US20120096511A1 - Enhanced browser security - Google Patents
Enhanced browser security Download PDFInfo
- Publication number
- US20120096511A1 US20120096511A1 US13/205,821 US201113205821A US2012096511A1 US 20120096511 A1 US20120096511 A1 US 20120096511A1 US 201113205821 A US201113205821 A US 201113205821A US 2012096511 A1 US2012096511 A1 US 2012096511A1
- Authority
- US
- United States
- Prior art keywords
- security
- domain
- browser
- domain identifiers
- context
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/102—Entity profiles
Definitions
- Embodiments of the invention relate generally to computer systems and, more particularly, to improvements in security for browser applications.
- browsers include one or more security “zones” that allow a user to apply one or more security policies to web sites accessible to the browsers.
- a security policy may govern whether an accessed web site is allowed to, for example, run ActiveX controls on or automatically upload/download software to the system on which the browser is running.
- the browser may include a “Restricted” zone represented by a user interface 10 displayable on a display device (not shown) and having one or more fields 20 A, 20 B that a user can populate with the domain identifiers of web sites to which the user would like to apply a comparatively restrictive security policy.
- a “Restricted” zone represented by a user interface 10 displayable on a display device (not shown) and having one or more fields 20 A, 20 B that a user can populate with the domain identifiers of web sites to which the user would like to apply a comparatively restrictive security policy.
- the user has previously placed several domain identifiers (e.g., www.abc.com, www.cba.com) in the Restricted zone, a fact illustrated in field 20 B.
- the browser applies a predefined security policy associated with the Restricted zone to each of the web sites associated with the domain identifiers displayed in field 20 B. If the user wishes to add a web site to the Restricted zone, the user must type or otherwise manually enter the domain identifier into the field 20 A.
- a machine-executable method implementable in a system operable to execute a browser application having at least one security-context zone and operable to apply at least one security policy to interaction between the system and web sites corresponding to domain identifiers populating the at least one security-context zone includes comparing a first set of domain identifiers populating a first security-context zone of the at least one security-context zone with a second set of domain identifiers. The method further includes populating the first security-context zone with at least one second-set identifier not included in the first set of domain identifiers.
- FIG. 1 illustrates a conventional user interface
- FIG. 2 is a schematic view of an exemplary operating environment in which an embodiment of the invention can be implemented
- FIG. 3 is a functional block diagram of an exemplary operating environment in which an embodiment of the invention can be implemented
- FIG. 4 illustrates a user interface according to an embodiment of the invention
- FIG. 5 illustrates a user interface according to an embodiment of the invention.
- FIG. 6 is a flow diagram illustrating a method according to an embodiment of the invention.
- FIG. 2 illustrates an example of a suitable computing system environment 100 on which the invention may be implemented.
- the computing system environment 100 is only one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality of the invention. Neither should the computing environment 100 be interpreted as having any dependency or requirement relating to any one or combination of components illustrated in the exemplary operating environment 100 .
- Embodiments of the invention are operational with numerous other general purpose or special purpose computing system environments or configurations.
- Examples of well known computing systems, environments, and/or configurations that may be suitable for use with the invention include, but are not limited to, personal computers, server computers, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.
- Embodiments of the invention may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer.
- program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types.
- the invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network.
- program modules may be located in both local and remote computer storage media including memory storage devices.
- an exemplary system for implementing the invention includes a general purpose computing device in the form of a computer 110 .
- Components of computer 110 may include, but are not limited to, a processing unit 120 , a system memory 130 , and a system bus 121 that couples various system components including the system memory to the processing unit 120 .
- the system bus 121 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures.
- such architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus also known as Mezzanine bus.
- ISA Industry Standard Architecture
- MCA Micro Channel Architecture
- EISA Enhanced ISA
- VESA Video Electronics Standards Association
- PCI Peripheral Component Interconnect
- Computer 110 typically includes a variety of computer readable media.
- Computer readable media can be any available media that can be accessed by computer 110 and includes both volatile and nonvolatile media, removable and non-removable media.
- Computer readable media may comprise computer storage media and communication media.
- Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data.
- Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can accessed by computer 110 .
- Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media.
- modulated data signal means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal.
- communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of any of the above should also be included within the scope of computer readable media.
- the system memory 130 includes computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM) 131 and random access memory (RAM) 132 .
