US5987611A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and methodology for managing internet access on a per application basis for client computers connected to the internet
Assignee: Check Point Software Technologies Inc
•
Filing: 1997-05-06
•
Granted: 1999-11-16
•
Expires: 2017-05-06
Abstract
Abstract A computing environment with methods for monitoring access to an open network, such as a WAN or the Internet, is described. The system includes one or more clients, each operating applications or processes (e.g., Netscape Navigator™ or Microsoft Internet Explorer™ browser software) requiring Internet (or other open network) access (e.g., an Internet connection to one or more Web servers). Client-based monitoring and filtering of access is provided in conjunction with a centralized enforcement supervisor. The supervisor maintains access rules for the client-based filtering and verifies the existence and proper operation of the client-based filter application. Access rules which can be defined can specify criteria such as total time a user can be connected to the Internet (e.g., per day, week, month, or the like), time a user can interactively use the Internet (e.g., per day, week, month, or the like), a list of applications or application versions that a user can or cannot use in order to access the Internet, a list of URLs (or WAN addresses) that a user application can (or cannot) access, a list of protocols or protocol components (such as Java Script™) that a user application can or cannot use, and rules to determine what events should be logged (including how long are logs to be kept). By intercepting process loading and unloading and keeping a list of currently-active processes, each client process can be checked for various characteristics, including checking executable names, version numbers, executable file checksums, version header details, configuration settings, and the like. With this information, the system can determine if a particular process in question should have access to the Internet and what kind of access (i.e., protocols, Internet addresses, time limitations, and the like) is permissible for the given specific user.
Inventors
- 👤 Gregor Freund
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-03 00:02
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0227; H04L63/0263; G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/552; H04L12/00; H04L12/28; H04L12/2854; H04L12/2856; H04L12/2869; H04L12/287; H04L12/2874; H04L43/00; H04L63/14; H04L63/1408; H04L63/1425; H04L67/00; H04L67/2866; H04L67/30; H04L67/306; H04L67/50; H04L67/535; H04L9/00; H04L9/40; G06F2221/00; G06F2221/21; G06F2221/2101; G06F2221/2119; G06F2221/2137; G06F2221/2149; G06F2221/2151; H04L43/06; H04L43/08; H04L43/0805; H04L43/0817; H04L69/00; H04L69/30; H04L69/32; H04L69/322; H04L69/329
Claims Analysis
Total Claims: 33
Claim 1
Independent Claim
148 words
In a system comprising a plurality of client computers connected to a network and having Internet access, a method for managing Internet access for a particular client computer, the method comprising: providing at the particular client computer a client monitoring process; providing at another computer on the network a supervisor process, said supervisor process specifying rules which govern Internet access by the client computers; transmitting at least a subset of said rules to the particular client computer; at the client monitoring process, trapping a request for Internet access from the particular client computer; and processing the request for Internet access by performing substeps of: (i) determining whether the request for Internet access violates any of the rules transmitted to the particular client computer, and (ii) if the request for Internet access violates any of the rules transmitted to the particular client computer, denying the request for Internet access.
Claim 2
Dependent Claim
148 words
In a system comprising a plurality of client computers connected to a network and having Internet access, a method for managing Internet access for a particular client computer, the method comprising: providing at the particular client computer a client monitoring process; providing at another computer on the network a supervisor process, said supervisor process specifying rules which govern Internet access by the client computers; transmitting at least a subset of said rules to the particular client computer; at the client monitoring process, trapping a request for Internet access from the particular client computer; and processing the request for Internet access by performing substeps of: (i) determining whether the request for Internet access violates any of the rules transmitted to the particular client computer, and (ii) if the request for Internet access violates any of the rules transmitted to the particular client computer, denying the request for Internet access.
Claim 3
Dependent Claim
54 words
The method of claim 1, wherein the particular client computer includes a communication driver for processing requests for Internet access and wherein said step of providing at the particular client computer a client monitoring process comprises: providing at the particular client computer a process which traps at the communication driver requests for Internet access.
Claim 4
Dependent Claim
41 words
The method of claim 1, wherein said step of providing at the particular client computer a client monitoring process includes: installing at the particular client computer a client monitoring process which executes anytime the communication driver processes requests for Internet access.
Claim 5
Dependent Claim
17 words
The method of claim 1, wherein said another computer includes a server computer connected to the network.
Claim 6
Dependent Claim
17 words
The method of claim 1, wherein said another computer includes another client computer connected to the network.
Claim 7
Dependent Claim
25 words
The method of claim 1, wherein said rules transmitted to the particular client computer specify whether the particular client computer is allowed any Internet access.
Claim 8
Dependent Claim
21 words
The method of claim 1, wherein said rules transmitted to the particular client computer specify which applications are allowed Internet access.
Claim 9
Dependent Claim
24 words
The method of claim 1, wherein said rules transmitted to the particular client computer specify a particular type of Internet access which is allowed.
Claim 10
Dependent Claim
42 words
The method of claim 1, wherein said system includes a "firewall" application for selectively blocking Internet access and wherein said substep of denying the request for Internet access includes: instructing said firewall application to block Internet access for the particular client computer.
Claim 11
Dependent Claim
26 words
The method of claim 9, wherein said firewall application operates independently to block Internet access for any client according to rules specified for the firewall application.
Claim 12
Dependent Claim
30 words
The method of claim 1, wherein said rules which govern Internet access by the client computers include rules which are enforced against selected ones of users, computers, and groups thereof.
