System, method and apparatus for use in monitoring or controlling internet access

• US 8,024,471 B2
• Filed: 09/28/2004
• Issued: 09/20/2011
• Est. Priority Date: 09/09/2004
• Status: Active Grant

• Current Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Original Assignee: Websense UK Ltd. (Francisco Partners Management LLC)
• Inventors: Sinclair, John W., Nash, Alistair H., Pettener, Ian James
• Primary Examiner(s): Serrao; Ranodhi
• Assistant Examiner(s): Cheema; Umar
• Application Number:
  US10/953,716
• Publication Number:
  US 20060069787A1
• Time in Patent Office: 2,548 Days
• Field of Search: 709/223, 709/224, 709/228, 709/229, 370/241, 370/252
• US Class Current: 709/229
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/164 Adaptation or special uses of UDP protocol

Abstract

A system method and apparatus are provided for use in monitoring or controlling internet access at a client device 12. A request message 500 is generated to request categorization of a specified URL, and a reply message 600 is returned denoting a category of the specified URL amongst a predetermined set of categories. The request message 500 comprises a UDP package including a sequence number, a time stamp, and a data section carrying the specified URL. The reply message 600 comprises a UDP packet and includes the sequence number and the time stamp from the request message 500, and a data section identifying the category. The request message 500 and the reply message 600 are economical and provide efficient communication across a local area network or the Internet 20.

Claims

1. A method for controlling or monitoring Internet access by categorizing Uniform Resource Locators (URLs), comprising the steps of:

receiving a URL request denoting a specified URL;

generating a categorization request message to request categorization of the specified URL, wherein generating the request comprises generating a unique value to distinguish the categorization request message for the specified URL from other categorization request messages;

receiving a reply message denoting a category of the specified URI amongst a predetermined set of categories;

wherein;

the categorization request message comprises a User Datagram Protocol (UDP) packet having a payload that includes the unique value, a timestamp, and a data section representing the specified URL; and

the reply message comprises a UDP packet having a payload that includes the unique value and the timestamp corresponding to the categorization request message, and a data section identifying a category of the specified URL amongst the predetermined set of categories;

calculating a timeout with reference to the timestamp;

resending the categorization request message upon expiry of the timeout; and

resending the categorization request message a predetermined number of times, and increasing the timeout between each resend;

wherein the predetermined number of times is reconfigurable during use.

2. The method of claim 1, further comprising generating the unique value as an incremental numerical value to distinguish the categorization request message from other categorization request messages.

3. The method of claim 2, further comprising matching the reply message against the categorization request message according to the unique value.

4. The method of claim 1, further comprising copying the unique value and the timestamp from the categorization request message into the reply message.

5. The method of claim 1, wherein the reply message data section comprises a categorization code identifying a category, a match length that determines a character string length of the specified URL which matched against a stored URL, and an exact flag to denote whether the specified URL was matched exactly against a stored URL.

6. The method of claim 1, further comprising encrypting the categorization request message data section.

7. The method of claim 1, further comprising encrypting the reply message data section.

8. The method of claim 1, wherein:

the categorization request message further comprises a data size field to specify a size of the categorization request message data section, and the reply message further comprises a data size field to specify a size of the reply message data section.

9. The method of claim 1, wherein the categorization request message comprises a command identity field to identify a command amongst a predetermined set of commands, and the reply message is generated according to the identified command.

10. The method of claim 1, wherein the method is applied in a computer network comprising a client device and a categorization server, and the method comprises:

receiving the URL request for a specified URL at the client device and in response generating the categorization request message to request categorization of the specified URL; and

transmitting the categorization request message to the categorization server, and receiving at the client device the reply message that was generated at the categorization server.

11. The method of claim 10, wherein the client device and the categorization server communicate over the Internet, and the method comprises transmitting the categorization request message over the Internet and receiving the reply message over the Internet.

12. The method of claim 11, wherein the client device comprises a user machine to provide a human-oriented user interface, and a client internet gateway appliance to couple the user machine to the Internet through an Internet Service Provider (ISP), and the method comprises:

initiating the URL request in the user machine to request a web page from the specified URL; and

servicing the URL request at the client internet gateway appliance, including requesting the web page from a host according to the specified URL.

13. The method of claim 12, wherein the user machine and the client internet gateway appliance are formed within a single integrated device.

