System, method and apparatus for use in monitoring or controlling internet access

• US 8,141,147 B2
• Filed: 09/28/2004
• Issued: 03/20/2012
• Est. Priority Date: 09/09/2004
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Websense UK Ltd. (Forcepoint LLC)
• Inventors: Sinclair, John W., Pettener, Ian James, Nash, Alistair H.
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US10/953,121
• Publication Number:
  US 20060053488A1
• Time in Patent Office: 2,730 Days
• Field of Search: 726/4, 726/27, 726/28, 726/11, 713/176, 713/183
• US Class Current: 726/22
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

An apparatus, method and system for use in categorizing Uniform Resource Locators (URLs) when controlling or monitoring access to the Internet from a client. A request message is generated to request categorization of a specified URL. The request message comprises a licensing field carrying a license key. A remote server receives the license key and, if valid, generates a reply message denoting a category of the specified URL. The license key enables workload at the server to be managed efficiently.

Claims

1. A method for use in controlling or monitoring of Internet access by categorizing Uniform Resource Locators (URLs), comprising the steps of:

receiving a request message from a client device requesting categorization of a specified URL, wherein the request message comprises at least four different members of the group comprising a time stamp, a sequence number, a data size, a request data, data indicative of the specified URL including a host portion, and a licensing field carrying a license key having a partner ID and a client ID;

validating by a processor of a categorization server using Dynamic Link Library, the license key using the partner ID to identify a licensing scheme from one of a plurality of selectable licensing schemes and using the client ID to validate the client device; and

if valid, generating a reply message denoting a category of the specified URL amongst a predetermined set of categories, wherein the reply message comprises at least one of a date or time stamp;

.

wherein the categorization of the URL is initially based on information indicative of a host name.

2. The method of claim 1, further comprising:

receiving the request message generated at a client device; and

validating the license key at a categorization server.

3. The method of claim 2, wherein the license key is associated with the client device.

4. The method of claim 3, further comprising calling a license module, said calling includes passing the licensing key to the license module for validation.

5. The method of claim 4, further comprising the steps of:

storing one or more license keys in a license cache, where the stored license keys have been validated previously; and

validating a received license key by matching it with a stored license key in the license cache, or else calling the license module.

6. The method of claim 5, further comprising the step of adding a validated license key to the license cache, when validity of the license key has been determined by the license module.

7. The method of claim 5, wherein the license cache comprises:

a hash array comprising one or more index elements, each index element comprising a license tree pointer and a hash key derived from a stored license key; and

one or more license trees comprising one or more tree nodes each holding license data representing stored license keys and an associated validity status.

8. The method of claim 7, wherein the licensing cache further comprises:

an age list including the one or more tree nodes organized by age, wherein the age list comprises, within each tree node, a next pointer and a previous pointer which refer to a next older tree node and a previous newer tree node, respectively.

9. The method of claim 8, comprising managing the license cache to stay within a predetermined size by deleting older tree nodes from a tail of the age list, and adding new tree nodes to the head of the age list, wherein deleting comprises referring a tree node to the next and previous tree pointers.

10. The method of claim 9, comprising updating the age list to keep recently accessed tree nodes at the head of the age list.

11. The method of claim 10, comprising periodically flushing the license cache.

12. The method of claim 5, wherein the license module is a dynamic linked library (DLL).

13. The method of claim 2, wherein the client device and the categorization server communicate over the Internet, and wherein the method comprises transmitting the request message over the Internet and transmitting the reply message over the Internet.

14. The method of claim 13, wherein the client device comprises a user machine to provide a human-oriented user interface, and a client internet gateway appliance to couple the user machine to the Internet through an Internet Service Provider (ISP), and wherein the method comprises:

initiating a URL request in the user machine to request a web page from the specified URL; and

servicing the URL request at the client internet gateway appliance, including requesting the web page from a host according to the specified URL.

15. The method of claim 14, wherein the user machine and the client internet gateway appliance are formed within a single integrated device.

16. The method of claim 14, wherein the user machine and the client internet gateway appliance are separate devices arranged to communicate over a local network.

