Method and system for restricting access to user resources

• US 9,038,145 B2
• Filed: 12/20/2013
• Issued: 05/19/2015
• Est. Priority Date: 03/05/1997
• Status: Expired due to Fees

• Current Assignee: At Home Bondholders Liquidating Trust (At Home Corporation)
• Original Assignee: At Home Bondholders Liquidating Trust (At Home Corporation)
• Inventors: Brown, Ralph William, Medin, Milo S., Keller, Robert, Temkin, David
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US14/137,023
• Publication Number:
  US 20140109198A1
• Time in Patent Office: 515 Days
• Field of Search: 726/2, 726/4, 709/229
• US Class Current: 726/4
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 12/1836 with heterogeneous network architecture
• CPC Class Codes: H04L 12/1845 broadcast or multicast in a specific location, e.g. geocast protocols for adapting network applications to user terminal location H04L67/52; services specially adapted for wireless communication networks making use of the location of users or terminals H04W4/02
• CPC Class Codes: H04L 12/1854 with non-centralised forwarding system, e.g. chaincast
• CPC Class Codes: H04L 12/1877 Measures taken prior to transmission
• CPC Class Codes: H04L 12/2801 Broadband local area networks
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2861 Point-to-multipoint connection from the data network to the subscribers
• CPC Class Codes: H04L 12/287 Remote access server, e.g. BRAS
• CPC Class Codes: H04L 12/2883 ATM DSLAM
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/2885 Hierarchically arranged intermediate devices, e.g. for hierarchical caching
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04N 21/2225 Local VOD servers
• CPC Class Codes: H04N 21/23106 involving caching operations prefetching while addressing of a memory level in which the access to the desired data or data block requires associative addressing means within memory systems or architectures G06F12/0862; caching at an intermediate stage in a data network H04L67/568

Abstract

A user'"'"'s set top box (STB), or other client, executes a shell and has an application program interface (API) by which certain features of the client can be controlled. The client is in communication with a walled garden proxy server (WGPS). The client sends a request to the WGPS to access a service provided by a site in the garden. The site sends the client a message containing code calling a function in the API. The WGPS traps the message from the site and looks up the site in a table to determine the access control list (ACL) for the site. The WGPS includes the ACL in the header of the hypertext transport protocol (HTTP) message to the client. The shell receives the message and extracts the ACL. If the code lacks permission, the shell stops execution.

Claims

1. A computer program product comprising:

a non-transitory computer usable storage medium having computer executable instructions embodied therein for managing access to an application program interface (API) comprising a plurality of functions, the computer executable instructions comprising instructions for;

receiving a message containing code calling a function in the API and data indicating API function execution rights for the message;

determining whether the data indicate that the message has a right to execute the called function;

executing the called function responsive to the data indicating that the message has the right to execute the called function; and

sending a response to an originator of the message indicating whether the code successfully executed the function in the API.

2. The computer program product of claim 1, wherein the data indicating API function execution rights comprise:

a value identifying an API function that can be executed by the originator of the message.

3. The computer program product of claim 1, wherein the data indicating API function execution rights comprise:

a value restricting API functions that can be executed by the originator of the message based on time.

4. The computer program product of claim 1, wherein the called function API is associated with television viewing.

5. The computer program product of claim 4, wherein the called function is associated with determining television viewing privileges of a particular television viewer of a plurality of television viewers.

6. The computer program product of claim 1, wherein the data indicating API function execution rights are stored in a header of the received message.

7. The computer program product of claim 1, wherein the data indicating API function execution rights comprise a bit map specifying API function execution rights of the originator of the received message.

8. A computer for managing access to an application program interface (API) comprising a plurality of functions, the computer comprising:

a processor for executing computer program instructions; and

a non-transitory computer usable storage medium having computer program instructions embodied therein, the computer program instructions comprising instructions for;

receiving a message containing code calling a function in the API and data indicating API function execution rights for the message;

determining whether the data indicate that the message has a right to execute the called function;

executing the called function responsive to the data indicating that the message has the right to execute the called function; and

sending a response to an originator of the message indicating whether the code successfully executed the function in the API.

9. The computer of claim 8, wherein the data indicating API function execution rights comprise:

a value identifying an API function that can be executed by the originator of the message.

10. The computer of claim 8, wherein the data indicating API function execution rights comprise:

a value restricting API functions that can be executed by the originator of the message based on time.

11. The computer of claim 8, wherein the called function is associated with television viewing.

12. The computer of claim 11, wherein the called function is associated with determining television viewing privileges of a particular television viewer of a plurality of television viewers.

13. The computer of claim 8, wherein the data indicating API function execution rights are stored in a header of the received message.

14. The computer of claim 8, wherein the data indicating API function execution rights comprise a bit map specifying API function execution rights of the originator of the received message.

15. A method of using a computer processor to manage access to an application program interface (API) comprising a plurality of functions, comprising:

receiving a message containing code calling a function in the API and data indicating API function execution rights for the message;

determining, by the computer processor, whether the data indicate that the message has a right to execute the called function;

executing the called function responsive to the data indicating that the message has the right to execute the called function; and

sending a response to an originator of the message indicating whether the code successfully called the function in the API.

16. The method of claim 15, wherein the data indicating API function execution rights comprise:

a value identifying an API function that can be executed by the originator of the message.

17. The method of claim 15, wherein the data indicating API function execution rights comprise:

a value restricting API functions that can be executed by the originator of the message based on time.

18. The method of claim 15, wherein the called function is associated with television viewing.

19. The method of claim 18, wherein the called function is associated with determining television viewing privileges of a particular television viewer of a plurality of television viewers.

20. The method of claim 15, wherein the data indicating API function execution rights are stored in a header of the received message.