Web-based security and filtering system for inbound/outbound communications with proxy chaining

• US 20090300196A1
• Filed: 07/29/2009
• Published: 12/03/2009
• Est. Priority Date: 09/14/2000
• Status: Active Grant

• Current Assignee: Joshua Haghpassand
• Original Assignee: Kirsten Aldrich
• Inventors: Haghpassand, Joshua
• Granted Patent: US 9,037,738 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/566 Grouping or aggregating service requests, e.g. for unified processing
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A customizable system for filtering web-based HTTP requests for outbound and inbound access to web sites. An administrative module in a user computer configures a range of access levels for inbound and outbound communications and has list maintenance functions. Users attempting to access an unfriendly site are anonymously forwarded to a friendly site or the request is terminated. A first proxy server in each user computer of a LAN has access to the WWW, has a customizable friendly and unfriendly outbound list, one of which is active and a customizable friendly and unfriendly inbound list, one of which is active. A second HTTP proxy server without an administrative module or friendly or unfriendly lists is between the first proxy server and the Internet as a LAN gateway or at an ISP domain, the second proxy being capable of communicating to a proxy of a destination or directly to a destination.

Claims

1. A versatile customizable combination system for providing filtering of outbound requests for access to web sites on the Internet and/or for controlling inbound requests from the Internet for access to a web site of the system, comprising:

a plurality of computer users,

one or a plurality of user computers, each having a dynamically allocated Internet protocol address or a static Internet Protocol address,

an administrative module/interface that includes configuration settings for inbound communications and for outbound communications, has list maintenance functions,

said administrative module located in a user computer for configuring a range of access levels and being capable of creating multiple types of user accounts that require unique authentication credentials for each user account including an administrator account that has the full power to configure,

a first proxy server in one or a plurality of user computers of a local area network with access to the world wide web, each of said first proxy server having a friendly outbound list and/or an unfriendly outbound list only one of which is active at any given time, and/or having a friendly inbound list and/or an unfriendly inbound list only one of which is active at any given time, the friendly outbound list, the unfriendly outbound list, the friendly inbound list and the unfriendly inbound lists being uniquely configurable for each user account, each user computer in the plurality of user computers can be configured to use the first proxy server,

said first proxy server programmed to receive a request from an HTTP client, check the identity of a requesting client and/or of a requested URL against the friendly inbound, friendly outbound, unfriendly inbound or unfriendly outbound list maintained by the administrative module and then either approve the request, terminate the request or re-route the request,

a second proxy server, without the administrative module and without the friendly or the unfriendly lists, placed between the first proxy server and the Internet, the second proxy server being capable of communicating to a proxy of a destination or directly to a destination, said second proxy server having an Internet Protocol address configurable only by a holder of the administrator account or a regular account with administrative privileges,

the first proxy server programmed to forward the request to the second proxy server if and when said first proxy server approves the request,

the first proxy server and the second proxy server have a network communication link between them.

2. The system of claim 1, wherein the first proxy server is programmed to check the identity of a user who logs into the first proxy server and who presents a unique authentication credential prior to checking the identity of the requesting client and/or requested URL against the list or lists.

3. The system of claim 2, wherein the first proxy server is programmed, upon a successful authentication of the user'"'"'s credential, to use a configuration of the user'"'"'s account to check the identity of the requesting client and/or requested URL against the list or lists.

4. The system of claim 2, wherein the first proxy server is programmed that if the first proxy server fails to authenticate the user, the first proxy server offers the user an opportunity to login again, denies the request and/or re-routes the user request to replacement resources.

5. The system of claim 1, wherein the list maintenance functions include list editing, list deleting, searching of lists, saving of lists, adding and deleting users, interchanging lists and importing and exporting lists and wherein the three types of user accounts include regular accounts with administrative privileges other than the privilege to create additional accounts or view information on any other accounts and regular accounts without administrative privileges.