17. The method of claim 2, wherein the client device and the categorization sever are arranged to communicate over a local area network.

18. The method of claim 1, further comprising selecting a partner license module from amongst one or more partner license modules according to the partner ID field, and passing the licensing key to the selected partner license module for validation.

19. A non-transitory program storage medium having computer executable instructions stored thereon for performing the method of claim 1.

20. A method for use at a categorization server in controlling or monitoring of Internet access at a client device, the method comprising the steps of:

receiving a request message to request categorization of a specified URL, wherein the request message comprises at least four different members of the group comprising a time stamp, a sequence number, a data size, a request data, data indicative of the specified URL including a host portion, and a licensing field carrying a license key having a partner ID and a client ID; and

validating by a processor of the categorization server using Dynamic Link Library, the license key using the partner ID to identify a licensing scheme from one of a plurality of selectable licensing schemes and using the client ID to validate the client device, wherein the reply message comprises at least one of a date or time stamp; and

if valid, generating a reply message denoting a category of the specified URL amongst a predetermined set of categories,

wherein the categorization of the URL is initially based on information indicative of a host name.

21. The method of claim 20, further comprising:

storing one or more license keys in a license cache, where the stored license keys have been validated previously; and

validating a received license key by matching with a stored license key in the license cache, or else calling a license validation function.

22. The method of claim 20, further comprising:

passing the license key to a licensing module which performs validation and returns a “

license valid”

or “

license invalid”

status; and

controlling whether or not the categorization server will respond to the request message based on the status.

23. A non-transitory program storage medium having computer executable instructions stored thereon for performing the method of claim 20.

24. A categorization server, comprising:

a first module arranged to receive a request message denoting a specified URL and to provide a corresponding category code in return, wherein the request message further comprises at least four different members of the group comprising a time stamp, a sequence number, a data size, a request data, data indicative of the specified URL including a host portion, and a license key having a partner ID and a client ID; and

a license module, executed on a processor of the categorization server using Dynamic Link Library, said license module arranged to validate the license key using the partner ID to identify a licensing scheme from one of a plurality of selectable licensing schemes and using the client ID to validate a client device and thereby control whether or not the first module provides the category code,

wherein the categorization of the URL is initially based on information indicative of a host name.

25. The categorization server of claim 24, wherein the license module comprises a license cache to store one or more license keys which have been validated recently.

26. The categorization server of claim 24, wherein the license module comprises:

a partner license module arranged to validate a license key and provide a validation result; and

a license interface module arranged to pass the license key to the partner license module and receive the validation result.

27. The categorization server of claim 24, wherein the license module comprises:

one or more partner license DLLs each arranged to validate the license key and provide a validation result; and

a license interface DLL arranged to pass the license key to a selected one amongst the one or more partner licenses DLLs according to a partner ID field and receive the validation result.

28. The categorization server of claim 27, wherein the license interface DLL resolves a partner ID field by referring to a partner map database, which links the partner ID to a partner license DLL name.

29. The categorization server of claim 28, wherein the one or more partner license DLLs include any one or more of:

a no license DLL which indicates that any license key is valid;

a no database DLL which performs a mathematical, algorithmic or cryptographic validation of the license key;

a hosted licensing DLL which forwards licensing requests to a remote licensing server for validation; and

a database licensing DLL which connects directly into an ODBC database using a stored procedure to validate the license key.

30. The categorization server of claim 24, comprising:

a main module arranged to determine a category of a specified URL amongst a set of predetermined categories by comparing the specified URL against stored URLs in a categorization database;

an encryption unit arranged to encrypt and decrypt data;

a protocol module arranged to unmarshal incoming data into a comprehensible command format and marshal outgoing data into a transmittable format, and make encryption and decryption calls to the encryption unit; and

a communication module arranged to receive and buffer incoming and outgoing data and respond to an incoming categorization request message including generation of a corresponding outgoing reply message;

wherein the licensing module is arranged to validate a license key provided in the incoming categorization request message and inform the communication module of a validation result.