14. The method of claim 12, wherein the user machine and the client internet gateway appliance are separate devices arranged to communicate over a local network.

15. The method of claim 10, wherein the client device and the categorization server are arranged to communicate over a local area network.

16. The method of claim 1, further comprising the step of monitoring or controlling Internet access according to the identified category of the specified URL.

34. A non-transitory program storage medium having computer executable instructions stored thereon which, when executed, perform the method of claim 1.

37. The method of claim 1, wherein the categorization request message comprises a licensing identity associated with the client.

38. The method of claim 37, wherein the categorization request message comprises a partner ID and a client ID field.

17. A method for use in controlling or monitoring of Internet access at a client device by categorizing Uniform Resource Locators (URLs), comprising the steps of:

generating a categorization request message to request categorization of a specified URL, wherein the categorization request message comprises a request message header section including a sequence number field and a timestamp field, and a data section representing the specified URL, wherein the header section and the data section are the payload of a UDP packet and wherein generating the categorization request message header comprises generating the sequence number field as an incremental numerical value to distinguish the categorization request message for the specified URL from other categorization request messages;

sending the categorization request message to a categorization server which determines a category of the specified URL amongst a predetermined set of categories, and in reply receiving a reply message comprising a request message header section including a sequence number field and a timestamp field each having contents corresponding to those of the respective fields of the categorization request message, and a data section identifying a category of the specified URL amongst the predetermined set of categories, wherein the header section and the data section are the payload of a UDP packet;

calculating a timeout period with reference to the timestamp;

resending the categorization request message one or more times upon expiry of the or each successive timeout period; and

resending the categorization request message a predetermined number of times, and increasing the timeout between each resend;

wherein the predetermined number of times is reconfigurable during use.

18. The method of claim 17, further comprising matching the reply message against the categorization request message according to the sequence number field.

19. The method of claim 17, wherein the reply message data section comprises a categorization code which identifies a category, and a match length that determines a character string length of the specified URL which matched against a stored URL in a categorization database at the categorization server.

20. The method of claim 19, wherein the reply message data section further comprises an exact flag to denote whether the specified URL was matched exactly against the stored URL.

21. The method of claim 17, further comprising encrypting the data section before sending the categorization request message, and decrypting the data section of a received reply message.

22. The method of claim 17, further comprising passing the identified category from the reply message to a function for monitoring or controlling Internet access according to the identified category of the specified URL.

35. A non-transitory program storage medium having computer executable instructions stored thereon which, when executed, perform the method of claim 17.

23. A method for use at a categorization server to assist in controlling or monitoring of Internet access at a client device by categorizing Uniform Resource Locators (URLs), comprising the steps of:

receiving a categorization request message which requests categorization of a specified URL, wherein the categorization request message comprises a request message header section including a sequence number field and a timestamp field, and a data section representing the specified URL, wherein the header section and the data section are the payload of a UDP packet and wherein the sequence number field comprises an incremental numerical value that distinguishes the categorization request message for the specified URL from other categorization request messages; and

determining a category of the specified URL amongst a predetermined set of categories at the categorization server, and generating a reply message comprising a reply message header including a sequence number field and a timestamp field each having contents corresponding to those of the respective fields of the received categorization request message, and a data section identifying a category of the specified URL amongst the predetermined set of categories, wherein the header section and the data section are the payload of a UDP packet;

sending the reply message from the categorization server for receipt by the client device;

calculating a timeout with reference to the timestamp;

resending the reply message upon expiry of the timeout; and

resending the reply message a predetermined number of times, and increasing the timeout between each resend;

wherein the predetermined number of times is reconfigurable during use.

24. The method of claim 23, further comprising sending the reply message as a UDP packet over Internet Protocol.

25. The method of claim 24, further comprising directly copying the sequence number and the timestamp from the categorization request message into the reply message.

26. The method of claim 23, further comprising extracting the specified URL from the data section of the categorization request message, and searching a categorization database to determine a category code for the specified URL.

27. The method of claim 26, further comprising generating the reply message data section including the category code for the specified URL, a match length that determines a character string length of the specified URL which matched against a stored URL in the categorization database, and an exact flag to denote whether the specified URL was matched exactly against the stored URL.

28. The method of claim 23, further comprising decrypting the data section of a received categorization request message, and encrypting the data section before sending the reply message.

36. A non-transitory program storage medium having computer executable instructions stored thereon which, when executed, perform the method of claim 23.