6. A versatile customizable combination system for providing filtering of outbound requests for access to web sites on the Internet and/or for controlling inbound requests from the Internet for access to a web site of the system, comprising:

a plurality of computer users,

one or a plurality of user computers, each having a dynamically allocated Internet protocol address or a static Internet Protocol address,

an administrative module/interface that includes configuration settings for inbound communications and for outbound communications and has list maintenance functions,

said administrative module located in a user computer for configuring a range of access levels and being capable of creating multiple types of user accounts that require unique authentication credentials for each user account including an administrator account that has the full power to configure,

a first proxy server in one or a plurality of user computers of a local area network with access to the world wide web, each of said first proxy server having a friendly outbound list and/or an unfriendly outbound list only one of which is active at any given time, and/or having a friendly inbound list and/or an unfriendly inbound list only one of which is active at any given time, the friendly outbound list, the unfriendly outbound list, the friendly inbound list and the unfriendly inbound list being uniquely configurable for by each user account, each user computer in the plurality of user computers can be configured to use the first proxy server,

said first proxy server programmed to receive a request from an HTTP client, check the identity of a requesting client and/or of a requested URL against the friendly inbound, friendly outbound, unfriendly inbound or unfriendly outbound list maintained by the administrative module and then either approve the request, terminate the request or re-route the request,

a second proxy server, without the administrative module and without the friendly or the unfriendly lists, placed between the first proxy server and a resource, the second proxy server being capable of communicating to a proxy of a destination or directly to a destination, said second proxy server having an Internet Protocol address configurable only by a holder of the administrator account or a regular account with administrative privileges,

the first proxy server programmed to forward the request to the second proxy server if and when said first proxy server approves the request,

the first proxy server and the second proxy server have a communication link between them.

7. The system of claim 6, wherein the first proxy server is programmed to check the identity of a user who logs into the first proxy server and who presents a unique authentication credential prior to checking the identity of the requesting client and/or requested URL against the list or lists.

8. The system of claim 7, wherein the first proxy server is programmed, upon a successful authentication of the user'"'"'s credential, to use a configuration of the user'"'"'s account to check the identity of the requesting client and/or requested URL against the list or lists.

9. The system of claim 7, wherein the first proxy server is programmed that if the first proxy server fails to authenticate the user, the first proxy server offers the user an opportunity to login again, denies the request and/or re-routes the user request to replacement resources.

10. The system of claim 6, wherein the list maintenance functions include list editing, list deleting, searching of lists, saving of lists, adding and deleting users, interchanging lists and importing and exporting lists and wherein the three types of user accounts include regular accounts with administrative privileges other than the privilege to create additional accounts or view information on any other accounts and regular accounts without administrative privileges.

11. A versatile customizable combination system for providing filtering of outbound requests for access to web sites on the Internet and/or for controlling inbound requests from the Internet for access to a web site of the system, comprising:

a plurality of computer users,

one or a plurality of user computers, each having a dynamically allocated Internet protocol address or a static Internet Protocol address,

an administrative module/interface that includes configuration settings for inbound communications and for outbound communications and has list maintenance functions,

said administrative module located in a user computer for configuring a range of access levels and being capable of creating multiple types of user accounts that require unique authentication credentials for each user account including an administrator account that is self-configuring,

a first proxy server in one or a plurality of user computers of a local area network with access to the world wide web, each of said first proxy server having a friendly outbound list and/or an unfriendly outbound list only one of which is active at any given time, and/or having a friendly inbound list and/or an unfriendly inbound list only one of which is active at any given time, the friendly outbound list, the unfriendly outbound list, the friendly inbound list and the unfriendly inbound list being uniquely configurable for each user account, and

said first proxy server programmed to receive a request from an HTTP client, check the identity of a requesting client and/or of a requested URL against the friendly inbound, friendly outbound, unfriendly inbound or unfriendly outbound list maintained by the administrative module and then either approve the request, terminate the request or re-route the request.

12. The system of claim 11, wherein the range of access levels ranges from allowing all access to allowing no access at all.

13. The system of claim 11, wherein said first proxy server is also programmed to register the request in a logfile of all URLs requested by a user.

