Site access via intervening control layer

• US 20020087692A1
• Filed: 03/13/2002
• Published: 07/04/2002
• Est. Priority Date: 12/01/1997
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: NetSelector, Inc. (Apple Inc.)
• Inventors: Wynne, Ed, Woods, Jonathan
• Granted Patent: US 7,334,037 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/53 using third party service providers
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Monitoring site access via an intervening control layer within a client is disclosed. In one embodiment of the invention, a computerized system includes a plurality of sites, a monitoring server, and a client. Each site has content referenced be addresses. The monitoring server maintains a database of permissible content on at least one of the plurality of sites, where the permissible content is also referenced by addresses. The client has an intervening control layer within an otherwise standard mechanism by which programs running on the client access the content on the plurality of sites. The intervening control layer polls the monitoring server to determine whether a program attempting to access content on one of the sites as referenced by an address should be permitted to do so.

Claims

1. A computerized system comprising:

a plurality of sites, each site having content referenced by addresses, the sites hosted on one or more servers;

a monitoring server, distinct from the one or more servers, maintaining a database of permissible content on at least one of the plurality of sites, the permissible content referenced by addresses; and

,

a client having an intervening control layer within an otherwise standard mechanism by which programs running on the client access the content on the plurality of sites,

such that the intervening control layer polls the monitoring server to determine whether a program attempting to access content on one of the sites as referenced by an address should be permitted to do so.

2. The computerized system of claim 1, wherein the client maintains a cache of permissible content on at least one of the plurality of sites so that subsequent permission to programs running on the client to access the permissible content can be given without repeated polling of the monitoring server.

3. The computerized system of claim 1, wherein at least some of the permissible content of the database maintained by the monitoring service comprises all hypertext-markup-language (HTML) pages located at a site.

4. The computerized system of claim 1, wherein at least some of the permissible content of the database maintained by the monitoring service comprises an incomplete portion of all hypertext-markup-language (HTML) pages located at a site.

5. The computerized system of claim 1, wherein the content on a site comprises a plurality of hypertext-markup-language (HTML) pages located at the site.

6. The computerized system of claim 1, wherein the content on a site comprises a plurality of hypertext-markup-language (HTML) located within at least one particular directory on the site.

7. The computerized system of claim 1, wherein each of the plurality of sites, the monitoring server, and the client are communicatively coupled to one another through the Internet.

8. The computerized system of claim 1, wherein each address by which content is referenced comprises a Universal Resource Locator (URL) address.

9. The computerized system of claim 1, wherein each address by which content is referenced comprises an Internet Protocol (IP) address.

10. The computerized system of claim 1, wherein the otherwise standard mechanism of the client comprises a socket services program and a TCP/IP handler program.

11. The computerized system of claim 1, wherein the otherwise standard mechanism of the client comprises an Open Transport program.

12. The computerized system of claim 1, wherein the otherwise standard mechanism of the client comprises a WinSock program.

14. The computer of claim 13, wherein the standard mechanism comprises a socket services program and a TCP/IP handler program.

15. The computer of claim 13, wherein the layer includes a cache of permissible content on at least one of the plurality of sites so that subsequent permission to programs running on the computer to access the permissible content can be given without repeated polling of the monitoring server.

16. The computer of claim 13, further comprising an Internet connection, such that the standard mechanism accesses the content on the plurality of sites through the Internet and the layer polls the monitoring server through the Internet.

17. The computer of claim 13, wherein each address by which content is referenced comprises a Universal Resource Locator (URL) address.

18. The computer of claim 13, wherein each address by which content is referenced comprises an Internet Protocol (IP) address.

19. The computer of claim 13, wherein the computer-readable medium comprises memory.

20. The computer of claim 13, wherein the computer-readable medium comprises a nonvolatile storage medium.

13. A computer comprising:

a processor;

a computer-readable medium;

a standard mechanism executed by the processor from the medium by which programs running on the computer access content on a plurality of sites, the sites hosted on one or more servers; and

,

an intervening control layer within the standard mechanism executed by the processor from the medium,

such that the layer polls a monitoring server, distinct from the one or more servers, to determine whether a program attempting to access content on one of the sites as referenced by an address should be permitted to do so.

21. A server comprising:

a processor;

a computer-readable medium; and

,

a computer program executed by the processor from the medium to receive polling from clients to determine whether a client program attempting to access content on one of a plurality of sites as referenced by an address should be permitted to do so, the sites hosted on one or more servers and distinct from the processor and computer program,

such that in response to the polling the computer program returns whether the client program is permitted to access the content on the one of the plurality of sites.

22. The server of claim 21, wherein the server maintains a database of permissible content on at least one of the plurality of sites, the permissible content reference by addresses.

23. The server of claim 21, wherein the server comprises an Internet web server, and a database server.

24. The server of claim 21, wherein the computer-readable medium comprises memory.

25. The server of claim 21, wherein the computer-readable medium comprises a nonvolatile storage medium.

30. The computerized system of claim 29, wherein the client maintains a local copy of the one or more rule, wherein the local copy is generated from the one or more rules on the monitoring server.

31. The computerized system of claim 29, wherein the one or more rules of the monitoring server includes a rule for access restriction to the content of one of the destination sites having hyper-linked pages.

