the web server 208 addressable via the URL news-online.com on the Internet 204, via the URL adserver.com on the Internet 204 addressable web server 209 and on the URL tracker.com on the Internet 204 addressable web server 210 without an active in the local network 203 network control device. In the first step, the user 201 calls the news website news-online.com via his browser 202. After loading the

Home news.html and the image file image.gif from the web server 208 referenced in the start page, the browser 202 loads the others in the homepage news.html

referenced advertising content ad.flash from the web server 209 transmitting user profile data to the web server 209. Thereafter, the browser 202 executes the other tracking item referenced in the homepage news.html track? Id = 12345 & page = xxxx & content = yyyyy to the web server 210, a tracking service, in which it provides user profile data to the user

Web server 210 transmitted. The web server 210 returns a one-pixel invisible image to the browser 202. After receiving all the content referenced in the homepage news.html, the browser 202 composes the page (rendering) and displays it. The user 201 is presented with the homepage news.html with the advertising content ad.flash. FIG. 4 shows an alternative data communication sequence between the user 201, the browser application 202 in the local network 303 and the web server 208 that can be addressed via the URL news- online.com on the Internet 204, the web addressable via the URL adserver.com on the Internet 204. Server 209 and on the URL tracker.com on the Internet 204 addressable web server 210 with the network controller 211 activated in the local network 203. In the first step, the user 201 calls the news website news-online.com via his browser 202. The browser 202 requests the homepage news.html, wherein the request is transmitted to the network control device 21 1. The network controller 21 1 looks for a matching filter rule, but finds no reason why it forwards the unmodified request to the web server 208 and delivers the response received homepage news.html to the browser 202. At the same time, the network controller 211 inserts HTML and JavaScript code for presenting a control bar for accessing the user account personal configuration profile in the HTML page. Thereafter, the browser 202 requests the image file image.gif from the web server 208 referenced in the home page. The network controller 21 1 looks for a suitable filter rule but finds no reason why it forwards the unchanged request to the web server 208 and delivers the image file image.gif received to the browser 202 in response. Thereafter, the browser 202 requests the further advertising content ad.flash referenced in the homepage news.html from the web server 209. The

Network controller 21 1 finds a matching filter rule for the URL adserver.com, blocks the request and creates its own HTTP response with which it delivers an image consisting of a transparent pixel to the browser 202. As a result, the transmission of user profile data to the web server 209 is simultaneously prevented. Thereafter, the browser 202 requests the other tracking item referenced in the homepage news.html track? Id = 12345 & page = xxxx & content = yyyyy from the web server 210. The network controller 211 finds a matching filter rule for the URL tracker.com, blocks the request, and creates its own HTTP response, with which it delivers an image consisting of a transparent pixel to the browser 202. As a result, the transmission of user profile data to the web server 210 is simultaneously prevented. After receiving all the content referenced in the homepage news.html, the browser 202 composes the page (rendering) and displays it. The user 201 the homepage news.html is displayed without the advertising content ad.flash and to send profile data to third parties unnoticed.

FIG. 5 shows an alternative data communication sequence between the user 201, the browser application 202 in the local network 303 and the web server 208 that can be addressed via the URL news- online.com on the Internet 204, via the URL

adserver.com on the Internet 204 addressable web server 209 and on the URL tracker.com on the Internet 204 addressable web server 210 with the activated in the local network 203 network control device 211 and with the user 201 active user profile 212 with user profile data. In the first step, the user 201 calls the news website news-online.com via his browser 202. The browser 202 requests the homepage news.html, wherein the request is transmitted to the network control device 21 1. The network controller 211 looks for a matching filter rule, but finds no reason why it forwards the unmodified request to the web server 208 and delivers the response home page news.html to the browser 202. At the same time, the network controller 21 1 inserts HTML and JavaScript code for presenting a control bar for accessing the user account personal configuration profile in the HTML page and displaying personalized advertising content in accordance with the user profile data user profile 212 contents and settings. The views of the contents referenced in the start page image.gif, ad.flash and the tracking request track? Id = 12345 & page = xxxx & content = yyyyy are not listed separately in Figure 5, they run as shown in Figure 4 from. In contrast to the representation in FIG. 4, however, the browser 202 after the sequence according to FIG. 5 additionally starts a request wanted-ad.gif for personalized advertising in accordance with the contents and

Settings of the user profile 212 with user profile data from the network control device 21 1. The network controller 211 calls the user self-determined

User profile 212 with user profile data and loads this. After that it leads

Network control device 21 1 sends out a request for a personalized advertising content to the web server 209 and in this case transmits the user profile data of the user profile 212. The network control device 211 contains a response in accordance with the

User profile data desired advertising content and delivers it to the browser 202. After receiving all the content referenced in the homepage news.html and of the personalized advertising content, the browser 202 composes the page (rendering) and displays it. Here, in addition to the homepage news.html (without the advertising content ad.flash), the user 201 is also shown within the display area defined by him in the settings of the user profile 212 desired advertising content presented.

