Filtering techniques for managing access to internet sites or other software applications

• US 20030105863A1
• Filed: 12/05/2001
• Published: 06/05/2003
• Est. Priority Date: 12/05/2001
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Kester, Harold, Lonas, Hal Case Jr., Hegli, Ronald Bjorn
• Granted Patent: US 6,947,985 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/53 using third party service providers
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A method and system for providing flexible access resources or services related to particular software applications are described. The system includes a database of Internet sites that have been categorized so that the system determines the category of information that a user is accessing on the Internet. The system is also programmed so users are only allowed to access sites a limited number of times. The system is further programmed to limit a user'"'"'s access to the Internet based on the network'"'"'s current bandwidth usage. Moreover, users can requested a postponed access, wherein the resource or service they are requesting is stored to a server, and available to the user at a later time. In addition, if a user chooses to access a resource or service that is within certain predefined categories, they are presented with the option of retrieving the resource or service, but notified that their access will be logged to a file.

Claims

1. A system for controlling user access to categories of Internet sites between an area network and an Internet, comprising:

a categorized database of Internet sites;

a first module configured to reference the categorized database and determine the category of Internet site that is being requested by a user;

a second module configured to determine a data transfer rate between the area network and the Internet;

a categorized database of threshold values; and

a third module configured to compare the data transfer rate to the categorized database of threshold values and, responsive to the comparison, blocking the user'"'"'s further access to the site.

2. The system of claim 1, wherein the categorized database of threshold values includes an array of categories of Internet sites, each category including an associated threshold value.

3. The system of claim 2, wherein the array of categories of Internet sites includes threshold values associated with work hours and off work hours.

4. The system of claim 2, wherein the array of categories of Internet sites includes threshold values associated with the classification of the user.

5. The system of claim 2, wherein the array of categories of Internet sites includes threshold values associated with the identification of the user.

6. The system of claim 1, wherein the data transfer rate is indicative of a total data transfer rate between the area network and the Internet.

7. The system of claim 1, wherein the data transfer rate is indicative of the portion of a total data transfer rate between the area network and the Internet that is being used by the category of Internet site requested by the user.

8. The system of claim 1 further comprising a fourth module configured to determine whether the user has spent a preset amount of time on the Internet site within the category and, responsive to the determination, allowing the user'"'"'s further access to the site.

9. The system of claim 1 further comprising a fourth module configured to determine whether the user requests a postponed access to the Internet site within the category, and responsive to the determination, storing pages from the requested the Internet site to a storage.

10. The system of claim 1 further comprising a fourth module configured to determine whether the user has accessed the Internet site within the category a predetermined number of times and, responsive to the determination, blocking the user'"'"'s further access to the Internet site.

11. The system of claim 1 further comprising a fourth module configured to determine whether the user has accessed the Internet site within the category and thereafter notifying the user that any Internet access will be stored to a log file.

12. The system of claim 1, wherein the area network is a local area network.

13. The system of claim 1, wherein the area network is a wide area network.

14. The system of claim 13, wherein the wide area network includes a plurality of local area networks.

15. A method for controlling user access to categories of internet sites between an area network and an Internet, the method comprising:

referencing a categorized database of Internet sites;

determining the category of Internet site that is being requested by a user;

determining a data transfer rate between the area network and the Internet; and

comparing the data transfer rate to a categorized database of threshold values, and responsive to the comparison, blocking access to the site.

16. The method of claim 15 further comprising determining whether the user has spent a preset amount of time on the Internet site within the category and, responsive to the determination, blocking the user'"'"'s further access to the site.

17. The method of claim 15 further comprising determining whether the user requests a postponed access to the Internet site within the category, and responsive to the determination, storing pages from the requested the Internet site to a storage.

18. The method of claim 15 further comprising determining whether the user has accessed the Internet site within the category a predetermined number of times and, responsive to the determination, blocking the user'"'"'s further access to the site.

19. The method of claim 15 further comprising determining whether the user has accessed the Internet site within the category and thereafter notifying the user that any Internet access will be stored to a log file.

20. The method of claim 15, wherein the categorized database of threshold values includes an array of categories of Internet sites, each category including an associated threshold value.