- ROM read only memory
- RAM random access memory
- BIOS basic input/output system
- RAM 132 typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by processing unit 120 .
- FIG. 2 illustrates operating system 134 , application programs 135 , other program modules 136 , and program data 137 .
- the computer 110 may also include other removable/non-removable, volatile/nonvolatile computer storage media.
- FIG. 2 illustrates a hard disk drive 140 that reads from or writes to non-removable, nonvolatile magnetic media, a magnetic disk drive 151 that reads from or writes to a removable, nonvolatile magnetic disk 152 , and an optical disk drive 155 that reads from or writes to a removable, nonvolatile optical disk 156 such as a CD ROM or other optical media.
- removable/non-removable, volatile/nonvolatile computer storage media that can be used in the exemplary operating environment include, but are not limited to, magnetic tape cassettes, flash memory cards, digital versatile disks, digital video tape, solid state RAM, solid state ROM, and the like.
- the hard disk drive 141 is typically connected to the system bus 121 through an non-removable memory interface such as interface 140
- magnetic disk drive 151 and optical disk drive 155 are typically connected to the system bus 121 by a removable memory interface, such as interface 150 .
- hard disk drive 141 is illustrated as storing operating system 144 , application programs 145 , other program modules 146 , and program data 147 . Note that these components can either be the same as or different from operating system 134 , application programs 135 , other program modules 136 , and program data 137 . Operating system 144 , application programs 145 , other program modules 146 , and program data 147 are given different numbers here to illustrate that, at a minimum, they are different copies.
- a user may enter commands and information into the computer 20 through input devices such as a keyboard 162 and pointing device 161 , commonly referred to as a mouse, trackball or touch pad.
- Other input devices may include a microphone, joystick, game pad, satellite dish, scanner, or the like.
- These and other input devices are often connected to the processing unit 120 through a user input interface 160 that is coupled to the system bus, but may be connected by other interface and bus structures, such as a parallel port, game port or a universal serial bus (USB).
- a monitor 191 or other type of display device is also connected to the system bus 121 via an interface, such as a video interface 190 .
- computers may also include other peripheral output devices such as speakers 197 and printer 196 , which may be connected through a output peripheral interface 190 .
- the computer 110 may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 180 .
- the remote computer 180 may be a personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the computer 110 , although only a memory storage device 181 has been illustrated in FIG. 2 .
- the logical connections depicted in FIG. 2 include a local area network (LAN) 171 and a wide area network (WAN) 173 , but may also include other networks.
- LAN local area network
- WAN wide area network
- Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets and the Internet.
- the computer 110 When used in a LAN networking environment, the computer 110 is connected to the LAN 171 through a network interface or adapter 170 .
- the computer 110 When used in a WAN networking environment, the computer 110 typically includes a modem 172 or other means for establishing communications over the WAN 173 , such as the Internet.
- the modem 172 which may be internal or external, may be connected to the system bus 121 via the user input interface 160 , or other appropriate mechanism.
- program modules depicted relative to the computer 110 may be stored in the remote memory storage device.
- FIG. 2 illustrates remote application programs 185 as residing on memory device 181 . It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used.
- System 200 includes an electronic client device 210 , such as a personal computer or workstation, that is linked via a communication medium, such as a network 220 (e.g., the Internet), to an electronic device or system, such as a server 230 .
- the server 230 may further be coupled, or otherwise have access, to a database 240 and a computer system 260 .
- FIG. 3 includes one server 230 coupled to one client device 210 via the network 220 , it should be recognized that embodiments of the invention may be implemented using one or more such client devices coupled to one or more such servers.
- each of the client device 210 and server 230 may include all or fewer than all of the features associated with the computer 110 illustrated in and discussed with reference to FIG. 3 .
- Client device 210 includes or is otherwise coupled to a computer screen or display 250 .
- Client device 210 can be used for various purposes including both network- and local-computing processes.
- the client device 210 is linked via the network 220 to server 230 so that computer programs, such as, for example, a browser, running on the client device 210 can cooperate in two-way communication with server 230 .
- Server 230 may be coupled to database 240 to retrieve information therefrom and to store information thereto.
- Database 240 may include a plurality of different tables (not shown) that can be used by server 230 to enable performance of various aspects of embodiments of the invention.
- the server 230 may be coupled to the computer system 260 in a manner allowing the server to delegate certain processing functions to the computer system.
