System, method and apparatus for use in monitoring or controlling internet access

• US 20060053488A1
• Filed: 09/28/2004
• Published: 03/09/2006
• Est. Priority Date: 09/09/2004
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Websense UK Ltd. (Forcepoint LLC)
• Inventors: Sinclair, John W., Nash, Alistair H., Pettener, Ian James
• Granted Patent: US 8,141,147 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

An apparatus, method and system for use in categorising Uniform Resource Locators (URLs) when controlling or monitoring access to the Internet 20 from a client 12. A request message 500 is generated to request categorisation of a specified URL. The request message 500 comprises a licensing field carrying a licence key. A remote server 40 receives the licence key and, if valid, generates a reply message 600 denoting a category of the specified URL. The licence key enables workload at the server 40 to be managed efficiently.

Claims

1. A method for use in controlling or monitoring of Internet access by categorising Uniform Resource Locators (URLs), comprising the steps of:

generating a request message to request categorisation of a specified URL, wherein the request message comprises a licensing field carrying a licence key; and

validating the license key and, if valid, generating a reply message denoting a category of the specified URL amongst a predetermined set of categories.

2. The method of claim 1, for use in a system comprising a client device and a categorisation server, and the method comprises:

generating the request message at the client device; and

validating the license key at the categorisation server.

3. The method of claim 2, wherein the license key is associated with the client device.

4. The method of claim 3, comprising calling a licence module including passing the licensing code to the licence module for validation.

5. The method of claim 4, comprising the steps of:

storing one or more licence codes in a licence cache, where the stored licence codes have been validated previously; and

validating a received licence code by matching with a stored licence code in the licence cache, or else calling the licence module.

6. The method of claim 5, further comprising the step of adding a validated licence code to the licence cache, when validity has been determined by the licence module.

7. The method of claim 5, wherein the licensing cache comprises:

a hash array comprising one or more index elements, each index element comprising a licence tree pointer and a hash key derived from a stored licence code; and

one or more licence trees comprising one or more tree nodes each holding licence data representing stored licence codes and an associated validity status.

8. The method of claim 7, wherein the licensing cache further comprises:

an age list to list each of the tree nodes by age, wherein the age list comprises, within each tree node, a next pointer and a previous pointer which refer to a next older tree node and a previous newer tree node, respectively.

9. The method of claim 8, comprising managing the license cache to reside within a predetermined size by deleting older tree nodes from a tail of the age list by referring to the next and previous pointers, and adding new tree nodes to the head of the age list.

10. The method of claim 9, comprising updating the age list to keep recently accessed tree nodes at the head of the age list.

11. The method of claim 10, comprising periodically flushing the license cache.

12. The method of claim 5, wherein the licence module is a dynamic linked library (DLL).

13. The method of claim 3, wherein the licensing field comprises a partner ID field to identify a licensing scheme and a client ID field carrying a client licence code to validate the client device according to the identified licensing scheme.

14. The method of claim 13, comprising selecting a partner licence module amongst one or more partner licence modules according to the partner ID field, and passing the licensing code to the selected partner licence module for validation.

15. The method of claim 2, wherein the client device and the categorisation server communicate over the Internet, and the method comprises transmitting the request message over the Internet and transmitting the reply message over the Internet.

16. The method of claim 15, wherein the client device comprises a user machine to provide a human-oriented user interface, and a client internet gateway appliance to couple the user machine to the Internet through an Internet Service Provider (ISP), and the method comprises:

initiating the URL request in the user machine to request a web page from the specified URL; and

servicing the URL request at the client internet gateway appliance, including requesting the web page from a host according to the specified URL.

17. The method of claim 16, wherein the user machine and the client internet gateway appliance are formed within a single integrated device.

18. The method of claim 16, wherein the user machine and the client internet gateway appliance are separate devices arranged to communicate over a local network.

19. The method of claim 2, wherein the client device and the categorisation sever are arranged to communicate over a local area network.

38. A program storage medium having computer executable instructions stored thereon for performing the method of claim 1.

20. A method for use at a categorisation server to assist in controlling or monitoring of Internet access at a client device by categorising Uniform Resource Locators (URLs), comprising the steps of:

receiving a request message to request categorisation of a specified URL, wherein the request message comprises a licensing field carrying a licence key; and

validating the license key and, if valid, generating a reply message denoting a category of the specified URL amongst a predetermined set of categories.