29. A system for use in controlling or monitoring of Internet access by categorizing Uniform Resource Locators (URLs), comprising:

a client device comprising a processor controlled device configured to monitor or control Internet access according to a category of a specified URL, including generating a categorization request message to request categorization of the specified URL, wherein the categorization request message comprises a request message header section including a sequence number field and a timestamp field, and a data section representing the specified URL, wherein the header section and the data section are the payload of a UDP packet wherein the client device is configured to generate the sequence number field as an incremental numerical value to distinguish the categorization request message for the specified URL from other categorization request messages; and

a categorization server comprising a processor controlled device configured to communicate with the client device and arranged to receive the categorization request message and determine a category of the specified URL, including generating a reply message comprising a request message header section including a sequence number field and a timestamp field each having contents corresponding to those of the respective fields of the received categorization request message, and a data section identifying a category of the specified URL amongst the predetermined set of categories, wherein the header section and the data section are the payload of a UDP packet;

wherein the client device is further configured to;

calculate a timeout with reference to the timestamp;

resend the categorization request message upon expiry of the timeout; and

resend the categorization request message a predetermined number of times, and increase the timeout between each resend;

wherein the predetermined number of times is reconfigurable during use.

39. The method of claim 29, wherein the categorization server comprises a licensing cache, the licensing cache comprising a hash of license keys to license tree lists.

30. A non-transitory computer readable medium having instructions stored thereon which when executed provide:

an interface module arranged to present a URL categorization function, wherein the interface module is passed a specified URL from a client software and returns a categorization code;

an encryption module which encrypts and decrypts data;

a protocol module which marshals and unmarshals incoming and outgoing data and makes encryption/decryption calls to the encryption module; and

a communication module arranged to send an outgoing categorization request message to a remote categorization server and to receive and buffer incoming data including a corresponding reply message, wherein;

the categorization request message comprises a header section including a sequence number field and a timestamp field, and an encrypted data section representing the specified URL, wherein the header section and the data section are the payload of a UDP packet and wherein the sequence number field comprises an incremental numerical value that distinguishes the categorization request message for the specified URL from other categorization request messages; and

the reply message comprises a header section including the sequence number field and the timestamp field having contents corresponding to those of the respective fields of the categorization request message, and an encrypted data section identifying a category of the specified URL amongst the predetermined set of categories as determined by the categorization server, wherein the header section and the data section are the payload of a UDP packet;

wherein the communication module is further arranged to;

calculate a timeout with reference to the timestamp;

resend the categorization request message upon expiry of the timeout; and

resend the categorization request message a predetermined number of times, and increase the timeout between each resend;

wherein the predetermined number of times is reconfigurable during use.

31. A non-transitory computer readable medium of claim 30, wherein the client device comprises a router or a modem to couple the client device to the Internet through an Internet Service Provider.

32. A non-transitory computer readable medium of claim 30, wherein the client device comprises a client computer communicating with the categorization server over a local area network.

33. A non-transitory computer readable medium having instructions stored thereon which when executed provide:

a main module arranged to determine a category of a specified URL amongst a set of predetermined categories by comparing the specified URL against stored URLs in a categorization database;

an encryption unit arranged to encrypt and decrypt data;

a protocol module arranged to unmarshal incoming data into a comprehensible command format and marshal outgoing data into a transmittable format, and make encryption/decryption calls to the encryption unit; and

a communication module arranged to receive and buffer incoming and outgoing data and respond to an incoming categorization request message including generation of an corresponding outgoing reply message, wherein;

the categorization request message comprises a header section including a sequence number field and a timestamp field, and an encrypted data section representing the specified URL, wherein the header section and the data section are the payload of a UDP packet and wherein the sequence number field comprises an incremental numerical value that distinguishes the categorization request message for the specified URL from other categorization request messages; and

the reply message comprises a header section including the sequence number field contents and the timestamp field contents from the categorization request message, and an encrypted data section identifying a category of the specified URL amongst the predetermined set of categories as determined by the main module, wherein the header section and the data section are the payload of a UDP packet;

wherein the communication module is further arranged to;

calculate a timeout with reference to the timestamp;

resend the categorization request message upon expiry of the timeout; and

resend the categorization request message a predetermined number of times, and increase the timeout between each resend;

wherein the predetermined number of times is reconfigurable during use.