- An embodiment of the invention includes a first domain-identifier file 270 and a populating component 280 , the functionality of which is discussed more fully hereinafter. At least portions of the component 280 may be executed by the server 230 . Alternatively or additionally, at least portions of the component 280 may be executed by the computer system 260 . Alternatively or additionally, at least portions of the component 280 may be executed by the client device 210 .
- the first domain-identifier file 270 and/or component 280 may be implemented in any suitable hardware, software, firmware, or combination thereof.
- a user (not shown) of the client device 210 desiring to apply one or more security policies to one or more web sites uses a browser application running on the client device to access web content, which may, but need not, be served by the server 230 .
- the user may download from the server 230 and install on the client device 210 the first domain-identifier file 270 and/or component 280 .
- URL uniform resource locator
- the user may receive the first domain-identifier file 270 and/or component 280 on a tangible computer-readable medium (not shown), such as, for example, a CD-ROM, and subsequently install the file and/or component on the client device 210 from the medium.
- a tangible computer-readable medium such as, for example, a CD-ROM
- An embodiment of the invention which may include the first domain-identifier file 270 and/or component 280 , includes one or more user-interface components (not shown).
- a user interface including, for example, a window 300 ( FIG. 4 ) may be presented to the user on a display device such as display 250 .
- the window 300 includes a control-button panel 310 , the buttons of which are selectable via a conventional “point-and-click” device, such as a mouse (not shown), and enable the user to control probe functionality of the component 280 as described more fully hereinafter.
- An embodiment of the file 270 includes domain identifiers associated with web sites that have been analyzed and categorized according to their trustworthiness and, as such, the extent to which each is appropriate for a particular security zone.
- the file 270 may include a set of identifiers of sites appropriate for the “Restricted” zone (i.e., a zone having a more-restrictive policy than that of a zone having normal or average security requirements), a set of identifiers appropriate for a “Trusted” zone (i.e., a zone having a less-restrictive policy than that of a zone having normal or average security requirements), and/or sets of identifiers appropriate for respective ones of other zones of varying security requirements.
- the administrator of the server 230 or the administrator of a site hosted by the server 230 and from which the client device 210 ultimately receives the file 270 may make the determinations upon which such categorizations are based. These determinations may be made on an ongoing basis such that, periodically, a second domain-identifier file 290 ( FIG. 3 ), and perhaps subsequent updated domain-identifier files (not shown) that include newly analyzed sites may be provided in a manner described above to the client device 210 to supplement or supplant the first domain-identifier file 270 .
- the second domain-identifier file 290 and subsequent updated domain-identifier files may be manually downloaded by the user or automatically uploaded to the client device 210 .
- An embodiment allows users to submit web sites for review and automatic or manual inclusion in, for example, an updated domain-identifier file. Additionally, an embodiment enables a user to contact the server 230 for a real-time evaluation of a site rather than relying on a static domain-identifier file.
- the user interface allows the user to choose a security zone (i.e., Restricted, Trusted, etc.) for which a probe shall be performed using the window 300 .
- a security zone i.e., Restricted, Trusted, etc.
- the component 280 is operable to review the domain identifiers in the file 270 , and to determine whether those domain identifiers currently populate the selected zone (in the example illustrated in FIG. 4 , the Restricted zone) of the browser.
- the status of this probe is displayed in a status pane 320 of the window 300 .
- Those identifiers in the file 270 that do currently populate the zone are tallied into the total corresponding to the “Protected Sites Found” entry of the status pane 320 .
- Those identifiers in the file 270 that do not currently populate the zone are tallied into the total corresponding to the “Exposed Sites Found” entry of the status pane 320 .
- Sites corresponding to those identifiers in the file 270 that do not currently populate the zone may be displayed in a probe-results pane 330 .
- the user may select a populate button 340 of the window 300 to populate the zone with all of the sites displayed in the results pane 330 .
- the user may, prior to selecting the populate button 340 , select one or more of the sites listed in the results pane 330 to be excluded from populating the zone.
- the user interface of an embodiment may include a settings page 400 that enables a user to customize the security policy that will be applied to web sites that have been made subject to a particular zone.
- the settings page may allow the user to enable/disable the ability of sites in the applicable zone to, for example, run ActiveX controls, script ActiveX controls, run Java Applets, etc.
