Device internet resource access filtering system and method

• US 7,890,642 B2
• Filed: 09/16/2004
• Issued: 02/15/2011
• Est. Priority Date: 08/07/2004
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Websense UK Ltd. (Forcepoint LLC)
• Inventors: Pointon, Richard, Jones, Kevin Brian
• Primary Examiner(s): Srivastava; Vivek
• Assistant Examiner(s): Hossain; Tanim
• Application Number:
  US10/942,635
• Publication Number:
  US 20060031942A1
• Time in Patent Office: 2,343 Days
• Field of Search: 709/220, 709/223, 709/228, 709/229, 709/246
• US Class Current: 709/229
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A remote site filtering and monitoring system and method is described in which the Internet accesses of a remote device are monitored and categorized by a remote server in real-time. The system also provides for offline access logging and subsequent uploading, adjustable filtering sensitivities and particular HTTP port filtering.

Claims

1. An Internet access filtering system, comprising:

a computer;

a client on a device wherein the client is configured to establish a connection to the computer, the client further comprising a module that gathers information about a request to access a resource by the device and a module that communicates the gathered information to the computer;

the computer further comprising a module that categorizes the resource access of the device based on the gathered information and a module that communicates, in real-time, a resource access decision to the client so that the client controls the access to the resource by the device based on the resource access decision of the computer;

wherein the client further comprises a module that is configured to generate a capability mask for the device and communicates that capability mask to the computer, the capability mask containing information about the filtering capabilities of the device;

wherein the computer is further configured to generate the resource access decision based on the capability mask;

wherein the client further comprises an offline filtering module that controls the resource accesses of the device based on the filtering capabilities of the device when the client is unable to communicate with the computer;

wherein the offline filtering module further comprises an allow all resource access mode, a block all resource access mode and an allow all resource access with logging mode; and

wherein the allow all resource access with logging mode further comprises a module for throttling the offline logs uploaded to the computer in order to control the bandwidth utilized by the offline logs.

2. The system of claim 1, wherein the client has a filtered port list downloaded from the computer that indicates the ports to be filtered and the ports to be treated as HTTP ports.

3. The system of claim 2, wherein the client further comprises an unfiltered ports module that controls the resources accesses of the device for a port not specifically identified as a filtered port.

4. The system of claim 3, wherein the unfiltered port module further comprises an allow all resource access mode, a block all resource access mode and a send to computer for possible filtering and/or logging mode.

5. The system of claim 4, wherein the unfiltered port module mode is selected by the computer.

6. The system of claim 1, wherein the client further comprises a filtering sensitivity module that controls the level of filtering of resource accesses for the client.

7. The system of claim 6, wherein the filtering sensitivity module further comprises a high sensitivity level mode, a medium sensitivity level mode, a low sensitivity level mode and an automatic sensitivity level mode.

8. The system of claim 7, wherein the filtering sensitivity module mode is selected by the computer.

9. The system of claim 1, wherein the computer further comprises a monitor module that monitors the resource accesses of the devices connected to the computer to generate a summary of the resource accesses of the devices.

10. The system of claim 1, wherein the resource being accessed further comprises one of a web page, a file transfer protocol site, an e-mail site, a secure web site, and a news site.

11. The system of claim 1, wherein the device further comprises one of a personal digital assistant, a cellular phone, a personal computer, a laptop computer, a palmtop computer and an appliance.

12. The system of claim 1, wherein the client further comprises a module that detects whether the requested resource is to be communicated over a corporate network and that disables the client filtering for the requested resource being communicated over the corporate network.

13. The system of claim 1, wherein the gathered information and the resource access decision are communicated between the client and computer using a hypertext transfer protocol over TCP port 80.

14. The system of claim 13, wherein the protocol for gathered information further comprises a hypertext transfer protocol POST operation.

15. The system of claim 1, wherein the protocol for the resource access decision further comprises data in a web page format.

16. An Internet access filtering system, comprising:

a computer;

a client on a device wherein the client is configured to establish a connection to the computer, the client further comprising means for gathering information about a request to access a resource by the device and means for communicating the gathered information to the computer;

the computer further comprising means for categorizing the resource access of the device based on the gathered information and means for communicating, in real-time, a resource access decision to the client so that the client controls the access to the resource by the device based on the resource access decision of the computer;

wherein the client further comprises means for generating a capability mask for the device and communicating that capability mask to the computer, the capability mask containing information about the filtering capabilities of the device;

wherein the computer further comprises means for generating the resource access decision based on the capability mask;

wherein the client further comprises means for offline filtering that controls the resource accesses of the device based on the filtering capabilities of the device when the client is unable to communicate with the computer;

wherein the offline filtering means further comprises an allow all resource access mode, a block all resource access mode and an allow all resource access with logging mode; and

wherein the allow all resource access with logging mode further comprises means for throttling the offline logs uploaded to the computer in order to control the bandwidth utilized by the offline logs.