LIST OF REFERENCE NUMBERS

1, 101, 211 network control device

lb, 101b storage device

2, 102 Network installation

3, 103, 203, 303 Local network

4, 104 routers

5, 105, 205 Internet

6, 106, 108, terminal

7, 8, 208, 209, 210 web server

la, 101a ethernet interface

101b WLAN-Schnirtstelle

107 Wi-Fi

201 users

202 browser application

Claims

claims

1. Network control device (1, 101, 21 1) with at least one

Data communication interface for wireless or wired

Data communication with a local network (3, 103, 203, 303) and at least one storage device (lb, 101b) with resource information about advertising content and analysis services, characterized in that the network control device (1, 101, 21 1) is formed in a separate housing and Programmtechnisch is set up for

Mediating the traffic of at least one client from the local network (3, 103, 203, 303) with external servers (7, 8, 208, 209, 210) in the Internet (5, 105,

205);

- Analyze outbound requests at the application log level

Identification of resource information about advertising content and analysis services and comparison with the stored resource information;

- unchanged or changed forwarding or prevention of requests to external servers (7, 8, 208, 209, 210) depending on the analysis result or generation of a separate answer to a prevented request to the client;

Analysis of incoming replies at the application log level and identification of resource information and tracking information;

- unchanged or changed forwarding or replacement of the answers to the client depending on the analysis result.

Second network control device (1, 101, 21 1) according to claim 1, characterized in that the network control device (1, 101, 21 1) is programmatically set up as a DHCP server and sets its IP address as the default gateway.

3. Network control device (1, 101, 21 1) according to claim 1, characterized in that the network control device (1, 101, 211) is program-technically set up for

Provision of a PAC file for all clients on the local network (3, 103, 203, 303), by means of which it is automatically configured as a browser proxy on the clients.

4. Network control device (1, 101, 211) according to claim 1, characterized in that the network control device (1, 101, 211) is program-technically set up for

Send ARP requests to all IP addresses in the network segment of the local network, to store the device-specific MAC addresses and IP addresses of existing terminals (6, 106, 108) received as ARP response, and to

periodically sending ARP packets to the terminals (6, 106, 108) defining the network control device (1, 101, 21 1) as an Internet access point.

5. Network control device (1, 101, 21 1) according to one of claims 1 to 4 with a data communication interface for wired data communication and with a WLAN interface (101b), characterized in that the network control device (1, 101, 21 1) programmatically as Access point is set up.

6. Network control device (1, 101, 21 1) according to any one of claims 1 to 5, characterized in that the network control device (1, 101, 21 1) is set by the program to

- installation of a root certificate in a client-side application;

- Provide SSL certificates for connections to clients in the local

Network (3, 103, 203, 303);

for verifying SSL certificates of external servers (7, 8, 208, 209, 210) in

Internet (5, 105, 205) and

- For encrypted data communication with clients from the local network (3, 103, 203, 303) and external servers (7, 8, 208, 209, 210) on the Internet (5, 105, 205) via the HTTPS protocol.

7. Network control device (1, 101, 211) according to any one of claims 1 to 6, characterized in that the network control device (1, 101, 211) is programmatically set up with a configuration section, which the network control device (1, 101, 21 1) the insertion of program statements in responses sent to a client and what modification options for the stored ones

Resource information and / or on the network controller provides storable rules on the stored resource information.

8. Network control device (1, 101, 211) according to claim 7, characterized in that the network control device (1, 101, 211) is program-technically set up with a user account management, each user (201) via a

Authentication function a user account is assigned and each user account is assigned a separate configuration profile.

9. network control device (1, 101, 21 1) according to claim 8, characterized in that the network control device (1, 101, 21 1) is programmatically set up with a plurality of user account types for which different modification and rule permissions are defined and in addition to personal configuration profiles or more global configuration profiles are defined.

10. Network control device (1, 101, 21 1) according to claim 8 or 9, characterized

in that the network control device (1, 101, 21 1) is program-technically set up for

Storage of user profile data that can be entered by the user (201)

User accounts;

- Passing on these user profile data to the user (201) definable external server (7, 8, 208, 209, 210), which offer personalized advertising content, wherein the network control device (1, 101, 211) the user (201) a selection of possible external server (7, 8, 208, 209, 210) from a locally stored, manually or automatically updatable database of resource information;

- Receive personalized, based on the passed user profile data

Advertising content;

- Forwarding of this advertising content to the client, the advertising content by the insertion of program instructions in responses to a client transmitted and displayed in a definable area of the display area of the client-side application.

1 1. Network control device (1, 101, 21 1) according to claim 10, characterized in that the by the user (201) enterable user profile data relevance ratings specific, already received advertising content.

12. Network control device (1, 101, 211) according to one of claims 1 to 11, characterized in that the network control device (1, 101, 21 1) is program-technically set up to mediate the data traffic to external servers (7, 8, 208, 209 , 210) on the Internet (5, 105, 205) via an anonymization network.