Device internet resource access filtering system and method

• US 20060031942A1
• Filed: 09/16/2004
• Published: 02/09/2006
• Est. Priority Date: 08/07/2004
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Websense UK Ltd. (Forcepoint LLC)
• Inventors: Pointon, Richard, Jones, Kevin Brian
• Granted Patent: US 7,890,642 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A remote site filtering and monitoring system and method is described in which the Internet accesses of a remote device are monitored and categorized by a remote server in real-time. The system also provides for offline access logging and subsequent uploading, adjustable filtering sensitivities and particular HTTP port filtering.

Claims

1. An Internet access filtering system, comprising:

a computer;

a client on a device wherein the client establishes a connection to the computer, the client further comprising a module that gathers information about a request to access a resource by the device and a module that communicates the gathered information to the computer; and

the computer further comprising a module that categorizes the resource access of the device based on the gathered information and a module that communicates, in real-time, a resource access decision to the client so that the client controls the access to the resource by the device based on the resource access decision of the computer.

2. The system of claim 1, wherein the client further comprises an offline filtering module that controls the resource accesses of the device when the client is unable to communicate with the computer.

3. The system of claim 2, wherein the offline filtering module further comprises an allow all resource access mode, a block all resource access mode and an allow all resource access with logging mode.

4. The system of claim 3, wherein the allow all resource access with logging mode further comprises a module for throttling the offline logs uploaded to the computer in order to control the bandwidth utilized by the offline logs.

5. The system of claim 3, wherein the offline filtering module mode is selected by the computer.

6. The system of claim 1, wherein the client has a filtered port list downloaded from the computer that indicates the ports to be filtered and the ports to be treated as HTTP ports.

7. The system of claim 6, wherein the client further comprises an unfiltered ports module that controls the resources accesses of the device for a port not specifically identified as a filtered port.

8. The system of claim 7, wherein the unfiltered port module further comprises an allow all resource access mode, a block all resource access mode and a send to computer for possible filtering and/or logging mode.

9. The system of claim 8, wherein the unfiltered port module mode is selected by the computer.

10. The system of claim 1, wherein the client further comprises a filtering sensitivity module that controls the level of filtering of resource accesses for the client.

11. The system of claim 10, wherein the filtering sensitivity module further comprises a high sensitivity level mode, a medium sensitivity level mode, a low sensitivity level mode and an automatic sensitivity level mode.

12. The system of claim 11, wherein the filtering sensitivity module mode is selected by the computer.

13. The system of claim 1, wherein the computer further comprises a monitor module that monitors the resource accesses of the devices connected to the computer to generate a summary of the resource accesses of the devices.

14. The system of claim 1, wherein the resource being accessed further comprises one of a web page, a file transfer protocol site, an e-mail site, a secure web site, and a news site.

15. The system of claim 1, wherein the device further comprises one of a personal digital assistant, a cellular phone, a personal computer, a laptop computer, a palmtop computer and an appliance.

16. The system of claim 1, wherein the client further comprises a module that detects whether the requested resource is to be communicated over a corporate network and that disables the client filtering for the requested resource being communicated over the corporate network.

17. The system of claim 1, wherein the client further comprises a module that generates a capability mask for the device and communicates that capability mask to the computer, the capability mask containing information about the filtering capabilities of the device.

18. The system of claim 1, wherein the gathered information and the resource access decision are communicated between the client and computer using a hypertext transfer protocol over TCP port 80.

19. The system of claim 18, wherein the protocol for gathered information further comprises a hypertext transfer protocol POST operation.

20. The system of claim 1, wherein the protocol for the resource access decision further comprises data in a web page format.

21. An Internet access filtering system, comprising:

a computer;

a client on a device wherein the client establishes a connection to the computer, the client further comprising means for gathering information about a request to access a resource by the device and means for communicating the gathered information to the computer; and

the computer further comprising means for categorizing the resource access of the device based on the gathered information and means for communicating, in real-time, a resource access decision to the client so that the client controls the access to the resource by the device based on the resource access decision of the computer.

22. The system of claim 21, wherein the client further comprises means for offline filtering that controls the resource accesses of the device when the client is unable to communicate with the computer.

23. The system of claim 22, wherein the offline filtering means further comprises an allow all resource access mode, a block all resource access mode and an allow all resource access with logging mode.

24. The system of claim 23, wherein the allow all resource access with logging mode further comprises means for throttling the offline logs uploaded to the computer in order to control the bandwidth utilized by the offline logs.