- the user may enable/disable these settings by using setting buttons 410 to toggle between or otherwise select the permission settings.
- FIG. 6 illustrates a process 600 , according to an embodiment of the invention, that can be implemented in a system operable to execute a browser application having at least one security-context zone and operable to apply at least one security policy to interaction between the system and web sites corresponding to domain identifiers populating the a security-context zone.
- the process 600 is illustrated as a set of operations shown as discrete blocks.
- the process 600 may be implemented in any suitable hardware, software, firmware, or combination thereof.
- the process 600 may be implemented in computer-executable instructions that can be transferred from one computer, such as server 230 , to a second computer, such as client device 210 , via a communications medium, such as network 220 .
- the order in which the operations are described is not to be necessarily construed as a limitation.
- a first set of domain identifiers populating a first security-context zone is compared with a second set of domain identifiers.
- the populating component 280 may review a set of domain identifiers in the file 270 appropriate for the Restricted zone and determine whether those domain identifiers currently populate the Restricted zone of the browser.
- the first security-context zone is populated with at least one second-set identifier not included in the first set of domain identifiers. For example, as discussed above, sites corresponding to those identifiers in the file 270 that do not currently populate the Restricted zone may be displayed in a probe-results pane 330 . After reviewing the sites listed in the results pane 330 , the user may select a populate button 340 of the window 300 to populate the Restricted zone with all of the sites displayed in the results pane 330 .
- the populating component 280 or other associated implementation may be operable to restrict the number of domain identifiers that can populate a given one or more of the zones and, as such, restrict the number of web sites to which a given one or more security policies are applied.
- a third set of domain identifiers populating a second security-context zone is compared with a fourth set of domain identifiers.
- the populating component 280 may review a set of domain identifiers in the file 270 appropriate for the Trusted zone and determine whether those domain identifiers currently populate the Trusted zone of the browser.
- the second security-context zone is populated with at least one fourth-set identifier not included in the third set of domain identifiers. For example, sites corresponding to those identifiers in the file 270 that do not currently populate the Trusted zone may be displayed in a probe-results pane 330 . After reviewing the sites listed in the results pane 330 , the user may select a populate button 340 of the window 300 to populate the Trusted zone with all of the sites displayed in the results pane 330 .
Abstract
A machine-executable method implementable in a system operable to execute a browser application having at least one security-context zone and operable to apply at least one security policy to interaction between the system and web sites corresponding to domain identifiers populating the at least one security-context zone includes comparing a first set of domain identifiers populating a first security-context zone of the at least one security-context zone with a second set of domain identifiers. The method further includes populating the first security-context zone with at least one second-set identifier not included in the first set of domain identifiers.
Description
- The present application is a continuation of U.S. patent application Ser. No. 11/549,812 filed Oct. 16, 2006 which claims priority from U.S. Provisional Patent Application No. 60/727,288 filed Oct. 14, 2005, along with commonly owned and co-pending U.S. patent application Ser. No. 11/351,257 filed on Feb. 9, 2006, U.S. patent application Ser. No. 11/549,804 filed Oct. 16, 2006, U.S. patent application Ser. No. 11/549,783 filed Oct. 16, 2006 and U.S. Provisional Application No. 60/805,683 filed on Jun. 23, 2006, all of which are herein incorporated by reference in their entirety.
- Embodiments of the invention relate generally to computer systems and, more particularly, to improvements in security for browser applications.
- Many conventional Internet-browser applications (“browsers”) include one or more security “zones” that allow a user to apply one or more security policies to web sites accessible to the browsers. Such a security policy may govern whether an accessed web site is allowed to, for example, run ActiveX controls on or automatically upload/download software to the system on which the browser is running. As shown in
FIG. 1 , the browser may include a “Restricted” zone represented by auser interface 10 displayable on a display device (not shown) and having one ormore fields FIG. 1 , the user has previously placed several domain identifiers (e.g., www.abc.com, www.cba.com) in the Restricted zone, a fact illustrated infield 20B. As such, the browser applies a predefined security policy associated with the Restricted zone to each of the web sites associated with the domain identifiers displayed infield 20B. If the user wishes to add a web site to the Restricted zone, the user must type or otherwise manually enter the domain identifier into thefield 20A. - As the number of web sites that the user wishes to add to a zone increases, it should be appreciated that the task of employing a user interface, such as the
interface 10 ofFIG. 1 , to manually enter each associated domain identifier becomes increasingly nontrivial. Moreover, by the time the user decides to so restrict a web site, it is highly possible that the user has already suffered some negative effect from accessing the web site due to the user being previously unaware of the harmful nature of the web site. - In an embodiment of the invention, a machine-executable method implementable in a system operable to execute a browser application having at least one security-context zone and operable to apply at least one security policy to interaction between the system and web sites corresponding to domain identifiers populating the at least one security-context zone includes comparing a first set of domain identifiers populating a first security-context zone of the at least one security-context zone with a second set of domain identifiers. The method further includes populating the first security-context zone with at least one second-set identifier not included in the first set of domain identifiers.
