Method, system and apparatus for monitoring and controlling internet site content access

• US 20030182420A1
• Filed: 05/20/2002
• Published: 09/25/2003
• Est. Priority Date: 05/21/2001
• Status: Abandoned Application

• Current Assignee: Telemate Holdings LLC
• Original Assignee: Telemate Holdings LLC
• Inventors: Spencer, Doug, Jones, Kent, Gaffner, Ian, Campbell, Rene
• Application Number:
  US10/152,247
• Publication Number:
  US 20030182420A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A disclosed system comprises user sites with monitor devices that report uncategorized content sites requested by users to a master site via an external network such as “the Internet.” The master site administers categorization of content sites, which is carried out by an unknown site reviewer. The master site transmits the resulting site categorization data to the monitor devices. The monitor devices use this data for subsequent user requests to determine categories of content sites requested by users. The monitor device further determines whether users are authorized to access content sites according usage policies established for the users sites.

Claims

16. A monitor device storing site access control data indicating at least one privilege of a user of a first network to access a category of content site via a second network, the monitor device further storing a site categorization library received from a master site via the second network, the site categorization library indicating a content category of at least one content site, the monitor device using the site access control data and site categorization library to determine whether a request generated by a user of a computing device coupled to the first network is authorized to access a content site via the second network, the monitor device permitting the request to proceed if the user is authorized to access the content site, and the monitor device preventing the user of the computing device from accessing the content site if the user is not authorized to access the content site, the monitor device storing uncategorized site data indicating content sites requested by users that have categories not determined by data stored by the monitor device, the monitor device transmitting the uncategorized site data to a master site for categorization.

17. A monitor device as claimed in claim 16 wherein the site categorization library is downloaded at periodic intervals from one millisecond to one year.

18. A monitor device as claimed in claim 16 wherein the monitor device uses a site categorization library listing site identification data in correspondence with site categorization data, and site access control data listing user identification data in correspondence with site categorization data so as to indicate whether a user is authorized to access a category of content site.

19. A monitor device as claimed in claim 18 wherein the monitor device determines that it does not have stored site categorization data indicating the category of the requested content site, the monitor device transmitting site data indicating the requested content site to a master site for categorization.

20. A monitor device as claimed in claim 18 wherein the monitor device determines that it does not have stored site categorization data indicating the category of the requested content site, the monitor device storing site data identifying the requested content site as uncategorized site data.

21. A monitor device as claimed in claim 20 wherein the monitor device transmits the uncategorized site data to the master site via the second network for categorization of the requested content site.

22. A monitor device as claimed in claim 21 wherein the monitor device transmits the uncategorized site data to the master site at determined time intervals.

23. A monitor device as claimed in claim 22 wherein the monitor device transmits the uncategorized site data to the master site at time intervals determined from one millisecond to one year.

24. A monitor device as claimed in claim 16 wherein the monitor device monitors network traffic from the computing device in the first network to determine whether a transmission from the computing device is a request for access to the content site.

25. A monitor device as claimed in claim 16 wherein the monitor device is coupled to the first network with a monitor device network connection (MDNC).

26. A monitor device as claimed in claim 25 wherein the MDNC comprises a switch.

27. A monitor device as claimed in claim 25 wherein the MDNC comprises a hub.

28. A monitor device as claimed in claim 16 wherein the first network is an intranetwork.

29. A monitor device as claimed in claim 16 wherein the second network is “

the Internet.”

32. A master site as claimed in claim 29 wherein the computer receives uncategorized site data from the monitor device via the network, the master site coupled to supply the uncategorized site data to an unknown site reviewer to determine the category of at least one content site identified by the uncategorized site data to produce site categorization data, the master site transmitting the site categorization data as determined by the unknown site reviewer, to the monitor device via the network for use by the monitor device to determine the category of the content site for a subsequent request from the user to access the content site.

33. A master site as claimed in claim 29 wherein the master site comprises the unknown site reviewer.

34. A master site as claimed in claim 32 wherein the unknown site reviewer comprises a neural network for determining the category of the content site identified by the unknown site reviewer.

