Services using globally distributed infrastructure for secure content management

• US 8,296,178 B2
• Filed: 08/14/2008
• Issued: 10/23/2012
• Est. Priority Date: 01/08/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hudis, Efim, Edery, Yigal, Ananiev, Oleg, Wohlfert, John, Nice, Nir
• Primary Examiner(s): Frenel, Vanel
• Application Number:
  US12/192,113
• Publication Number:
  US 20090177514A1
• Time in Patent Office: 1,531 Days
• Field of Search: 705/8, 705/14, 705/30, 705/400, 705/7.29, 726/4, 726/22, 726/3, 707/4, 707/E17.014, 455/436, 455/412.1, 370/401
• US Class Current: 705/8
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06Q 30/0204 Market segmentation
• CPC Class Codes: G06Q 30/0215 Including financial accounts
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Secure content management is enabled as a cloud-based service through which security protection and policy enforcement may be implemented for both on-premise network users and roaming users. The global SCM service integrates the security functionalities—such as anti-virus, spyware, and phishing protection, firewall, intrusion detection, centralized management, and the like—that are typically provided by enterprise network SCM appliance hardware or servers into a cloud-based service that users reach via Internet-based points-of-presence (“POPs”). The POPs are configured with forward proxy servers, and in some implementations, caching and network acceleration components, and coupled to hubs which provide configuration management and identity management services such as active directory services.

Claims

1. A method for profiling Internet users, the method comprising the steps of:

providing a globally accessible secure content management service as a value added service implemented using a cloud-based distributed infrastructure including a plurality of points-of-presence, each point-of-presence including a forward proxy through which users access and interact with resources including web pages available on the Internet, each point-of-presence further including a plurality of security products, the security products operating to filter content from the resources, prevent attacks or intrusions into the users'"'"' computing environments, prevent information leakage from the users'"'"' computing environments, or restrict user access to the resources;

monitoring, at the points-of-presence, user activity with the resources to generate a user profile; and

providing profile-specific content, processes, or experiences to the user responsively at least in part to the user profile to facilitate an enhanced user experience.

2. The method of claim 1 in which the value added service provides common policy enforcement to on-premise users and roaming users in an enterprise or household.

3. The method of claim 1 in which the value added service further includes a network optimized Internet access service, the network optimization providing a low latency connection or localization of the user experience.

4. The method of claim 3 in which the localization is performed using at least one of language, time zone, currency, or character set.

5. The method of claim 1 in which the infrastructure further includes an administrator console functionality in one or more of the points-of-presence and a hub operatively coupled to one or more of the points-of-presence, the hub providing configuration management for forward proxy servers disposed in the hub, and further providing identity management to authenticate and authorize a user.

6. The method of claim 5 in which the plurality of security products are operated in accordance with security policies.

7. The method of claim 6 in which the securities policies are disposed in a database located in either a point-of-presence or the hub.

8. A method comprising the steps of:

utilizing an infrastructure that is accessible by a user of a remote information technology device over an Internet connection to provide a globally accessible secure content management service, the infrastructure including a plurality of points-of-presence, each point-of-presence in the plurality including at least a forward proxy server for forwarding traffic from the information technology devices to one or more resource servers that are accessible on the Internet, each point-of-presence further including a plurality of security products, the security products operating to filter content from the resource servers, prevent attacks or intrusions into the user'"'"'s information technology device, prevent information leakage from the user'"'"'s information technology device, or restrict user access to the resource servers, the infrastructure further including a hub operatively coupled to one or more points-of-presence, the hub providing configuration management for forward proxy servers disposed in the hub, and further providing identity management to authenticate and authorize the user of the remote information technology device for the secure content management service;

redirecting the user to a co-located point-of-presence, a point-of-presence being co-located when a set of parameters is optimized including network latency compared with non-co-located points-of-presence and localization of a user experience may be implemented; and

rendering a user interface from the co-located point-of-presence so that the user may interact with content provided by the one or more resource servers.

9. The method of claim 8 in which the user interface is rendered using one of remotely deployed application, terminal services session, or HyperText Transfer Protocol.

10. The method of claim 8 including a further step of monitoring clicks performed by the user on content hosted by the one or more resource servers.

11. The method of claim 10 including a further step of pre-fetching data based on the monitoring.

12. The method of claim 8 in which the content comprises one of advertising, search results, or web-based experience.

13. The method of claim 8 including a further step of performing network optimization in a point-of-presence, the network optimization including one of caching, HyperText Transfer Protocol compression, or Quality of Service enforcement.

14. The method of claim 8 in which the user interface is rendered to the user when a local application is unavailable for supporting interaction with the content on the one or more resource servers.

15. A method for providing a secure search service, the method comprising the steps of:

utilizing an infrastructure that is accessible by a user over an Internet connection to provide a globally accessible secure content management service, the infrastructure including a plurality of points-of-presence, each point-of-presence in the plurality including at least a forward proxy server for forwarding a search query from the user to one or more servers and each point-of-presence further including a plurality of security products, the security products operating to filter content from the one or more servers, prevent attacks or intrusions into the user'"'"'s computing environment, prevent information leakage from the user'"'"'s computing environment, or restrict user access to the one or more servers;

monitoring, at the points-of-presence, clicks performed by the user when interacting with content hosted by the one or more servers to generate a user profile; and

returning results to the search query based at least in part on the user profile so that the results are tailored to the user.

16. The method of claim 15 including a further step of processing the search results by the secure search service to remove links to malicious or illegitimate websites.

17. The method of claim 15 including a further step of providing at least one of policy enforcement or security protection to a client device that is employed by the user.

18. The method of claim 15 including a further step of providing advertising that is targeted to the user based at least in part on the user profile.

19. The method of claim 15 in which the infrastructure further includes a hub operatively coupled to one or more points-of-presence, the hub providing configuration management for forward proxy servers disposed in the hub, and further providing identity management to authenticate and authorize the user to the secure search service.