- Preferred and alternative embodiments of the present invention are described in detail below with reference to the following drawings.
-
FIG. 1 illustrates a conventional user interface; -
FIG. 2 is a schematic view of an exemplary operating environment in which an embodiment of the invention can be implemented; -
FIG. 3 is a functional block diagram of an exemplary operating environment in which an embodiment of the invention can be implemented; -
FIG. 4 illustrates a user interface according to an embodiment of the invention; -
FIG. 5 illustrates a user interface according to an embodiment of the invention; and -
FIG. 6 is a flow diagram illustrating a method according to an embodiment of the invention. -
FIG. 2 illustrates an example of a suitablecomputing system environment 100 on which the invention may be implemented. Thecomputing system environment 100 is only one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality of the invention. Neither should thecomputing environment 100 be interpreted as having any dependency or requirement relating to any one or combination of components illustrated in theexemplary operating environment 100. - Embodiments of the invention are operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well known computing systems, environments, and/or configurations that may be suitable for use with the invention include, but are not limited to, personal computers, server computers, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.
- Embodiments of the invention may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
- With reference to
FIG. 2 , an exemplary system for implementing the invention includes a general purpose computing device in the form of acomputer 110. Components ofcomputer 110 may include, but are not limited to, aprocessing unit 120, asystem memory 130, and asystem bus 121 that couples various system components including the system memory to theprocessing unit 120. Thesystem bus 121 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. By way of example, and not limitation, such architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus also known as Mezzanine bus. -
Computer 110 typically includes a variety of computer readable media. Computer readable media can be any available media that can be accessed bycomputer 110 and includes both volatile and nonvolatile media, removable and non-removable media. By way of example, and not limitation, computer readable media may comprise computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can accessed bycomputer 110. Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of any of the above should also be included within the scope of computer readable media. - The
system memory 130 includes computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM) 131 and random access memory (RAM) 132. A basic input/output system 133 (BIOS), containing the basic routines that help to transfer information between elements withincomputer 110, such as during start-up, is typically stored inROM 131.RAM 132 typically contains data and/or program modules that are immediately accessible to and/or presently being operated on byprocessing unit 120. By way of example, and not limitation,FIG. 2 illustratesoperating system 134,application programs 135,other program modules 136, andprogram data 137. - The
computer 110 may also include other removable/non-removable, volatile/nonvolatile computer storage media. By way of example only,FIG. 2 illustrates ahard disk drive 140 that reads from or writes to non-removable, nonvolatile magnetic media, amagnetic disk drive 151 that reads from or writes to a removable, nonvolatilemagnetic disk 152, and anoptical disk drive 155 that reads from or writes to a removable, nonvolatileoptical disk 156 such as a CD ROM or other optical media. Other removable/non-removable, volatile/nonvolatile computer storage media that can be used in the exemplary operating environment include, but are not limited to, magnetic tape cassettes, flash memory cards, digital versatile disks, digital video tape, solid state RAM, solid state ROM, and the like. Thehard disk drive 141 is typically connected to thesystem bus 121 through an non-removable memory interface such asinterface 140, andmagnetic disk drive 151 andoptical disk drive 155 are typically connected to thesystem bus 121 by a removable memory interface, such asinterface 150. - The drives and their associated computer storage media discussed above and illustrated in
FIG. 2 , provide storage of computer readable instructions, data structures, program modules and other data for thecomputer 110. InFIG. 2 , for example,hard disk drive 141 is illustrated as storingoperating system 144,application programs 145,other program modules 146, andprogram data 147. Note that these components can either be the same as or different fromoperating system 134,application programs 135,other program modules 136, andprogram data 137.Operating system 144,application programs 145,other program modules 146, andprogram data 147 are given different numbers here to illustrate that, at a minimum, they are different copies. A user may enter commands and information into the computer 20 through input devices such as akeyboard 162 and pointingdevice 161, commonly referred to as a mouse, trackball or touch pad. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, or the like. These and other input devices are often connected to theprocessing unit 120 through auser input interface 160 that is coupled to the system bus, but may be connected by other interface and bus structures, such as a parallel port, game port or a universal serial bus (USB). Amonitor 191 or other type of display device is also connected to thesystem bus 121 via an interface, such as avideo interface 190. In addition to the monitor, computers may also include other peripheral output devices such asspeakers 197 andprinter 196, which may be connected through a outputperipheral interface 190. - The