35. A master site as claimed in claim 29 wherein the uncategorized site data comprises the universal resource locator (URL) and first directory if any of the network address of the content site, and the unknown site reviewer uses the URL and first directory if any to determine the category of the content site requested by the user.

36. A master site as claimed in claim 29 further comprising:

a data storage unit coupled to the computer, the data storage unit storing a master site categorization list having site categorization data for all content sites categorized by the unknown site reviewer.

37. A master site as claimed in claim 29 wherein the master site logs the date and time of receipt of site categorization data for the content site from the unknown site reviewer, and after expiration of a determined time from receipt of the site categorization data for the content site, the master site deletes the site categorization data for the content site from the master site categorization list and stores the site categorization data in a dropped site list.

38. A master site as claimed in claim 36 wherein the master site searches the dropped site list first for the category of the content site requested the user of a computing device before transmitting the known site data to the unknown site review for analysis.

30. A master site coupled to communicate with a plurality of user sites via a network, the master site comprising a computer coupled via the network to the user sites, the computer receiving uncategorized site data from the user sites and causing site categorization data to be generated for the user sites based thereon, the computer transmitting the site categorization data for the plurality of user sites to each user site for use in determining whether a user of a computing device at the user site is authorized to access a content site.

31. A master site as claimed in claim 30 wherein the computer transmits site categorization data to monitor devices of the user sites in a site categorization library file.

39. A system for use with at least one content site accessible via an external network, the system comprising:

a plurality of user sites each having a monitor device, a server, and at least one computing device coupled in communication via an internal network, the monitor device coupled to the internal network to monitor communications of the computing device to the server coupled to the external network to receive requests to access content sites via the external network, the monitor devices determining the categories of the requested content sites based on site categorization libraries stored at the user sites and determining whether the users are authorized to access the categories of requested content sites based on site access control data stored at the user sites, the monitor devices storing any site data identifying any content sites not found in the site categorization libraries as uncategorized site data; and

a master site having a computer and a data storage unit, the computer coupled to the external network to receive uncategorized site data from the servers of the user sites, the master site administering categorization of uncategorized site data to produce site categorization data stored in a master site categorization list in the data storage unit, the computer transmitting the master site categorization list containing site categorization data for requests generated at the plurality of user sites to each of the monitor devices via the external network for storage as the site categorization libraries for use in determining categories of content sites requested by users at the user sites.

1. A monitor device coupled to receive requests to access content sites on an external network by users of respective computing devices on an internal network, the monitor device determining the categories of the requested content sites associated with the requests and blocking access to the content sites based on the respective categories of the content sites that the users are not authorized to access, the monitor device storing uncategorized site data indicating content sites requested by users that have categories not determined by data stored by the monitor device, the monitor device transmitting the uncategorized site data to a master site for categorization.

6. A monitor device as claimed in claim 1 wherein the monitor device determines whether the users are authorized to access content sites using site access control data that defines the categories that the users are authorized to access.

7. A monitor device as claimed in claim 6 wherein the site access control data defines the categories of content sites each user is authorized to access.

8. A monitor device as claimed in claim 1 wherein the monitor device uploads the uncategorized site data at determined time intervals.

9. A monitor device as claimed in claim 1 wherein the monitor device uploads uncategorized site data at time intervals in a range from one millisecond to one year.

10. A monitor device as claimed in claim 1 wherein the monitor device accumulates uncategorized site data for transmission to the master site for categorization.

11. A monitor device as claimed in claim 1 wherein the master site transmits the uncategorized site data to an unknown site reviewer for categorization, the unknown site reviewer categorizing content sites indicated by the uncategorized site data to generate site categorization data, the unknown site reviewer supplying the uncategorized site data to the master site, the master site storing the site categorization data in a site categorization library supplied to the monitor device via the second network for use in categorizing subsequent requests by users for access to content sites.

12. A monitor device as claimed in claim 1 wherein the first network is an intranetwork.

13. A monitor device as claimed in claim 1 wherein the external network is “

the Internet.”

