SERVICES USING GLOBALLY DISTRIBUTED INFRASTRUCTURE FOR SECURE CONTENT MANAGEMENT

• US 20090177514A1
• Filed: 08/14/2008
• Published: 07/09/2009
• Est. Priority Date: 01/08/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hudis, Efim, Nice, Nir, Ananiev, Oleg, Edery, Yigal, Wohlfert, John
• Granted Patent: US 8,296,178 B2
• Time in Patent Office: Days
• US Class Current: 705/8
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06Q 30/0204 Market segmentation
• CPC Class Codes: G06Q 30/0215 Including financial accounts
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Secure content management is enabled as a cloud-based service through which security protection and policy enforcement may be implemented for both on-premise network users and roaming users. The global SCM service integrates the security functionalities—such as anti-virus, spyware, and phishing protection, firewall, intrusion detection, centralized management, and the like—that are typically provided by enterprise network SCM appliance hardware or servers into a cloud-based service that users reach via Internet-based points-of-presence (“POPs”). The POPs are configured with forward proxy servers, and in some implementations, caching and network acceleration components, and coupled to hubs which provide configuration management and identity management services such as active directory services.

Claims

1. A method for profiling Internet users, the method comprising the steps of:

providing a value added service using a cloud-based distributed infrastructure including a plurality of POPs, each POP including a forward proxy through which users access and interact with resources available on the Internet;

monitoring user activity with the resources to generate a user profile; and

providing profile-specific content, processes, or experiences to the user responsively at least in part to the user profile to facilitate an enhanced user experience.

2. The method of claim 1 in which the value added service is a globally accessible SCM service.

3. The method of claim 2 in which the globally accessible SCM service provides common policy enforcement to on-premise users and roaming users in an enterprise or household.

4. The method of claim 1 in which the value added service is a network optimized Internet access service, the network optimization providing a low latency connection or localization of the user experience.

5. The method of claim 4 in which the localization is performed using at least one of language, time zone, currency, or character set.

6. The method of claim 1 in which the infrastructure further includes an administrator console functionality in one or more of the POPs and a hub operatively coupled to one or more of the POPs, the hub providing configuration management for forward proxy servers disposed in the hub, and further providing identity management to authenticate and authorize a user.

7. The method of claim 6 in which the infrastructure further includes one or more security products that are operated in accordance with security policies.

8. The method of claim 7 in which the securities policies are disposed in a database located in either a POP or the hub.

9. A method for providing an SCM service for remote IT devices, the method comprising the steps of:

utilizing an infrastructure that is accessible by a user over an Internet connection, the infrastructure including a plurality of POPs, each POP in the plurality including at least a forward proxy server for forwarding traffic from the IT devices to one or more resource servers that are accessible on the Internet, the infrastructure further including a hub operatively coupled to one or more POPs, the hub providing configuration management for forward proxy servers disposed in the hub, and further providing identity management to authenticate and authorize a user of the remote IT device for the SCM service;

redirecting the user to a co-located POP, a POP being co-located when a set of parameters is optimized including network latency compared with non-co-located POPs and localization of a user experience may be implemented; and

rendering a user interface from the co-located POP so that the user may interact with content provided by the one or more resource servers.

10. The method of claim 9 in which the user interface is rendered using one of remotely deployed application, terminal services session, or HTTP.

11. The method of claim 9 including a further step of monitoring clicks performed by the user on content hosted by the one or more resource servers.

12. The method of claim 11 including a further step of pre-fetching data based on the monitoring.

13. The method of claim 9 in which the content comprises one of advertising, search results, or web-based experience.

14. The method of claim 9 including a further step of performing network optimization in a POP, the network optimization including one of caching, HTTP compression, or QoS enforcement.

15. The method of claim 9 in which the user interface is rendered to the user when a local application is unavailable for supporting interaction with the content on the one or more resource servers.

16. A method for providing a secure search service, the method comprising the steps of:

utilizing an infrastructure that is accessible by a user over an Internet connection, the infrastructure including a plurality of POPs, each POP in the plurality including at least a forward proxy server for forwarding a search query from the user to one or more servers;

monitoring clicks performed by the user when interacting with content hosted by the one or more servers to generate a user profile; and

returning results to the search query based at least in part on the user profile so that the results are tailored to the user.

17. The method of claim 16 including a further step of processing the search results by the secure search service to remove links to malicious or illegitimate websites.

18. The method of claim 16 including a further step of providing at least one of policy enforcement or security protection to a client device that is employed by the user.

19. The method of claim 16 including a further step of providing advertising that is targeted to the user based at least in part on the user profile.

20. The method of claim 16 in which the infrastructure further includes a hub operatively coupled to one or more POPs, the hub providing configuration management for forward proxy servers disposed in the hub, and further providing identity management to authenticate and authorize the user to the SCM service.