computer 110 may operate in a networked environment using logical connections to one or more remote computers, such as aremote computer 180. Theremote computer 180 may be a personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to thecomputer 110, although only a memory storage device 181 has been illustrated inFIG. 2 . The logical connections depicted inFIG. 2 include a local area network (LAN) 171 and a wide area network (WAN) 173, but may also include other networks. Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets and the Internet. - When used in a LAN networking environment, the
computer 110 is connected to theLAN 171 through a network interface oradapter 170. When used in a WAN networking environment, thecomputer 110 typically includes amodem 172 or other means for establishing communications over theWAN 173, such as the Internet. Themodem 172, which may be internal or external, may be connected to thesystem bus 121 via theuser input interface 160, or other appropriate mechanism. In a networked environment, program modules depicted relative to thecomputer 110, or portions thereof, may be stored in the remote memory storage device. By way of example, and not limitation,FIG. 2 illustratesremote application programs 185 as residing on memory device 181. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used. - Referring now to
FIG. 3 , an embodiment of the present invention can be described in the context of an exemplarycomputer network system 200 as illustrated.System 200 includes anelectronic client device 210, such as a personal computer or workstation, that is linked via a communication medium, such as a network 220 (e.g., the Internet), to an electronic device or system, such as aserver 230. Theserver 230 may further be coupled, or otherwise have access, to adatabase 240 and acomputer system 260. Although the embodiment illustrated inFIG. 3 includes oneserver 230 coupled to oneclient device 210 via thenetwork 220, it should be recognized that embodiments of the invention may be implemented using one or more such client devices coupled to one or more such servers. - In an embodiment, each of the
client device 210 andserver 230 may include all or fewer than all of the features associated with thecomputer 110 illustrated in and discussed with reference toFIG. 3 .Client device 210 includes or is otherwise coupled to a computer screen ordisplay 250.Client device 210 can be used for various purposes including both network- and local-computing processes. - The
client device 210 is linked via thenetwork 220 toserver 230 so that computer programs, such as, for example, a browser, running on theclient device 210 can cooperate in two-way communication withserver 230.Server 230 may be coupled todatabase 240 to retrieve information therefrom and to store information thereto.Database 240 may include a plurality of different tables (not shown) that can be used byserver 230 to enable performance of various aspects of embodiments of the invention. Additionally, theserver 230 may be coupled to thecomputer system 260 in a manner allowing the server to delegate certain processing functions to the computer system. - An embodiment of the invention includes a first domain-
identifier file 270 and apopulating component 280, the functionality of which is discussed more fully hereinafter. At least portions of thecomponent 280 may be executed by theserver 230. Alternatively or additionally, at least portions of thecomponent 280 may be executed by thecomputer system 260. Alternatively or additionally, at least portions of thecomponent 280 may be executed by theclient device 210. The first domain-identifier file 270 and/orcomponent 280 may be implemented in any suitable hardware, software, firmware, or combination thereof. - Still referring to
FIG. 3 , and in operation according to an embodiment of the invention, a user (not shown) of theclient device 210 desiring to apply one or more security policies to one or more web sites uses a browser application running on the client device to access web content, which may, but need not, be served by theserver 230. Specifically, by employing an appropriate uniform resource locator (URL) in a known manner, the user may download from theserver 230 and install on theclient device 210 the first domain-identifier file 270 and/orcomponent 280. Alternatively, the user may receive the first domain-identifier file 270 and/orcomponent 280 on a tangible computer-readable medium (not shown), such as, for example, a CD-ROM, and subsequently install the file and/or component on theclient device 210 from the medium. - An embodiment of the invention, which may include the first domain-