25. The system of claim 23, wherein the offline filtering means mode is selected by the computer.

26. The system of claim 21, wherein the client has a filtered port list downloaded from the computer that indicates the ports to be filtered and the ports to be treated as HTTP ports.

27. The system of claim 26, wherein the client further comprises means for filtering unfiltered ports that controls the resources accesses of the device for a port not specifically identified as a filtered port.

28. The system of claim 27, wherein the unfiltered port means further comprises an allow all resource access mode, a block all resource access mode and a send to computer for possible filtering and/or logging mode.

29. The system of claim 28, wherein the unfiltered port means mode is selected by the computer.

30. The system of claim 21, wherein the client further comprises means for adjusting the filtering sensitivity that controls the level of filtering of resource accesses for the client.

31. The system of claim 30, wherein the filtering sensitivity means further comprises a high sensitivity level mode, a medium sensitivity level mode, a low sensitivity level mode and an automatic sensitivity level mode.

32. The system of claim 31, wherein the filtering sensitivity means mode is selected by the computer.

33. The system of claim 21, wherein the computer further comprises means for monitoring resource accesses of the devices connected to the computer to generate a summary of the resource accesses of the devices.

34. The system of claim 21, wherein the resource being accessed further comprises one of a web page, an file transfer protocol site, an e-mail site, a secure web site, and a news site.

35. The system of claim 21, wherein the device further comprises one of a personal digital assistant, a cellular phone, a personal computer, a laptop computer, a palmtop computer and an appliance.

36. The system of claim 21, wherein the client further comprises means for detecting whether the requested resource is to be communicated over a corporate network and means for disabling the client filtering for the requested resource being communicated over the corporate network.

37. The system of claim 21, wherein the client further comprises means for generating a capability mask for the device and communicating that capability mask to the computer, the capability mask containing information about the filtering capabilities of the device.

38. An Internet access filtering method using a computer and a client on a device that establishes a connection to the computer, the method comprising:

gathering information by the client about a request to access a resource by the device;

communicating the gathered information to the computer;

categorizing, at the computer, the resource access of the device based on the gathered information; and

communicating, in real-time, a resource access decision to the client so that the client controls the access to the resource by the device based on the resource access decision of the computer.

39. The method of claim 38 further comprising offline filtering that controls the resource accesses of the device when the client is unable to communicate with the computer.

40. The method of claim 39, wherein the offline filtering further comprises an allow all resource access mode, a block all resource access mode and an allow all resource access with logging mode.

41. The method of claim 40, wherein the allow all resource access with logging mode further comprises throttling the offline logs uploaded to the computer in order to control the bandwidth utilized by the offline logs.

42. The method of claim 40, wherein the offline filtering mode is selected by the computer.

43. The method of claim 38 further comprising downloading a filtered port list from the computer to the client that indicates the ports to be filtered and the ports to be treated as HTTP ports.

44. The method of claim 43 further comprising filtering unfiltered ports that controls the resources accesses of the device for a port not specifically identified as a filtered port.

45. The method of claim 44, wherein the filtering of the unfiltered ports further comprises an allow all resource access mode, a block all resource access mode and a send to computer for possible filtering and/or logging mode.

46. The method of claim 45, wherein the unfiltered port mode is selected by the computer.

47. The method of claim 38 further comprising adjusting the filtering sensitivity that controls the level of filtering of resource accesses for the client.

48. The method of claim 47, wherein the filtering sensitivity adjustment further comprises a high sensitivity level mode, a medium sensitivity level mode, a low sensitivity level mode and an automatic sensitivity level mode.

49. The method of claim 48, wherein the filtering sensitivity adjustment mode is selected by the computer.

50. The method of claim 38 further comprising monitoring the resource accesses of the devices connected to the computer to generate a summary of the resource accesses of the devices.

51. The method of claim 38, wherein the resource being accessed further comprises one of a web page, an file transfer protocol site, an e-mail site, a secure web site, and a news site.

52. The method of claim 38, wherein the device further comprises one of a personal digital assistant, a cellular phone, a personal computer, a laptop computer, a palmtop computer and an appliance.

53. The method of claim 38 further comprising detecting, by the client, a connection of the device to a corporate network in order to disable the client filtering operation while the device is connected to the corporate network.

54. The method of claim 38 further comprising generating, by the client, a capability mask for the device and communicating that capability mask to the computer, the capability mask containing information about the filtering capabilities of the device.