32. The computerized system of claim 29, wherein the one or more rules of the monitoring server includes a rule for access restriction to the content of one of the destination sites having an incomplete portion of all hyper-linked pages.

33. The computerized system of claim 29, wherein the content of one of the destination sites includes a plurality of hyper-linked pages.

34. The computerized system of claim 29, wherein the content of one of the destination sites includes a plurality of hyper-linked pages located within at least one particular directory on the destination site.

35. The computerized system of claim 29, wherein each of the one or more destination sites, the monitoring server, and the client are communicatively coupled to one another through a network.

36. The computerized system of claim 29, wherein each address by which content is referenced on the one or more destination sites comprises a Universal Resource Locator (URL) address.

37. The computerized system of claim 29, wherein each address by which content is referenced on the one or more destination sites comprises an Internet Protocol (IP) address.

39. The system of claim 38, wherein the computer comprises:

a processor;

a random-access memory;

a read-only memory; and

one or more storage devices.

40. The system of claim 39, wherein the one or more storage devices are selected from a group consisting of a hard disk drive, a floppy disk drive, an optical disk drive, and a tape cartridge drive.

26. A computerized method comprising:

generating at a program running on a client a request to access content at a site as referenced by an address so, the site hosted on one or more servers;

receiving the request at a standard mechanism on the client by which programs running on the client access content on a plurality of sites;

intercepting the request by an intervening layer within the standard mechanism on the client;

determining at the intervening layer whether the content is present in a cache of content previously determined to be permissible;

upon failure to determine that the content is present in the cache,

polling by the layer of a monitoring server distinct from the one or more servers to determine whether the content is permissible;

determining at the monitoring server whether the content is present in a database of permissible content; and

,

permitting by the layer to the program running on the client to access the content upon determining that the content is permissible.

27. A computer-readable medium storing a computer program to cause a client computer having an intervening control layer within an otherwise standard mechanism by which programs running on the client access content on a plurality of sites to perform the computerized method comprising:

generating at one of the programs running on the client a request to access content at one of the sites as referenced by an address, the sites hosted on one or more server computers;

receiving the request at the standard mechanism;

intercepting the request by the intervening layer;

determining at the intervening layer whether the content is present in a cache of content previously determined to be permissible;

polling by the layer of a monitoring server distinct from the one or more servers to determine whether the content is permissible upon failure to determine that the content is present in the cache; and

,

permitting by the layer to the one of the programs running on the client to access the content upon determining that the content is permissible.

28. A computer-readable medium storing a computer program to cause a monitoring server to perform the computerized method comprising:

receiving polling from a client computer at a computer distinct from one or more servers hosting content on a plurality of sites to determine whether particular content on one of a plurality of sites as referenced by an address is permissible;

determining whether the particular content is present in a database of permissible content; and

,

indicating to the client computer whether the particular content is permissible,

wherein the client computer includes an intervening control layer within an otherwise standard mechanism by which programs running on the client access content on the plurality of sites.

29. A computerized system comprising:

a client that has access to one or more destination sites, the one or more destination sites being hosted on one or more servers and having content referenced by one or more addresses; and

a monitoring server distinct from the one or more servers, the monitoring server having one or more rules that govern access to the one or more destination sites,

wherein the monitoring server includes a software component operable on a computing platform for interpreting the one or more rules and determining if the client is restricted from accessing the one or more destination sites.

38. A system comprising:

a computer that has access to one or more destination sites, the one or more destination sites being hosted on one or more servers and having content referenced by one or more addresses; and

a monitoring server that is distinct from the one or more servers, the monitoring server having one or more rules that govern access to the one or more destination sites, and

wherein the computer is denied access to one of the destination sites if the one or more rules disallow such access.

41. A computerized system comprising:

one or more client computers operatively coupled to an Internet;

one or more content servers operatively coupled to the Internet; and

a monitoring server,

wherein the one or more content servers are referenced by one or more addresses, and

wherein the monitoring server determines whether one of the client computers has permission to access one of the one or more addresses of the one or more content servers based on a set of one or more permissible content rules.

42. The computerized system of claim 41, wherein one of the client computers includes a browser.

43. The computerized system of claim 41, wherein one of the client computers is operatively coupled to a display device, a pointing device, and a keyboard.

44. The computerized system of claim 41, wherein the one of the one or more addresses includes a subdirectory name.

46. The computerized method of claim 45, further comprising copying at least one of the one or more access rules from the monitoring server to the client computer.

47. The computerized method of claim 46, further comprising first determining if the at least one of the one or more access rules copied onto the client computer allow access to the content of one of the destination sites by the client computer.

45. A computerized method comprising:

creating one or more access rules on a monitoring server that relate to a controlling of access to a plurality of destination sites, the destination sites being hosted on one or more servers that are distinct from the monitoring server;

initiating a request on a client computer to access content on one of the destination sites, the content being referenced by one or more addresses; and

allowing access to the content of one of the destination sites by the client computer if the one or more access rules on the monitoring server do not restrict such access.

48. A computer-readable medium having a computer program stored thereon that controls access to a destination site by performing a computerized method comprising:

creating one or more rules on a monitoring server that govern access to the destination site, the destination site being hosted on one or ore servers that are distinct from the monitoring server;

receiving notification of a request by a computer to access content on the destination site, the content on the destination site being referenced by one or more addresses; and

restricting access to the content of the destination site according to the one or more rules.