14. A method as claimed in claim 1 wherein the request is in the form of a packet.

15. A method as claimed in claim 1 wherein the requests are Internet protocol (IP) requests.

40. A system as claimed in claim 39 further comprising:

an unknown site reviewer coupled in communication with the computer via the master site, the unknown site reviewer receiving uncategorized site data from the master site and generating site categorization data based thereon, the unknown site reviewer transmitting the site categorization data to the server of the master site.

41. A system as claimed in claim 39 wherein the master site further comprises an unknown site reviewer coupled in communication with the computer of the master site, the unknown site reviewer receiving uncategorized site data from the computer of the master site and generating site categorization data based thereon, the unknown site reviewer transmitting the site categorization data to the computer of the master site for further transmission to the user site.

42. A system for supporting communications of users to content sites coupled to an external network, the system comprising:

a plurality of user sites coupled to the external network, the user sites having respective monitor devices for monitoring network communications of users of respective internal networks of the user sites for requests to access content sites via the external network, the monitor devices selectively granting authorization to the users to access the content sites based on categories of the content sites, the monitor devices transmitting uncategorized site data identifying uncategorized content sites via the external network; and

a master site coupled to the external network, the master site receiving the uncategorized site data, determining the categories of the content sites identified by the uncategorized site data to generate site categorization data, and transmitting the site categorization data to the user sites for use in determining whether users are authorized to access the content sites.

43. A system as claimed in claim 41 wherein the user sites transmit uncategorized site data at determined intervals in a range from one millisecond to one year.

44. A system as claimed in claim 41 wherein the master site transmits the site categorization data to the user sites for storage as site categorization libraries at determined time intervals.

45. A system as claimed in claim 41 wherein the site categorization libraries are transmitted to the user sites at intervals in a range from one millisecond to one year.

46. A system as claimed in claim 41 wherein the external network is an internetwork.

47. A system as claimed in claim 41 wherein the external network is “

the Internet.”

48. A system as claimed in claim 41 wherein the internal network is an intranetwork.

49. A method as claimed in claim 41 wherein the request is in the form of a packet.

50. A method as claimed in claim 41 wherein the requests are Internet protocol (IP) requests.

42-1. A system as claimed in claim 41 wherein the user sites transmit uncategorized site data at determined intervals.

51. A method comprising the steps of:

a) receiving network communications of users of respective internal networks of user sites for requests to access content sites via an external network;

b) determining if possible at the user sites categories of the requested content sites from site categorization data stored at the user sites;

if the categories of the requested content sites can be determined from the site categorization data at the user sites,

c) determining whether the users are authorized to access respective categories of requested content sites; and

d) blocking users from accessing the requested content sites if the determining of step (c) establishes that the users are not authorized to access respective categories of content sites; and

if the categories of the requested content sites cannot be determined at the user sites,

e) transmitting uncategorized site data identifying the requested content sites whose categories cannot be determined in step (b) from respective user sites to a master site for categorization.

2. A monitor device as claimed in claim 1 wherein the monitor device determines the categories of the content sites from a site categorization library downloaded from the master site via the external network.

52. A method as claimed in claim 51 further comprising the step of:

f) receiving updated site categorization data at the user sites based on the uncategorized content site data for use in subsequent performance of steps (a) and (b).

53. A method as claimed in claim 51 further comprising the step of:

f) categorizing the uncategorized site data to determine categories of the content sites identified by such data; and

g) transmitting the data identifying the content sites and their respective content categories to the users sites for use in subsequent repeated performance of at least steps (a) and (b).

54. A method as claimed in claim 51 wherein at least step (g) is repeatedly performed at time intervals at in a range from one to three days.

55. A method as claimed in claim 51 wherein the monitoring is performed by a monitor device.

56. A method as claimed in claim 51 wherein the replicating of step (b) is performed by a monitor device network connection (MDNC) operating in promiscuous mode.

57. A method as claimed in claim 51 wherein the replicating is performed by a switch.

58. A method as claimed in claim 51 wherein the replicating is performed by a hub.

59. A method as claimed in claim 51 wherein the determining of the step (c) is performed by a monitor device having the site categorization library stored in its memory.

