System and program for access control

• US 7,865,604 B2
• Filed: 08/29/2008
• Issued: 01/04/2011
• Est. Priority Date: 12/27/2002
• Status: Expired due to Fees

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Wada, Tokuhiro, Yamamoto, Hidenobu, Yoshino, Hirofumi, Ogawa, Yukio, Saitoh, Michiko
• Primary Examiner(s): LIN, WEN TAI
• Application Number:
  US12/201,360
• Publication Number:
  US 20090064298A1
• Time in Patent Office: 858 Days
• Field of Search: None
• US Class Current: 709/229
• CPC Class Codes: H04L 2101/32 containing non-Latin characters, e.g. Chinese domain names
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A system and program for a proxy server that forwards an access request from a client to a data server and forwards response data from the data server to the client. The proxy server includes a means for storing a first address location and an encoding format of the response data. The proxy server also includes a means for receiving a subsequent access request from the client, which includes a second address location encoded by the encoding format. A means is present in the proxy server for comparing the second address location to the first address location to determine if the second address location is related to the first address location. The proxy server also includes a means for decoding the second address location based on the encoding format in response to a determination that the second address location is related to the first address location.

Claims

1. A proxy server to forward an access request from a client computer to a data server and forward response data from the data server to the client computer, the proxy server comprising:

a computer system comprising a CPU, a computer readable storage device, and a computer readable memory;

first program instructions for storing a first address location and an encoding format obtained from the response data;

second program instructions for receiving a subsequent access request from the client computer which includes a second address location that is encoded;

third program instructions for comparing the second address location to the first address location to determine if the second address location includes the the first address location; and

fourth program instructions, responsive to a determination that the second address location includes the first address location, for decoding the second address location based on the encoding format, wherein the second address location differs from the first address location, but includes the first address location, and wherein the first program instructions, the second program instructions, the third instructions, and the fourth program instructions are stored in the computer readable storage device for execution by the CPU via the computer readable memory.

2. The proxy server according to claim 1, wherein the data server is a web server, and the response data is a web page.

3. The proxy server according to claim 1, wherein the second address location is an extension of the first address location.

4. The proxy server according to claim 1 further comprising:

fifth program instructions for determining access-allowed/access-prohibited for the subsequent access request based on a decoded second address location; and

sixth program instructions for transmitting the subsequent access request to the data server if the fifth program instructions determine that access is allowed for the subsequent access request, wherein the fifth program instructions and the sixth program instructions are stored in the computer readable storage device for execution by the CPU via the computer readable memory.

5. The proxy server according to claim 4, wherein the fifth program instructions include instructions for comparing the decoded second address location with a list of allowed addresses or prohibited addresses previously stored in the proxy server.

6. The proxy server according to claim 1, wherein the first address location is a location of a web page currently displayed on the client computer when a user of the client computer selects the second address location.

7. The proxy server according to claim 1, wherein the access request is an HTTP request, the first address location is a URL of a home page, the response data is the home page, and the encoding format is an attribute value of a “

charset”

of the response data.

13. The proxy server according to claim 1 further comprising:

fifth program instructions for determining whether the subsequent access request is allowed by comparing a decoded second address location to an access control list; and

sixth program instructions for transmitting the subsequent access request to the data server if a determination is made to allow access for the subsequent access request, wherein the fifth program instructions and the sixth program instructions are stored in the computer readable storage device for execution by the CPU via the computer readable memory.

14. The proxy server according to claim 13, wherein the access control list identifies address locations for which the access is permitted.

15. The proxy server according to claim 1, wherein the second address location includes a character using a byte code other than a single byte code.

8. A computer program product to be installed in a proxy server which forwards an access request from a client computer to a data server and forwards response data from the data server to the client computer, the computer program product comprising:

a computer readable storage device;

first program instructions to store a first address location and an encoding format of the response data;

second program instructions to receive a subsequent access request from the client computer which includes a second address location;

third program instructions to compare the second address location to the first address location to determine if the second address location includes the the first address location; and

fourth program instructions, responsive to a determination that the second address location includes the first address location, to decode the second address location based on the encoding format, wherein the second address location differs from the first address location, but includes the first address location, and wherein the first, second, third and fourth program instructions are recorded on the computer readable storage device.

9. The computer program product according to claim 8, wherein the data server is a web server and the response data is a web page.

10. The computer program product according to claim 8, wherein the second address location is an extension of the first address location.

11. The computer program product according to claim 8, further comprising:

fifth program instructions to determine access-allowed/access-prohibited for the subsequent access request based on a decoded second address location; and

sixth program instructions to transmit the subsequent access request to the data server if the determination is that access is allowed for the subsequent access request, wherein

the fifth and sixth program instructions are recorded on the computer readable storage device.

12. The computer program product according to claim 8, wherein the encoding format is UTF-8, EUC, Unicode, or Shift-JIS.

16. The computer program product according to claim 8 further comprising:

fifth program instructions for determining whether the subsequent access request is allowed by comparing a decoded second address location to an access control list; and

sixth program instructions for transmitting the subsequent access request to the data server if a determination is made to allow access for the subsequent access request, wherein the fifth program instructions and the sixth program instructions are stored in the computer readable storage device.

17. The computer program product according to claim 16, wherein the access control list identifies address locations for which the access is permitted.

18. The computer program product according to claim 8, wherein the second address location includes a character using a byte code other than a single byte code.