Claim 13
Dependent Claim
49 words
The method of claim 11, wherein said transmitting at least a subset of said rules step includes: determining, based on identification of users, computers, or groups thereof and for which rules have been defined, a subset of said rules filtered for a given user at the particular client computer.
Claim 14
Dependent Claim
13 words
The method of claim 12, wherein said users are identified by user name.
Claim 15
Dependent Claim
15 words
The method of claim 12, wherein said computers are identified by Internet Protocol (IP) addresses.
Claim 16
Dependent Claim
41 words
The method of claim 1, wherein said transmitting at least a subset of said rules to the particular client computer includes: transmitting a set of default rules for the particular client, if no particular rules are already defined for the client.
Claim 17
Dependent Claim
129 words
In a system comprising a plurality of client computers connected to a network and having Internet access, a method for managing Internet access for a particular client computer on a per application basis, the method comprising: storing at a supervisor computer a list of applications and versions thereof defining which applications are permitted Internet access; transmitting said list from the supervisor computer to the client computer; at the client computer, trapping a request for Internet access from a particular application; based on said list, determining whether the request for Internet access is from an application or version thereof which is permitted Internet access; and if the request for Internet access is from an application or version thereof which is not permitted Internet access, blocking Internet access for the application.
Claim 18
Dependent Claim
129 words
In a system comprising a plurality of client computers connected to a network and having Internet access, a method for managing Internet access for a particular client computer on a per application basis, the method comprising: storing at a supervisor computer a list of applications and versions thereof defining which applications are permitted Internet access; transmitting said list from the supervisor computer to the client computer; at the client computer, trapping a request for Internet access from a particular application; based on said list, determining whether the request for Internet access is from an application or version thereof which is permitted Internet access; and if the request for Internet access is from an application or version thereof which is not permitted Internet access, blocking Internet access for the application.
Claim 19
Dependent Claim
36 words
The method of claim 16, wherein said storing step includes: storing with a supervisor process executing on a server computer connected to the network the list of applications and versions thereof which are permitted Internet access.
Claim 20
Dependent Claim
36 words
The method of claim 16, wherein said storing step includes: storing with a supervisor process executing on another client computer connected to the network the list of applications and versions thereof which are permitted Internet access.
Claim 21
Dependent Claim
21 words
The method of claim 16, wherein said list includes executable names and version numbers for applications which are permitted Internet access.
Claim 22
Dependent Claim
22 words
The method of claim 16, wherein said list includes executable names and version numbers for applications which are not permitted Internet access.
Claim 23
Dependent Claim
22 words
The method of claim 16, wherein said list includes Internet access activities which are permitted or restricted for applications or versions thereof.
Claim 24
Dependent Claim
15 words
The method of claim 21, wherein Internet access activities comprise use of particular communication protocols.
Claim 25
Dependent Claim
23 words
The method of claim 22, wherein said communication protocols include at least one of Hypertext Transport Protocol (HTTP) and File Transport Protocol (FTP).
Claim 26
Dependent Claim
13 words
The method of claim 22, wherein said communication protocols include an e-mail protocol.
Claim 27
Dependent Claim
20 words
The method of claim 16, wherein said Internet access activities comprise at least one of browsing activity and e-mail activity.
Claim 28
Dependent Claim
118 words
A computer system regulating access by client computers comprising: a plurality of client computers which can connect to at least one open network; supervisor means provided at a computer which is in communication with each client computer to be regulated, said supervisor means including a database of enforcement rules governing access of client computers to said at least one open network; means for transferring rules from the database of enforcement rules to each computer requiring access to said at least one open network and which is to be regulated; and monitoring means provided at each client computer which is to be regulated, for selectively blocking access to said at least one open network based on said transferred rules.
Claim 29
Dependent Claim
118 words
A computer system regulating access by client computers comprising: a plurality of client computers which can connect to at least one open network; supervisor means provided at a computer which is in communication with each client computer to be regulated, said supervisor means including a database of enforcement rules governing access of client computers to said at least one open network; means for transferring rules from the database of enforcement rules to each computer requiring access to said at least one open network and which is to be regulated; and monitoring means provided at each client computer which is to be regulated, for selectively blocking access to said at least one open network based on said transferred rules.
Claim 30
Dependent Claim
32 words
The system of claim 26, further comprising: means for selectively blocking access based on properties of applications executing at said client computers which attempt access to said at least one open network.
Claim 31
Dependent Claim
18 words
The system of claim 27, wherein said properties of applications include version and executable name for each application.
Claim 32
Dependent Claim
25 words
The system of claim 27, wherein said properties of applications include types of activities which applications are either allowed to perform or restricted from performing.
Claim 33
Dependent Claim
19 words
The system of claim 29, wherein said types of activities include at least one of using e-mail and browsing.
References Cited (Backward Citations)
US4914586A
Cited
US5475817A
Cited
US5586260A
Cited
US5623601A
Cited
US5815574A
Cited
US5832211A
Cited
US5838903A
Cited
US5764887A
Cited
US5881230A
Cited
US5857191A
Cited
US5828833A
Cited
US5864665A
Cited
US5875296A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-11-15 | 2003-05-17 | 2003-11-16 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-11-15 | 2007-05-17 | 2007-11-16 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-11-15 | 2011-05-17 | 2011-11-16 | $7700.00 | Window Closed / Lapsed |