Network Access Protection

• US 20100325710A1
• Filed: 05/20/2010
• Published: 12/23/2010
• Est. Priority Date: 06/19/2009
• Status: Active Grant

• Current Assignee: Cryptosoft Limited
• Original Assignee: DeviceAuthority Inc. (f/k/a NetAuthority, Inc.) (Device Authority Ltd.)
• Inventors: Etchegoyen, Craig S.
• Granted Patent: US 9,047,458 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers

Abstract

A system or method for network access protection executes steps for receiving, at a server, an access request for access to at least one network resource from a client machine, the access request including account authentication information comprising an account identifier and password, obtaining a client machine identifier from the client machine in response to receiving the request for access, and controlling access to the network resource in response to the access request by authorizing access to the network resource for the access request if the client machine identifier matches a registered machine identifier that is registered for use with the account authentication information and the account authentication information matches registered information for a valid account, but denying access to the network resource if the client machine identifier does not match a registered client machine identifier that is registered for use with the account authentication information.

Claims

1. A method comprising:

receiving, at a server, an access request for access to at least one network resource from a client machine, the access request including account authentication information comprising an account identifier and password;

obtaining a client machine identifier from the client machine, in response to receiving the request for access; and

controlling access to the network resource in response to the access request, by authorizing access to the network resource for the access request if the client machine identifier matches a registered machine identifier that is registered for use with the account authentication information and the account authentication information matches registered information for a valid account, but denying access to the network resource if the client machine identifier does not match a registered client machine identifier that is registered for use with the account authentication information.

2. The method of claim 1, further comprising registering a client machine identifier received from the client machine in an initial registration session.

3. The method of claim 1, further comprising maintaining a registry of account identifiers and client machine identifiers for use by the server in authorizing access to the network resource, wherein the registry associates each of the client machine identifiers with an at least one account identifier.

4. The method of claim 1, further comprising, in response to the access request, activating an executable object on the client machine operable to generate the client machine identifier by reading system data indicating a current system configuration of the client machine.

5. The method of claim 4, wherein the executable object activated on the client machine is further operable to process the system data to develop the client machine identifier.

6. The method of claim 4, further comprising activating the executable object by serving at least a portion of the executable object from the server to the client machine.

7. The method of claim 4, further comprising activating the executable object by transmitting an activation signal from the server to the client machine, the activation signal operable to activate the executable object stored in a memory of the client machine.

8. The method of claim 1, further comprising maintaining a registry of addresses for different network resources, including the at least one network resource, identifying one or more account identifiers authorized for access to one or more different network resources.

9. A system for controlling access to network resources in response to access requests, the system comprising:

means for processing an access request for access to at least one network resource from a client machine, the access request including account authentication information comprising an account identifier and password;

means for obtaining a client machine identifier from the client machine, in response to receiving the access request; and

means for controlling access to the network resource in response to the access request, responsive to determining whether or not the client machine identifier matches a registered machine identifier that is registered for use with the account authentication information and the account authentication information matches registered information for a valid account.

10. The system of claim 9, further comprising means for registering a client machine identifier received from the client machine in an initial registration session.

11. The system of claim 9, further comprising means for maintaining a registry of account identifiers and client machine identifiers for use by the means for authorizing access to the network resource, wherein the registry associates each of the client machine identifiers with an at least one account identifier.

12. The system of claim 9, further comprising means for activating an executable object on the client machine operable to generate the client machine identifier by reading system data indicating a current system configuration of the client machine.

13. The system of claim 9, further comprising means for generating the client machine identifier by reading system data indicating a current system configuration of the client machine and processing the system data to develop the client machine identifier.

14. A computer-readable medium encoded with software, that when executed by a processor, causes a computer to perform the functions of:

receiving an access request for access to at least one network resource from a client machine, the access request including account authentication information comprising an account identifier and password;

obtaining a client machine identifier from the client machine, in response to receiving the access request; and

controlling access to the network resource in response to the access request, by authorizing access to the network resource for the access request if the client machine identifier matches a registered machine identifier that is registered for use with the account authentication information and the account authentication information matches registered information for a valid account, but denying access to the network resource if the client machine identifier does not match a registered client machine identifier that is registered for use with the account authentication information.

15. The computer-readable medium of claim 14, further encoded with software configured to cause the computer to register a client machine identifier received from the client machine in an initial registration session.

16. The computer-readable medium of claim 14, further encoded with software configured to cause the computer to access a registry of account identifiers and client machine identifiers when authorizing access to the network resource, wherein the registry associates each of the client machine identifiers with an at least one account identifier.

17. The computer-readable medium of claim 14, further encoded with software configured to cause the computer to activate an executable object on the client machine operable to generate the client machine identifier by reading system data indicating a current system configuration of the client machine.

18. The computer-readable medium of claim 14, further encoded with software configured to cause the computer to activate the executable object by serving at least a portion of the executable object from the computer to the client machine.

19. The computer-readable medium of claim 14, further encoded with software configured to cause the computer to activate the executable object by transmitting an activation signal from the computer to the client machine, the activation signal operable to activate the executable object stored in a memory of the client machine.

20. The computer-readable medium of claim 14, further encoded with software configured to cause the computer to access a registry of addresses for different network resources, including the at least one network resource, associated with particular account identifiers, to determine if the access request should be authorized for access to one or more different network resources.