14. The system of claim 11, wherein a first proxy server is in each and every user computer.

15. The system of claim 14, wherein the range of access levels ranges from allowing all access to allowing no access at all.

16. The system of claim 11, wherein the system is compatible with dialup modem connection to the Internet, the system is compatible with a local area network and the system is compatible with virtual network connection.

17. The system of claim 16, wherein the range of access levels ranges from allowing all access to allowing no access at all.

18. The system of claim 11, said administrative module being capable of also creating a fourth type of user account namely one anonymous guest user account to be used by general users without authentication credentials.

19. The system of claim 18, wherein inbound communications are arranged so that an actual location of an important resource is located in an unpublished location that is a replacement location to which requests rejected by the first proxy server are rerouted, wherein clients of approved users are listed in the first proxy server in the unfriendly inbound list and are sent by the first proxy server to the replacement location, and wherein clients of unapproved users are not listed in the unfriendly inbound list and have their request sent to a published address that contains unimportant information

20. The system of claim 19, wherein the first proxy server is programmed to check the identity of a user who logs into the first proxy server and who presents a unique authentication credential prior to checking the identity of the requesting client and/or requested URL against the list or lists.

21. The system of claim 20, wherein the first proxy server is programmed, upon a successful authentication of the user'"'"'s credential, to use a configuration of the user'"'"'s account to check the identity of the requesting client and/or requested URL against the list or lists.

22. The system of claim 20, wherein the first proxy server is programmed that if said first proxy server fails to authenticate the user, the first proxy server offers that user an opportunity to log in as an anonymous guest user.

23. The system of claim 20, wherein said first proxy server is also programmed to register the request in a logfile of all URLs requested by a user.

24. The system of claim 18, wherein inbound communications are arranged so that an actual location of an important resource is located in an unpublished location that is a replacement location to which requests rejected by the first proxy server are rerouted, wherein clients of approved users are not listed in the first proxy server in the friendly inbound list and are sent by the first proxy server to the replacement location, and wherein clients of unapproved users are listed in the friendly inbound list and have their request sent to a published address that contains unimportant information.

25. The system of claim 24, wherein the first proxy server is programmed to check the identity of a user who logs into the first proxy server and who presents a unique authentication credential prior to checking the identity of the requesting client and/or requested URL against the list or lists.

26. The system of claim 25, wherein the first proxy server is programmed, upon a successful authentication of the user'"'"'s credential, to use a configuration of the user'"'"'s account to check the identity of the requesting client and/or requested URL against the list or lists.

27. The system of claim 25, wherein the first proxy server is programmed that if said first proxy server fails to authenticate the user, the first proxy server offers that user an opportunity to log in as an anonymous guest user.

28. The system of claim 25, wherein said first proxy server is also programmed to register the request in a logfile of all URLs requested by a user.

29. The system of claim 11, wherein the first proxy server is programmed to check the identity of a user who logs into the first proxy server and who presents a unique authentication credential prior to checking the identity of the requesting client and/or requested URL against the list or lists.

30. The system of claim 29, wherein the first proxy server is programmed, upon a successful authentication of the user'"'"'s credential, to use a configuration of the user'"'"'s account to check the identity of the requesting client and/or requested URL against the list or lists.

31. The system of claim 29, wherein the first proxy server is programmed that if the first proxy server fails to authenticate the user, the first proxy server offers the user an opportunity to login again, denies the request and/or re-routes the user request to replacement resources.

32. The system of claim 29, wherein said first proxy server is also programmed to register the request in a logfile of all URLs requested by a user.

33. The system of claim 24, wherein the range of access levels ranges from allowing all access to allowing no access at all.

34. The system of claim 24, wherein the system is compatible with dialup modem connection to the Internet, the system is compatible with a local area network and the system is compatible with virtual network connection.

35. The system of claim 34, wherein the range of access levels ranges from allowing all access to allowing no access at all.

36. The system of claim 18, wherein the first proxy server is programmed to check the identity of a user who logs into the first proxy server and who presents a unique authentication credential prior to checking the identity of the requesting client and/or requested URL against the list or lists.