60. A method as claimed in claim 51 wherein the site categorization library stores index data identifying at least one content site in association with site categorization indicating a category of the content accessible on the content site.

61. A method as claimed in claim 51 wherein the index data is derived from a universal resource locator (URL) and first level directory if any of the content site.

62. A method as claimed in claim 51 wherein the index data is in a form that is not in a language comprehensible to a user.

63. A method as claimed in claim 51 wherein the determining of step (d) is performed by the monitor device using site access control data stored therein.

64. A method as claimed in claim 51 wherein the site access control data lists user identification data identifying the user in correspondence with site categorization data indicating at least one category of content site, the correspondence of the user identification data to the site categorization data indicating at least one category of content site that the user is authorized to access.

65. A method as claimed in claim 51 wherein the site access control data is determined and set in the monitor device by an administrator of the user site using a computing device coupled to the first network.

66. A method as claimed in claim 51 further comprising the step of:

g) logging the request of the user in association with the category of content site sought to be accessed.

67. A method as claimed in claim 51 wherein the request is logged by storing user identification data identifying a user in association with site categorization data identifying the category of content site for which access is sought by the user.

68. A method as claimed in claim 67 wherein the request is logged with time and date data stored in association with the user identification data and site categorization data.

69. A method as claimed in claim 51 wherein step (e) is performed by a monitor device that transmits a message to the content site to stop the content site from providing access to the user.

70. A method as claimed in claim 51 wherein step (e) is performed by a monitor device that transmits a redirect message to a web browser of the user'"'"'s computing device that causes the user'"'"'s web browser to be directed to a web page advising the user that access to the site is not permitted under the network usage policy of the organization with which the respective internal network is associated.

71. A method as claimed in claim 51 wherein the request is in the form of a packet.

72. A method as claimed in claim 51 wherein the requests are Internet protocol (IP) requests.

73. A system as claimed in claim 51 wherein the external network is an internetwork.

74. A system as claimed in claim 51 wherein the external network is “

the Internet.”

75. A system as claimed in claim 51 wherein the internal network is an intranetwork.

53-2. A method as claimed in claim 51 wherein at least step (g) is repeatedly performed at time intervals in a range from one millisecond to one year.

76. A method comprising the steps of:

a) receiving requests to access content sites on an external network by users of respective computing devices on an internal network of a user site;

b) determining if possible at the user site categories for the requested content sites associated with the requests based on a site categorization library;

c) determining whether users are authorized to access the categories of content sites based on site access control data; and

d) preventing access to the content sites if the determining of steps (b) and (c) establish that the users are not authorized to access the content sites.

3. A monitor device as claimed in claim 2 wherein the monitor device downloads the site categorization library at determined time intervals.

4. A monitor device as claimed in claim 3 wherein the site categorization library is downloaded at time intervals in a range from one millisecond to one year.

77. A method as claimed in claim 76 wherein, if the categories of the requested content sites cannot be determined in steps (b) and (c) at the user site, the user site stores data identifying the uncategorized content sites as uncategorized site data, the method further comprising the step of:

e) transmitting uncategorized site data identifying the requested content sites whose categories cannot be determined in step (b) from respective user sites to a master site.

78. A method as claimed in claim 77 wherein at least step (e) is repeatedly performed at time intervals in a range from one millisecond to one year.

79. A method as claimed in claim 77 wherein the uncategorized site data is accumulated for transmission to the master site for categorization.

80. A method as claimed in claim 77 further comprising the steps of:

f) categorizing the uncategorized site data to determine categories of the content sites identified by such data; and

g) transmitting the data identifying the content sites and their respective content categories to the users sites for use in subsequent repeated performance of at least steps (a) and (b).

81. A method as claimed in claim 80 wherein at least step (g) is repeatedly performed at time intervals in a range from one millisecond to one year.

