Method and system for secure URL-based access control

• US 7,437,468 B2
• Filed: 12/16/2003
• Issued: 10/14/2008
• Est. Priority Date: 12/27/2002
• Status: Expired due to Fees

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Wada, Tokuhiro, Yamamoto, Hidenobu, Yoshino, Hirofumi, Ogawa, Yukio, Saitoh, Michiko
• Primary Examiner(s): Lin; Wen-Tai
• Application Number:
  US10/738,703
• Publication Number:
  US 20040260821A1
• Time in Patent Office: 1,764 Days
• Field of Search: None
• US Class Current: 709/229
• CPC Class Codes: H04L 2101/32 containing non-Latin characters, e.g. Chinese domain names
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

System, method and program product performed by a proxy server which forwards an access request from a client to a data server and forwards response data from the data server to the client. A first address location and an encoding format of the response data are stored. A subsequent access request from the client which includes a second address location encoded by the encoding format is received. The second address location is compared to the first address location to determine if the second address location is related to the first address location. In response to a determination that the second address location is related to the first address location, the second address location is decoded based on the encoding format. The data server can be a web server, the response data can be a web page, and the second address location can include the first address. For example, the second address location can be an extension of the first address location.

Claims

1. A method performed by a proxy server which forwards an access request from a client to a data server and forwards response data from the data server to the client, said method comprising the steps of:

storing a first address location and an encoding format obtained from said response data;

receiving a subsequent access request from said client which includes a second address location that is encoded;

comparing said second address location to said first address location to determine if said second address location is related to said first address location; and

in response to a determination that said second address location is related to said first address location, decoding said second address location based on said encoding format, wherein the second address location includes the first address location, but they are not the same.

2. The method according to claim 1 wherein said data server is a web server, said response data is a web page.

3. The method according to claim 2 wherein said second address location is an extension of said first address location.

4. The method according to claim 1 further comprising the steps of:

determining access-allowed/access-prohibited for said subsequent access request based on the decoded second address location; and

transmitting said subsequent access request to said data server if said determination is that access is allowed for said access request.

5. The method according to claim 4 wherein said comparing step includes the step of comparing the decoded second address location with a list of allowed addresses or prohibited addresses previously stored in said proxy server.

6. The method according to claim 1 wherein said first address location is a location of a web page currently displayed on a client system when a user of said client system selects said second address location.

7. The method according to claim 1 wherein said access request is an HTTP request, said first address location is a URL of a home page, said response data is said home page and said encoding format is an attribute value of “

charset”

of said response data.

8. The method according to claim 1 wherein said encoding format is UTF-8, EUC, Unicode or Shift-JIS.

9. The method according to claim 1 further comprising:

determining whether said subsequent access request is allowed by comparing the decoded second address location to an access control list; and

transmitting said subsequent access request to said data server if a determination is made to allow access for said request.

10. The method according to claim 9, wherein the access control list identifies address locations for which access is permitted.

11. The method according to claim 1, wherein the second address location includes a character using a byte code other than a single byte code.