37. The system of claim 36, wherein said first proxy server is also programmed to register the request in a logfile of all URLs requested by a user.

38. The system of claim 36, wherein the first proxy server is programmed, upon a successful authentication of the user'"'"'s credential, to use a configuration of the user'"'"'s account to check the identity of the requesting client and/or requested URL against the list or lists.

39. The system of claim 36, wherein the first proxy server is programmed that if said first proxy server fails to authenticate the user, the first proxy server offers that user an opportunity to log in as an anonymous guest user.

40. The system of claim 11, wherein the list maintenance functions include list editing, list deleting, searching of lists, saving of lists, adding and deleting users, interchanging lists and importing and exporting lists and wherein the three types of user accounts include regular accounts with administrative privileges other than the privilege to create additional accounts or view information on any other accounts and regular accounts without administrative privileges.

41. The system of claim 11, wherein one or additional proxy servers are situated between the first proxy server and a resource.

42. A versatile customizable combination system for providing filtering of outbound requests for access to web sites on the Internet, comprising:

a plurality of computer users,

one or a plurality of user computers, each having a dynamically allocated Internet protocol address or a static Internet Protocol address,

an administrative module/interface that includes configuration settings for outbound communications and has list maintenance functions,

said administrative module located in a user computer for configuring a range of access levels and being capable of creating multiple types of user accounts that require unique authentication credentials for each user account including an administrator account that is self-configuring,

a first proxy server in one or a plurality of user computers of a local area network with access to the world wide web, each of said first proxy server having a friendly outbound list and/or an unfriendly outbound list only one of which is active at any given time, the friendly outbound list and the unfriendly outbound list being uniquely configurable for each user account, and

said first proxy server programmed to receive a request from an HTTP client, check the identity of a requested URL against the friendly outbound or unfriendly outbound list maintained by the administrative module and then either approve the request, terminate the request or re-route the request without the knowledge of the user.

43. The system of claim 42, said administrative module being capable of also creating a fourth type of user account namely one anonymous guest user account to be used by general users without authentication credentials.

44. The system of claim 43, wherein the first proxy server is programmed to check the identity of a user who logs into the first proxy server and who presents a unique authentication credential prior to checking the identity of the requesting client and/or requested URL against the list or lists.

45. The system of claim 44, wherein said first proxy server is also programmed to register the request in a logfile of all URLs requested by a user.

46. The system of claim 44, wherein the first proxy server is programmed, upon a successful authentication of the user'"'"'s credential, to use a configuration of the user'"'"'s account to check the identity of the requesting client and/or requested URL against the list or lists.

47. The system of claim 44, wherein the first proxy server is programmed that if said first proxy server fails to authenticate the user, the first proxy server offers that user an opportunity to log in as an anonymous guest user.

48. The system of claim 42, wherein the range of access levels ranges from allowing all access to allowing no access at all.

49. The system of claim 42, wherein the system is compatible with dialup modem connection to the Internet, the system is compatible with a local area network and the system is compatible with virtual network connection.

50. The system of claim 49, wherein the range of access levels ranges from allowing all access to allowing no access at all.

51. The system of claim 42, wherein said first proxy server is also programmed to register the request in a logfile of all URLs requested by a user.

52. The system of claim 42, wherein the first proxy server is programmed to check the identity of a user who logs into the first proxy server and who presents a unique authentication credential prior to checking the identity of the requesting client and/or requested URL against the list or lists.

53. The system of claim 52, wherein the first proxy server is programmed, upon a successful authentication of the user'"'"'s credential, to use a configuration of the user'"'"'s account to check the identity of the requesting client and/or requested URL against the list or lists.

54. The system of claim 52, wherein the first proxy server is programmed that if the first proxy server fails to authenticate the user, the first proxy server offers the user an opportunity to login again, denies the request and/or re-routes the user request to replacement resources.

55. The system of claim 42, wherein the list maintenance functions include list editing, list deleting, searching of lists, saving of lists, adding and deleting users, interchanging lists and importing and exporting lists and wherein the three types of user accounts include regular accounts with administrative privileges other than the privilege to create additional accounts or view information on any other accounts and regular accounts without administrative privileges.