55. A server for an Internet access filtering system, comprising:

a module that receives information about a request to access a resource by a remote device wherein the information about the resource access request is communicated from the a remote client on the device;

a module that categorizes the resource access of the device based on the gathered information; and

a module that communicates, in real-time, a resource access decision to the client so that the client controls the access to the resource by the device based on the resource access decision of the computer.

56. The server of claim 55 further comprising an offline filtering module that sets mode of operation of the client when the client cannot connect to the server.

57. The server of claim 56, wherein the offline filtering mode further comprises an allow all resource access mode, a block all resource access mode and an allow all resource access with logging mode.

58. The server of claim 57, wherein the allow all resource access with logging mode further comprises means for throttling the offline logs uploaded to the computer in order to control the bandwidth utilized by the offline logs.

59. The server of claim 55 further comprising an administrator module that sets a filtered ports list that is downloaded to the client that indicates the ports to be filtered and the ports to be treated as HTTP ports.

60. The server of claim 59 further comprising an unfiltered ports module that sets the filtering decisions for each client for a port not specifically identified as a filtered port.

61. The server of claim 60, wherein the unfiltered port module setting further comprises an allow all resource access mode, a block all resource access mode and a send to computer for possible filtering and/or logging mode.

62. The server of claim 55 further comprising a filtering sensitivity module that sets the filtering sensitivity for each client.

63. The server of claim 62, wherein the filtering sensitivity module settings further comprises a high sensitivity level mode, a medium sensitivity level mode, a low sensitivity level mode and an automatic sensitivity level mode.

64. The server of claim 55 further comprising a monitor module that monitors the resource accesses of the devices connected to the computer to generate a summary of the resource accesses of the devices.

65. The server of claim 55, wherein the resource being accessed further comprises one of a web page, an file transfer protocol site, an e-mail site, a secure web site, and a news site.

66. The server of claim 55, wherein the device further comprises one of a personal digital assistant, a cellular phone, a personal computer, a laptop computer, a palmtop computer and an appliance.

67. The server of claim 55 further comprising a module that receives a capability mask for each device from a client associated with the device, the capability mask containing information about the filtering capabilities of the device.

68. An Internet access filtering client located on a device that a communicates with a remote computer, the client comprising:

a module that gathers information about a request to access a resource by the device;

a module that communicates the gathered information to the computer; and

a module that receives a resource access decision from the remote computer and controls the access to the resource by the device based on the resource access decision of the computer.

69. The client of claim 68 further comprising an offline filtering module that controls the resource accesses of the device when the client is unable to communicate with the computer.

70. The client of claim 69, wherein the offline filtering module further comprises an allow all resource access mode, a block all resource access mode and an allow all resource access with logging mode.

71. The client of claim 70, wherein the allow all resource access with logging mode further comprises means for throttling the offline logs uploaded to the computer in order to control the bandwidth utilized by the offline logs.

72. The client of claim 70, wherein the offline filtering module mode is selected by the computer.

73. The client of claim 68, wherein the client has a filtered port list downloaded from the computer that indicates the ports to be filtered and the ports to be treated as HTTP ports.

74. The client of claim 73 further comprising an unfiltered ports module that controls the resources accesses of the device for a port not specifically identified as a filtered port.

75. The client of claim 74, wherein the unfiltered port module further comprises an allow all resource access mode, a block all resource access mode and a send to computer for possible filtering and/or logging mode.

76. The client of claim 75, wherein the unfiltered port module mode is selected by the computer.

77. The client of claim 68 further comprising a filtering sensitivity module that controls the level of filtering of resource accesses for the client.

78. The client of claim 77, wherein the filtering sensitivity module further comprises a high sensitivity level mode, a medium sensitivity level mode, a low sensitivity level mode and an automatic sensitivity level mode.

79. The client of claim 78, wherein the filtering sensitivity module mode is selected by the computer.

80. The client of claim 68, wherein the resource being accessed further comprises one of a web page, an file transfer protocol site, an e-mail site, a secure web site, and a news site.

81. The client of claim 68, wherein the device further comprises one of a personal digital assistant, a cellular phone, a personal computer, a laptop computer, a palmtop computer and an appliance.

82. The client of claim 68 further comprising a module that detects whether the requested resource is to be communicated over a corporate network and that disables the client filtering for the requested resource being communicated over the corporate network.

83. The client of claim 68 further comprising a module that generates a capability mask for the device and communicates that capability mask to the computer, the capability mask containing information about the filtering capabilities of the device.