82. A method as claimed in claim 76 wherein the monitoring is performed by a monitor device.

83. A method as claimed in claim 76 wherein the replicating is performed by a hub.

84. A method as claimed in claim 76 wherein the determining of the step (c) is performed by a monitor device having the site categorization library stored in its memory.

85. A method as claimed in claim 76 wherein the site categorization library stores index data identifying at least one content site in association with site categorization indicating a category of the content accessible on the content site.

86. A method as claimed in claim 85 wherein the index data is derived from a universal resource locator (URL) and first level directory if any of the content site.

87. A method as claimed in claim 85 wherein the index data is in a form that is not in a language comprehensible to a user.

88. A method as claimed in claim 76 wherein the determining of step (d) is performed by the monitor device using site access control data stored therein.

89. A method as claimed in claim 76 wherein the site access control data lists user identification data identifying the user in correspondence with site categorization data indicating at least one category of content site, the correspondence of the user identification data to the site categorization data indicating at least one category of content site that the user is authorized to access.

90. A method as claimed in claim 76 wherein the site access control data is determined and set in the monitor device by an administrator of the user site using a computing device coupled to the first network.

91. A method as claimed in claim 76 further comprising the step of:

g) logging the request of the user in association with the category of content site sought to be accessed.

92. A method as claimed in claim 91 wherein the request is logged by storing user identification data identifying a user in association with site categorization data identifying the category of content site for which access is sought by the user.

93. A method as claimed in claim 91 wherein the request is logged with time and date data stored in association with the user identification data and site categorization data.

94. A method as claimed in claim 91 wherein step (e) is performed by a monitor device that transmits a message to the content site to stop the connection to the content site to prevent the content site from providing access to the user.

95. A method as claimed in claim 94 wherein step (e) is performed by a monitor device that transmits a redirect message to the web browser of a user'"'"'s computing device to cause the web browser to be directed to a web page that displays a message indicating that access to the requested content site is denied due to the network usage policy of an organization associated with the internal network.

96. A method as claimed in claim 76 wherein the requests are in the form of a packet.

97. A method as claimed in claim 76 wherein the requests are Internet protocol (IP) requests.

98. A method as claimed in claim 76 wherein the external network is an internetwork.

99. A method as claimed in claim 76 wherein the external network is “

the Internet.”

100. A method as claimed in claim 76 wherein the internal network is an intranetwork.

81-3. A method as claimed in claim 76 wherein the replicating of step (b) is performed by a monitor device network connection (MDNC) operating in promiscuous mode.

82-4. A method as claimed in claim 76 wherein the replicating is performed by a switch.

101. A medium having software executable by a monitor device to perform the following functions:

a) receiving requests to access content sites on an external network by users of respective computing devices on an internal network of a user site;

b) determining if possible at the user site categories for the requested content sites associated with the requests based on a site categorization library;

c) determining whether users are authorized to access the categories of content sites based on site access control data; and

d) preventing access to the content sites if the determining steps (b) and (c) establish that the users are not authorized to access the content sites.

5. A monitor device as claimed in claim 1 wherein the monitor device logs requests of the users of the computing devices in association with the categories of the requested content sites.

102. A medium as claimed in claim 101 wherein, if the categories of the requested content sites cannot be determined in steps (b) and (c) at the user site, the software stores data identifying the uncategorized content sites as uncategorized site data, the software further executable by the monitor device to perform the following function:

e) transmitting uncategorized site data identifying the requested content sites whose categories cannot be determined in step (b) from the user site to a master site for categorization.

103. A medium as claimed in claim 102 wherein the software is further executable by the monitor device to perform at least step (e) repeatedly at time intervals in a range from one millisecond to one year.

104. A medium as claimed in claim 103 wherein the software is further executable by the monitor device so that the time interval is selectable by an administrator using the software.

105. A medium as claimed in claim 102 wherein the monitor device accumulates uncategorized site data for transmission to the master site for categorization.

106. A medium as claimed in claim 105 wherein the software is further executable by the monitor device so that at least step (f) is repeatedly performed at time intervals in a range from one millisecond to one year.

107. A medium as claimed in claim 101 wherein the determining of the step (b) is performed by a monitor device having the site categorization library stored in its memory.