56. The system of claim 42, wherein one or additional proxy servers are situated between the first proxy server and a resource.

57. A versatile customizable combination system for providing filtering of outbound requests for access to web sites on the Internet, comprising:

a plurality of computer users,

one or a plurality of user computers, each having a dynamically allocated Internet protocol address or a static Internet Protocol address,

an administrative module/interface that includes configuration settings for outbound communications and has list maintenance functions,

said administrative module located in a user computer for configuring a range of access levels and being capable of creating multiple types of user accounts that require unique authentication credentials for each user account including an administrator account that is self-configuring,

a first proxy server in one or a plurality of user computers of a local area network with access to the world wide web, each of said first proxy server having a friendly outbound list and/or an unfriendly outbound list only one of which is active at any given time, the friendly outbound list and the unfriendly outbound list being uniquely configurable for each user account, and

said first proxy server programmed to receive a request from an HTTP client, check the identity of a requested URL against the friendly outbound or unfriendly outbound list maintained by the administrative module and then either approve the request, terminate the request or re-route the request without the knowledge of the user,

a second proxy server without the administrative module or the friendly or the unfriendly lists placed between the first proxy server and either (i) the Internet or (ii) a resource, the second proxy server being capable of communicating to a proxy of a destination or directly to a destination, said second proxy server having an Internet Protocol address configurable only by a holder of the administrator account or a regular account with administrative privileges,

the first proxy server programmed to forward the request to the second proxy server if and when said first proxy server approves the request,

the first proxy server and the second proxy server have a network communication link between them.

58. The system of claim 57, said administrative module being capable of also creating a fourth type of user account namely one anonymous guest user account to be used by general users without authentication credentials.

59. The system of claim 58, wherein the first proxy server is programmed to check the identity of a user who logs into the first proxy server and who presents a unique authentication credential prior to checking the identity of the requesting client and/or requested URL against the list or lists.

60. The system of claim 59, wherein the first proxy server is programmed, upon a successful authentication of the user'"'"'s credential, to use a configuration of the user'"'"'s account to check the identity of the requesting client and/or requested URL against the list or lists.

61. The system of claim 59, wherein the first proxy server is programmed that if said first proxy server fails to authenticate the user, the first proxy server offers that user an opportunity to log in as an anonymous guest user.

62. The system of claim 57, wherein the range of access levels ranges from allowing all access to allowing no access at all.

63. The system of claim 57, wherein the system is compatible with dialup modem connection to the Internet, the system is compatible with a local area network and the system is compatible with virtual network connection

64. The system of claim 63, wherein the range of access levels ranges from allowing all access to allowing no access at all.

65. The system of claim 57, wherein said first proxy server is also programmed to register the request in a logfile of all URLs requested by a user.

66. The system of claim 57, wherein the first proxy server is programmed to check the identity of a user who logs into the first proxy server and who presents a unique authentication credential prior to checking the identity of the requesting client and/or requested URL against the list or lists.

67. The system of claim 66, wherein the first proxy server is programmed, upon a successful authentication of the user'"'"'s credential, to use a configuration of the user'"'"'s account to check the identity of the requesting client and/or requested URL against the list or lists.

68. The system of claim 66, wherein the first proxy server is programmed that if the first proxy server fails to authenticate the user, the first proxy server offers the user an opportunity to login again, denies the request and/or re-routes the user request to replacement resources.

69. The system of claim 59, wherein said first proxy server is also programmed to register the request in a logfile of all URLs requested by a user.

70. The system of claim 57, wherein one or more additional proxy servers are situated between the second proxy server and a resource.

71. The system of claim 57, wherein the list maintenance functions include list editing, list deleting, searching of lists, saving of lists, adding and deleting users, interchanging lists and importing and exporting lists and wherein the three types of user accounts include regular accounts with administrative privileges other than the privilege to create additional accounts or view information on any other accounts and regular accounts without administrative privileges.