SYSTEM AND METHOD FOR DATA AND REQUEST FILTERING

• US 20150113603A1
• Filed: 08/12/2014
• Published: 04/23/2015
• Est. Priority Date: 03/21/2003
• Status: Active Grant

• Current Assignee: Imprivata Incorporated
• Original Assignee: Imprivata Incorporated
• Inventors: Ting, David M. T.
• Granted Patent: US 10,505,930 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Data and data requests of users of applications are filtered using a client-resident agent. A user profile may contain data pertaining to restrictions on content the user is permitted to view or types of requests the user is permitted to make. within one or more applications. Data in the user profile may be used to grant or deny access to applications, filter particular content from the user'"'"'s view, or filter particular data requests made by the user.

Claims

1. A method of controlling access to data provided to a client computer operated by a user, the client computer executing an operating system and client-resident applications, the method comprising the steps of:

a. identifying the user;

b. receiving, at the client computer, data-restriction information based on the user'"'"'s identity;

c. on the client computer, following retrieval of external data from a server, monitoring a message queue of the operating system and recognizing messages corresponding to an application to which access is sought by the user; and

d. based on the recognized messages and the data-restriction information, according or restricting user access to the application.

2. The method of claim 1 wherein according or restricting user access to the application comprises restricting execution of the operating system instructions in accordance with the data-restriction information, thereby limiting display of the retrieved external data

3. The method of claim 1 wherein the data-restriction information is stored on a server in communication with the client computer over a network.

4. The method of claim 1 wherein the data-restriction information specifies web pages the user is permitted to request.

5. The method of claim 1 wherein the data-restriction information specifies web pages the user is prohibited from requesting.

6. The method of claim 1 wherein the data-restriction information limits application screens the user is permitted to view.

7. The method of claim 1 wherein the data-restriction information limits data on a screen a user is permitted to view.

8. The method of claim 3 further comprising the step of authenticating the user by:

a. storing, on the server, a user profile comprising the data-restriction information and a reference set of biometric data identifying the user;

b. receiving, at the client computer, biometric data from the user;

c. transmitting the received biometric data from the client computer to the server over the network; and

d. if the received biometric data sufficiently matches the reference biometric data, confirming the identity of the user and transmitting the data-restriction information to the client computer.

9. The method of claim 1 wherein external data is monitored as it is received by the client computer, and access is limited in accordance with the data-restriction information.

10. The method of claim 1 wherein user requests for external data are monitored on the client computer and access is limited by restricting the user requests in accordance with the data-restriction information.

11. A system for controlling access by a user operating a client computer to data provided to the client, the client comprising an operating system and executable applications, the system comprising:

a. a communications module on the client computer for communicating with a computer network for receiving thereover data-restriction information; and

b. an active agent operable on the client computer for (i) monitoring a message queue of the operating system and recognizing messages corresponding to an application to which access is sought by a user of the client, and (ii) based on the recognized messages and the data-restriction information, according or restricting user access to the application

12. The system of claim 11 wherein the data-restriction information specifies web pages the user is permitted to request.

13. The system of claim 11 wherein the data-restriction information specifies web pages the user is prohibited from requesting.

14. The system of claim 11 wherein the data-restriction information limits application screens the user is permitted to view.

15. The system of claim 11 wherein the data-restriction information limits data on a screen a user is permitted to view.

16. The system of claim 11 further comprising, on the client computer, a biometric input device for receiving, at the client computer, biometric data from the user, the communications module transmitting the received biometric data from the client computer to the identification server over the computer network.

17. The system of claim 11 wherein the active agent monitors external data as the external data is received by the client computer, and limits access to the data in accordance with the data-restriction information.

18. The system of claim 11 wherein the active agent monitors user requests for external data on the client computer and limits access by restricting the user requests in accordance with the data-restriction information.