21. The method of claim 20, wherein the array of categories of Internet sites includes threshold values associated with work hours and off work hours.

22. The method of claim 20, wherein the array of categories of Internet sites includes threshold values associated with the classification of the user.

23. The method of claim 20, wherein the array of categories of Internet sites includes threshold values associated with the identification of the user.

24. The method of claim 15, wherein the data transfer rate is indicative of a total data transfer rate between the area network and the Internet.

25. The method of claim 15, wherein the data transfer rate is indicative of the portion of a total data transfer rate between the area network and the Internet that is being used by the category of Internet site requested by the user.

26. The method of claim 15, wherein the area network is a local area network.

27. The method of claim 15, wherein the area network is a wide area network.

28. The method of claim 27, wherein the wide area network includes a plurality of local area networks.

29. An system for controlling user access to categories of internet sites between an area network and an Internet, the system comprising:

means for referencing a categorized database of Internet sites;

means for determining the category of Internet site that is being requested by a user;

means for determining a data transfer rate between the area network and the Internet; and

means for comparing the data transfer rate to a categorized database of threshold values, and responsive to the comparison, blocking access to the site.

30. A method for controlling user access to categories of internet sites between an area network and an Internet, the method comprising:

receiving a request for an Internet site at a categorized site management module;

referencing a categorized database of Internet sites;

determining the responsiveness of the categorization database of Internet sites;

referencing a user permissions module to determine whether the user is restricted from accessing particular categories of sites; and

if the categorization database of Internet sites is not responsive, gradually degrading a level of service of the categorized site management module.

31. The method of claim 30, wherein degrading the level of service comprises:

determining a data transfer rate between the area network and the Internet;

selecting a default value from a categorized database of threshold values; and

comparing the data transfer rate to the default value, and responsive to the comparison, blocking access to the site.

32. The method of claim 30, wherein degrading the level of service includes limiting the application of the categorization site management module to the request for an Internet site.

33. The method of claim 32, wherein limiting the application of the categorization site management module includes applying a default global policy for the request for an Internet site.

34. The method of claim 32, wherein limiting the application of the categorization site management module includes allowing a specific category of Internet sites.

35. A system for controlling user access to Internet sites between an area network and an Internet, comprising:

a first module configured to determine a data transfer rate between a user and the Internet;

a database of quota values including a limit associated with the user; and

a second module configured to compare the data transfer rate to the limit associated with the user and, responsive to the comparison, blocking the user'"'"'s further access to the site.

36. The system of claim 35, wherein the data transfer rate is a measure of bytes transferred per time period.

37. The system of claim 35, wherein the data transfer rate is a measure of number of hits per time period.

38. A system for controlling software application data traffic between an area network and an Internet, comprising:

a database of software applications;

a first module configured to reference the database of software applications and determine the software application data traffic type that is being requested by a user;

a second module configured to determine a data transfer rate between the area network and the Internet;

a software database of threshold values; and

a third module configured to compare the data transfer rate to the software database of threshold values and, responsive to the comparison, blocking the user'"'"'s further requests for the software application data traffic type.

39. The system of claim 38, wherein the software database of threshold values includes an array of software application data traffic types, each type including an associated threshold value.

40. The system of claim 39 further comprising a fourth module configured to determine whether the user has received a pre-selected number of resources associated with the software application data traffic type and, responsive to the determination, allowing the user'"'"'s further access to resources associated with the software application data traffic type.

41. A method for controlling user access to software application data traffic between an area network and an Internet, the method comprising:

requesting a resource or service from an Internet;

referencing a database of software applications;

determining a software data traffic type that is associated with data packets captured from the area network;

determining a data transfer rate between the area network and the Internet; and

comparing the data transfer rate to a software database of threshold values, and responsive to the comparison, blocking access to the resource or service.

42. The method of claim 41, wherein the software database of threshold values includes an array of software application data traffic types, each type including an associated threshold values.

43. The method of claim 42 further comprising determining whether the user has received a pre-selected number of resources associated with the software application data traffic type and, responsive to the determination, blocking access to the resource or service.