Methods for performing secure on-line testing without pre-installation of a secure browser

• US 20100088740A1
• Filed: 10/08/2008
• Published: 04/08/2010
• Est. Priority Date: 10/08/2008
• Status: Abandoned Application

• Current Assignee: CTB/McGraw Hill LLC
• Original Assignee: Bookette Software Company Inc.
• Inventors: Waters, A. Bryan
• Application Number:
  US12/287,336
• Publication Number:
  US 20100088740A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06Q 50/20 Education

Abstract

Methods for performing secure on-line testing without the need for pre-installation of a secure browser are provided. The methods use a general purpose web browser which is already installed on the user'"'"'s computer and extend the browser so as to restrict the functionality of the user'"'"'s computer in at least one way which makes the computer more secure with regard to testing. The extending occurs through the transmission of trusted code to the user'"'"'s computer over the internet. The elimination of the need for pre-installation represents a major savings to school districts in terms of the amount of IT professional time that must be dedicated to on-line testing, especially for school districts having large numbers of installed computers. Apparatus for practicing the methods is also provided.

Claims

1. A method for administering a test and/or providing instruction over the internet to a user whose installed computer programs comprise a general purpose web browser, said method comprising:

(a) providing a server which is capable of;

(i) transmitting trusted code over the internet to the user'"'"'s computer; and

(ii) activating said trusted code on said user'"'"'s computer;

said trusted code extending the user'"'"'s general purpose web browser so as to restrict the functionality of the user'"'"'s computer in at least one way;

(b) enabling said trusted code on the user'"'"'s computer from the server; and

(c) providing the test and/or the instruction to the user on the user'"'"'s computer from the server while the functionality of the user'"'"'s computer is restricted in said at least one way;

where the enabling of step (b) comprises either transmitting and activating the trusted code on the user'"'"'s computer in cases where the trusted code is not pre-cached on the user'"'"'s computer or activating the trusted code in cases where the trusted code is pre-cached on the user'"'"'s computer.

2. The method of claim 1 wherein the general purpose web browser has a default mode which as provided by the manufacturer of the browser has a security level that does not ensure that the computer system which runs the browser is in a consistent state from user to user.

3. The method of claim 1 wherein the restriction on the functionality of the user'"'"'s computer comprises at least one of:

(i) suppressing application and system menu and task bars; and

(ii) trapping and modifying or disabling control and function keys.

4. The method of claim 1 wherein the restriction on the functionality of the user'"'"'s computer comprises (i) suppressing application and system menu and task bars, and (ii) trapping and modifying or disabling control and function keys.

5. The method of claim 1 wherein the restriction on the functionality of the user'"'"'s computer comprises one or more of:

(i) preventing use of a previously-installed calculator;

(ii) preventing use of a previously-installed spell checker;

(iii) preventing use of a previously-installed grammar checker;

(iv) preventing searching of files on the user'"'"'s computer;

(v) preventing searching on an intranet; and

(vi) preventing searching on the internet.

6. The method of claim 1 wherein the restriction on the functionality of the user'"'"'s computer comprises forcing the screen into a full screen mode by using a top-of-the-heap procedure.

7. The method of claim 1 wherein the restriction on the functionality of the user'"'"'s computer comprises identifying a browser window by examining a list of top level windows in a WINDOWS operating system.

8. The method of claim 1 wherein the restriction on the functionality of the user'"'"'s computer comprises setting a value in a system registry of a WINDOWS operating system in order to prevent the display of an undesired user interface in response to the ctl-alt-del keystroke combination.

9. The method of claim 1 wherein the trusted code is disabled upon completion of a secure test and/or completion of an instructional session.

10. The method of claim 1 wherein the trusted code comprises less than 10 percent of the bytes making up the user'"'"'s general purpose web browser.

11. The method of claim 1 wherein the method administers a secure test.

12. The method of claim 1 wherein the trusted code is selected from the group consisting of unsigned but pre-approved extensions and signed extensions.

13. The method of claim 1 wherein the trusted code is a signed extension.

14. The method of claim 1 wherein the user'"'"'s computer is part of a computer network and prior to step (a), the network'"'"'s overall security level is adjusted to permit the receipt of signed extensions.

15. The method of claim 14 wherein the adjustment of the network'"'"'s overall security level comprises adjusting the security level of one or more of:

(i) a user computer within the network, (ii) a proxy server within or outside the network, and (iii) a firewall within or outside of the network.

16. A computer program embodied in a tangible computer readable medium for performing the method of claim 1.

17. A method for administering a test and/or providing instruction over the internet to a user whose installed computer programs comprise a general purpose web browser, said method comprising:

(a) providing a website which is capable of;

(i) transmitting trusted code over the internet to the user'"'"'s computer; and

(ii) activating said trusted code on said user'"'"'s computer,

said trusted code extending the user'"'"'s general purpose web browser so as to restrict the functionality of the user'"'"'s computer in at least one way;

(b) enabling said trusted code on the user'"'"'s computer from the website; and

(c) providing the test and/or the instruction to the user on the user'"'"'s computer from the website while the functionality of the user'"'"'s computer is restricted in said at least one way;

where the enabling of step (b) comprises either transmitting and activating the trusted code on the user'"'"'s computer in cases where the trusted code is not pre-cached on the user'"'"'s computer or activating the trusted code in cases where the trusted code is pre-cached on the user'"'"'s computer.

18. The method of claim 17 wherein the general purpose web browser has a default mode which as provided by the manufacturer of the browser has a security level that does not ensure that the computer system which runs the browser is in a consistent state from user to user.

19. The method of claim 17 further comprising disabling the trusted code on the user'"'"'s computer from the website.

20. The method of claim 19 wherein the user remains at the website after the trusted code is disabled.

21. The method of claim 17 wherein the trusted code comprises less bytes than the bytes of the largest page of the website.

22. A computer system programmed to perform the method of claim 17.

23. A method for taking a test and/or receiving instruction over the internet comprising:

(a) visiting a website using a computer whose installed computer programs comprise a general purpose web browser;

(b) receiving trusted code from the website over the internet, said trusted code extending the general purpose web browser so as to restrict the functionality of the computer in at least one way;

(c) activating the trusted code; and

(d) receiving the test and/or the instruction over the internet from a website while the trusted code is activated.

24. A method for taking a test and/or receiving instruction over the internet using a computer which has (i) a general purpose web browser and (ii) trusted code that extends the general purpose web browser so as to restrict the functionality of the computer in at least one way, said method comprising:

(a) visiting a website that activates the trusted code; and

(b) receiving the test and/or the instruction over the internet from a website while the trusted code is activated.

25. A system comprising:

(a) a processor;

(b) an internet connection coupled to the processor; and

(c) a memory unit coupled to the processor, said memory unit storing a computer program for transforming a user'"'"'s general purpose web browser into a secure browser, said computer program including programming instructions for performing the following steps;

(i) transmitting trusted code through the internet connection to a user'"'"'s computer; and

(ii) activating said trusted code on the user'"'"'s computer;

wherein the trusted code extends a general purpose web browser on the user'"'"'s computer so as to restrict the functionality of the user'"'"'s computer in at least one way.