21. The method of claim 20, comprising

storing one or more licence codes in a licence cache, where the stored licence codes have been validated previously;

and

validating a received licence code by matching with a stored licence code in the licence cache, or else calling a licence validation function.

22. The method of claim 20, wherein the licensing field comprises a partner ID field to identify a licensing scheme and a client ID field carrying a client licence key, and wherein the method comprises:

selecting a partner licence module amongst one or more partner licence modules according to the partner ID field, and passing the client license key to the selected partner licence module for validation.

23. The method of claim 20, comprising passing the licence key to a licensing module which performs validation and returns a “

licence valid”

or “

licence invalid”

status which controls whether or not the categorisation server will respond to the request message.

39. A program storage medium having computer executable instructions stored thereon for performing the method of claim 20.

24. A system for use in controlling or monitoring of Internet access by categorising Uniform Resource Locators (URLs), comprising:

a client device arranged to monitor or control Internet access according to a category code of a specified URL and arranged to generate a request message to request categorisation of the specified URL, wherein the request message includes a licensing field; and

a categorisation server arranged to communicate with the client device and arranged to validate the license key and, if valid, generate a reply message denoting a category of the specified URL amongst a predetermined set of categories.

25. The system of claim 24, wherein the categorisation server further comprises:

a licensing module which performs validation and returns a licence status which controls whether or not the categorisation server will respond to the request message.

26. The system of claim 25, wherein the categorisation server further comprises:

a licence cache to store one or more licence codes which have been validated previously.

27. The system of claim 26, wherein the categorisation server further comprises:

a licence interface module to identify a licensing scheme according to a partner ID field of the licensing field; and

one or more partner licence modules selectable according to the partner ID field to validate the licence key.

28. The system of claim 24, wherein the request message and the reply message are each carried as the payload of a User Datagram Protocol packet.

29. A categorisation server, comprising:

a first module arranged to receive a request message denoting a specified URL and to provide a corresponding category code in return, wherein the request message further comprises a licence key; and

a licence module arranged to validate the licence key and thereby control whether or not the first module provides the category code.

30. The categorisation server of claim 29, wherein the licence module comprises a licence cache to store one or more licence codes which have been validated recently.

31. The categorisation server of claim 29, wherein the licence module comprises:

a partner licence module arranged to validate a licence key and provide a validation result; and

a license interface module arranged to pass the licence key to the partner licence module and receive the validation result.

32. The categorisation server of claim 29, wherein the licence key comprises a partner ID field and a client licence code, and the licence module comprises:

one or more partner licence DLLs each arranged to validate the licence key and provide a validation result; and

a license interface DLL arranged to pass the licence key to a selected one amongst the partner licence DLLs according to the partner ID field and receive the validation result.

33. The categorisation server of claim 32, wherein the license interface DLL resolves the partner ID field by referring to a partner map database, which links the partner ID to a partner licence DLL name.

34. The categorisation server of claim 33, wherein the one or mode partner licence DLLs include any one or more of:

a no license DLL which indicates that any licence key is valid;

a no database DLL which performs a mathematical, algorithmic or cryptographic validation of the licence key;

a hosted licensing DLL which forwards licensing requests to a remote licensing server for validation; and

/or

a database licensing DLL which connects directly into an ODBC database using a stored procedure to validate the licence key.

35. The categorisation server of claim 29, comprising:

a main module arranged to determine a category of a specified URL amongst a set of predetermined categories by comparing the specified URL against stored URLs in a categorisation database;

an encryption unit arranged to encrypt and decrypt data;

a protocol module arranged to unmarshal incoming data into a comprehensible command format and marshal outgoing data into a transmittable format, and make encryption/decryption calls to the encryption unit; and

a communication module arranged to receive and buffer incoming and outgoing data and respond to an incoming categorisation request message including generation of an corresponding outgoing reply message;

wherein the licensing module is arranged to validate a license key provided in the incoming request message and inform the communication module of a validation result.

36. A licensing cache structure for use in controlling or monitoring of Internet access by categorising Uniform Resource Locators (URLs), comprising:

a hash array comprising one or more index elements, each index element comprising a licence tree pointer and a hash key derived from a stored licence code; and

one or more licence trees comprising one or more tree nodes each holding licence data representing stored licence codes and an associated validity status.

37. The licensing cache structure of claim 36, further comprising:

an age list to list each of the tree nodes by age, wherein the age list comprises, within each tree node, a next pointer and a previous pointer which refer to a next older tree node and a previous newer tree node, respectively.