17. The system of claim 16, wherein the client has a filtered port list downloaded from the computer that indicates the ports to be filtered and the ports to be treated as HTTP ports.

18. The system of claim 17, wherein the client further comprises means for filtering unfiltered ports that controls the resources accesses of the device for a port not specifically identified as a filtered port.

19. The system of claim 18, wherein the unfiltered port means further comprises an allow all resource access mode, a block all resource access mode and a send to computer for possible filtering and/or logging mode.

20. The system of claim 19, wherein the unfiltered port means mode is selected by the computer.

21. The system of claim 16, wherein the client further comprises means for adjusting the filtering sensitivity that controls the level of filtering of resource accesses for the client.

22. The system of claim 21, wherein the filtering sensitivity means further comprises a high sensitivity level mode, a medium sensitivity level mode, a low sensitivity level mode and an automatic sensitivity level mode.

23. The system of claim 22, wherein the filtering sensitivity means mode is selected by the computer.

24. The system of claim 16, wherein the computer further comprises means for monitoring resource accesses of the devices connected to the computer to generate a summary of the resource accesses of the devices.

25. The system of claim 16, wherein the resource being accessed further comprises one of a web page, an file transfer protocol site, an e-mail site, a secure web site, and a news site.

26. The system of claim 16, wherein the device further comprises one of a personal digital assistant, a cellular phone, a personal computer, a laptop computer, a palmtop computer and an appliance.

27. The system of claim 16, wherein the client further comprises means for detecting whether the requested resource is to be communicated over a corporate network and means for disabling the client filtering for the requested resource being communicated over the corporate network.

28. An Internet access filtering method using a computer and a client on a device that establishes a connection to the computer, the method comprising:

gathering information by the client about a request to access a resource by the device;

communicating the gathered information to the computer;

categorizing, at the computer, the resource access of the device based on the gathered information;

communicating, in real-time, a resource access decision to the client so that the client controls the access to the resource by the device based on the resource access decision of the computer;

generating by the client, a capability mask for the device;

communicating that capability mask to the computer, the capability mask containing information about the filtering capabilities of the device;

generating, by the computer, the resource access decision based on the capability mask;

wherein offline filtering by the client controls the resource accesses of the device based on the filtering capabilities of the device when the client is unable to communicate with the computer;

wherein the offline filtering further comprises an allow all resource access mode, a block all resource access mode and an allow all resource access with logging mode; and

wherein the allow all resource access with logging mode further comprises throttling the offline logs uploaded to the computer in order to control the bandwidth utilized by the offline logs.

29. The method of claim 28 further comprising downloading a filtered port list from the computer to the client that indicates the ports to be filtered and the ports to be treated as HTTP ports.

30. The method of claim 29 further comprising filtering unfiltered ports that controls the resources accesses of the device for a port not specifically identified as a filtered port.

31. The method of claim 30, wherein the filtering of the unfiltered ports further comprises an allow all resource access mode, a block all resource access mode and a send to computer for possible filtering and/or logging mode.

32. The method of claim 31, wherein the unfiltered port mode is selected by the computer.

33. The method of claim 28 further comprising adjusting the filtering sensitivity that controls the level of filtering of resource accesses for the client.

34. The method of claim 33, wherein the filtering sensitivity adjustment further comprises a high sensitivity level mode, a medium sensitivity level mode, a low sensitivity level mode and an automatic sensitivity level mode.

35. The method of claim 34, wherein the filtering sensitivity adjustment mode is selected by the computer.

36. The method of claim 28 further comprising monitoring the resource accesses of the devices connected to the computer to generate a summary of the resource accesses of the devices.

37. The method of claim 28, wherein the resource being accessed further comprises one of a web page, an file transfer protocol site, an e-mail site, a secure web site, and a news site.

38. The method of claim 28, wherein the device further comprises one of a personal digital assistant, a cellular phone, a personal computer, a laptop computer, a palmtop computer and an appliance.

39. The method of claim 28 further comprising detecting, by the client, a connection of the device to a corporate network in order to disable the client filtering operation while the device is connected to the corporate network.