108. A medium as claimed in claim 101 wherein the site categorization library stores index data identifying at least one content site in association with site categorization indicating a category of the content accessible on the content site.

109. A medium as claimed in claim 108 wherein the index data is derived from a universal resource locator (URL) and first level directory if any of the content site.

110. A medium as claimed in claim 108 wherein the index data is in a form that is not in a language comprehensible to a human user.

112. A medium as claimed in claim 101 wherein the determining of step (d) is performed by the monitor device using site access control data stored therein.

113. A medium as claimed in claim 112 wherein the site access control data lists user identification data in correspondence with site categorization data to indicate categories of content sites the users are authorized to access.

114. A medium as claimed in claim 112 wherein the site access control data is determined and set in the monitor device by an administrator of the user site using a computing device coupled to the first network.

115. A medium as claimed in claim 101 wherein the software is further executable by the monitor device to perform the following function:

e) logging the request of the user in association with the category of content site sought to be accessed.

116. A medium as claimed in claim 115 wherein the request is logged by storing user identification data identifying a user in association with site categorization data identifying the category of content site for which access is sought by the user.

117. A medium as claimed in claim 115 wherein the request is logged with time and date data stored in association with the user identification data and site categorization data.

118. A medium as claimed in claim 115 wherein step (e) is performed by the monitor device executing the software to transmit an abort message to the content site to prevent the content site from providing access to the user.

119. A medium as claimed in claim 115 wherein step (e) is performed by the monitor device executing the software to transmit a redirect message to a web browser of a user'"'"'s computing device to direct the web browser to a page indicating access to the requested content site is denied under the network usage policy of an organization associated with the user site.

120. A medium as claimed in claim 101 wherein the requests are in the form of packets.

121. A medium as claimed in claim 101 wherein the requests are Internet protocol (IP) requests.

122. A medium as claimed in claim 101 wherein the external network is an internetwork.

123. A medium as claimed in claim 101 wherein the external network is “

the Internet.”

124. A medium as claimed in claim 101 wherein the internal network is an intranetwork.

105-5. A medium as claimed in claim 102 wherein the software is further executable by the monitor device to perform the following function:

f) receiving site categorization data categorizing the content sites requested by users.

125. An adaptive monitoring system coupled to an external network, the system comprising a plurality of monitor devices for respective internal networks of user sites, the monitor devices selectively blocking access of users to content sites accessible via the external network based on data indicating categories of the content sites requested by users of the internal networks, the monitor devices transmitting data for uncategorized content sites requested by users at the user sites to a master site via the external network for categorization, the master site returning updated data indicating categories of the content sites for requests to access content sites received from the plurality of user sites to each user site'"'"'s monitor device for subsequent use in determining whether users of the internal networks are authorized to access the content sites.

126. An adaptive monitoring system as claimed in claim 125 wherein the monitor devices selectively block access of users to content sites further based on data indicating the users'"'"' privileges to access respective categories of content sites.

127. A monitor device for monitoring requests on an internal network to access content sites via an external network, the monitor device using site categorization data to selectively block access to requested sites based on the content category of the requested sites, the monitor device transmitting uncategorized site data identifying the requests sites over the external network to a master site for categorization.

128. A method comprising the steps of:

a) selectively blocking requests from at least one user of an internal network to access at least one content site via an external network using site categorization data; and

b) transmitting uncategorized site data indicating at least one content site requested by the user not having site categorization data to a master site for categorization.

129. A computer receiving uncategorized site data generated by a plurality of user sites via an external network, the computer causing to be generated site categorization data for the plurality of user sites, the computer transmitting the site categorization data for the plurality of user sites to each user site for use in selectively blocking users'"'"' access to content sites based on the site categorization data.

130. A method comprising the steps of:

a) receiving uncategorized site data generated by a plurality of user sites;

b) causing site categorization data to be generated for the plurality of user sites; and

c) transmitting the site categorization data for the plurality of user sites to each user site for use in selectively blocking users'"'"' access to content sites based on the site categorization data.