40. A server for an Internet access filtering system, comprising:

a module implemented with a processor so as to cause said processor to receive information about a request to access a resource by a remote device wherein the information about the resource access request is communicated from a remote client on the device;

a module implemented with a processor so as to cause said processor to categorize the resource access of the device based on the gathered information;

a module implemented with a processor so as to cause said processor to communicate, in real-time, a resource access decision to the client so that the client controls the access to the resource by the device based on the resource access decision of the processor;

wherein the server further comprises a module implemented with a processor so as to cause said processor to receive a capability mask for the device from a client associated with the device, the capability mask containing information about the filtering capabilities of the device;

wherein the processor is further configured to generate the resource access decision based on the capability mask;

wherein the client associated with the device is configured to control the resource accesses of the device based on the filtering capabilities of the device when the client is unable to connect to the processor;

wherein, when the client is unable to connect to the processor, the client controls the resource accesses of the device with an allow all resource access mode, a block all resource access mode and an allow all resource access with logging mode; and

wherein the allow all resource access with logging mode further comprises means for throttling offline logs uploaded to the computer in order to control the bandwidth utilized by the offline logs.

41. The server of claim 40 further comprising an administrator module that sets a filtered ports list that is downloaded to the client that indicates the ports to be filtered and the ports to be treated as HTTP ports.

42. The server of claim 41 further comprising an unfiltered ports module that sets the filtering decisions for each client for a port not specifically identified as a filtered port.

43. The server of claim 42, wherein the unfiltered port module setting further comprises an allow all resource access mode, a block all resource access mode and a send to a computer for possible filtering and/or logging mode.

44. The server of claim 40 further comprising a filtering sensitivity module that sets the filtering sensitivity for each client.

45. The server of claim 44, wherein the filtering sensitivity module settings further comprises a high sensitivity level mode, a medium sensitivity level mode, a low sensitivity level mode and an automatic sensitivity level mode.

46. The server of claim 40 further comprising a monitor module, connected to a computer, that monitors the resource accesses of the devices to generate a summary of the resource accesses of the devices.

47. The server of claim 40, wherein the resource being accessed further comprises one of a web page, an file transfer protocol site, an e-mail site, a secure web site, and a news site.

48. The server of claim 40, wherein the device further comprises one of a personal digital assistant, a cellular phone, a personal computer, a laptop computer, a palmtop computer and an appliance.

49. An Internet access filtering client located on a device that communicates with a remote computer, the client comprising:

a module implemented with a processor so as to cause said processor to gather information about a request to access a resource by the device;

a module implemented with a processor so as to cause said processor to communicates the gathered information to the computer;

a module implemented with a processor so as to cause said processor to receive a resource access decision from the remote computer and controls the access to the resource by the device based on the resource access decision of the computer;

wherein the client further comprises a module implemented with a processor so as to cause said processor to generate a capability mask for the device and to communicate that capability mask to the computer, the capability mask containing information about the filtering capabilities of the device;

wherein the computer is further configured to generate the resource access decision based on the capability mask;

wherein the client is further configured to control the resource accesses of the device based on the filtering capabilities of the device when the client is unable to communicate with the computer;

wherein the client controls the resource accesses of the device with an allow all resource access mode, a block all resource access mode and an allow all resource access with logging mode; and

wherein the allow all resource access with logging mode further comprises means for throttling the offline logs uploaded to the computer in order to control the bandwidth utilized by the offline logs.

50. The client of claim 49, wherein the client controls the resource accesses of the device based on a mode selected by the computer.

51. The client of claim 49, wherein the client has a filtered port list downloaded from the computer that indicates the ports to be filtered and the ports to be treated as HTTP ports.

52. The client of claim 51 further comprising an unfiltered ports module that controls the resources accesses of the device for a port not specifically identified as a filtered port.

53. The client of claim 52, wherein the unfiltered port module further comprises an allow all resource access mode, a block all resource access mode and a send to the computer for possible filtering and/or logging mode.

54. The client of claim 53, wherein the unfiltered port module mode is selected by the computer.

55. The client of claim 49 further comprising a filtering sensitivity module that controls the level of filtering of resource accesses for the client.

56. The client of claim 55, wherein the filtering sensitivity module further comprises a high sensitivity level mode, a medium sensitivity level mode, a low sensitivity level mode and an automatic sensitivity level mode.

57. The client of claim 56, wherein the filtering sensitivity module mode is selected by the computer.

58. The client of claim 49, wherein the resource being accessed further comprises one of a web page, an file transfer protocol site, an e-mail site, a secure web site, and a news site.

59. The client of claim 49, wherein the device further comprises one of a personal digital assistant, a cellular phone, a personal computer, a laptop computer, a palmtop computer and an appliance.

60. The client of claim 49 further comprising a module that detects whether the requested resource is to be communicated over a corporate network and that disables the client filtering for the requested resource being communicated over the corporate network.