identifier file 270 and/orcomponent 280, includes one or more user-interface components (not shown). As such, upon execution of an embodiment, a user interface including, for example, a window 300 (FIG. 4 ) may be presented to the user on a display device such asdisplay 250. In the illustrated embodiment, thewindow 300 includes a control-button panel 310, the buttons of which are selectable via a conventional “point-and-click” device, such as a mouse (not shown), and enable the user to control probe functionality of thecomponent 280 as described more fully hereinafter. - An embodiment of the
file 270 includes domain identifiers associated with web sites that have been analyzed and categorized according to their trustworthiness and, as such, the extent to which each is appropriate for a particular security zone. For example, thefile 270 may include a set of identifiers of sites appropriate for the “Restricted” zone (i.e., a zone having a more-restrictive policy than that of a zone having normal or average security requirements), a set of identifiers appropriate for a “Trusted” zone (i.e., a zone having a less-restrictive policy than that of a zone having normal or average security requirements), and/or sets of identifiers appropriate for respective ones of other zones of varying security requirements. The administrator of theserver 230 or the administrator of a site hosted by theserver 230 and from which theclient device 210 ultimately receives thefile 270 may make the determinations upon which such categorizations are based. These determinations may be made on an ongoing basis such that, periodically, a second domain-identifier file 290 (FIG. 3 ), and perhaps subsequent updated domain-identifier files (not shown) that include newly analyzed sites may be provided in a manner described above to theclient device 210 to supplement or supplant the first domain-identifier file 270. In alternative embodiments, the second domain-identifier file 290 and subsequent updated domain-identifier files may be manually downloaded by the user or automatically uploaded to theclient device 210. An embodiment allows users to submit web sites for review and automatic or manual inclusion in, for example, an updated domain-identifier file. Additionally, an embodiment enables a user to contact theserver 230 for a real-time evaluation of a site rather than relying on a static domain-identifier file. - In an embodiment, the user interface allows the user to choose a security zone (i.e., Restricted, Trusted, etc.) for which a probe shall be performed using the
window 300. Once the “Start Probe” button of thepanel 310 is selected, thecomponent 280 is operable to review the domain identifiers in thefile 270, and to determine whether those domain identifiers currently populate the selected zone (in the example illustrated inFIG. 4 , the Restricted zone) of the browser. In the illustrated embodiment, the status of this probe is displayed in astatus pane 320 of thewindow 300. Those identifiers in thefile 270 that do currently populate the zone are tallied into the total corresponding to the “Protected Sites Found” entry of thestatus pane 320. Those identifiers in thefile 270 that do not currently populate the zone are tallied into the total corresponding to the “Exposed Sites Found” entry of thestatus pane 320. Sites corresponding to those identifiers in thefile 270 that do not currently populate the zone may be displayed in a probe-results pane 330. After reviewing the sites listed in theresults pane 330, the user may select a populatebutton 340 of thewindow 300 to populate the zone with all of the sites displayed in theresults pane 330. In an embodiment, the user may, prior to selecting the populatebutton 340, select one or more of the sites listed in theresults pane 330 to be excluded from populating the zone. - Referring to
FIG. 5 , the user interface of an embodiment may include asettings page 400 that enables a user to customize the security policy that will be applied to web sites that have been made subject to a particular zone. As illustrated inFIG. 5 , the settings page may allow the user to enable/disable the ability of sites in the applicable zone to, for example, run ActiveX controls, script ActiveX controls, run Java Applets, etc. The user may enable/disable these settings by using settingbuttons 410 to toggle between or otherwise select the permission settings. -
FIG. 6 illustrates aprocess 600, according to an embodiment of the invention, that can be implemented in a system operable to execute a browser application having at least one security-context zone and operable to apply at least one security policy to interaction between the system and web sites corresponding to domain identifiers populating the a security-context zone. Theprocess 600 is illustrated as a set of operations shown as discrete blocks. Theprocess 600 may be implemented in any suitable hardware, software, firmware, or combination thereof. As such theprocess 600 may be implemented in computer-executable instructions that can be transferred from one computer, such asserver 230, to a second computer, such asclient device 210, via a communications medium, such asnetwork 220. The order in which the operations are described is not to be necessarily construed as a limitation. - At a
block 610, a first set of domain identifiers populating a first security-context zone is compared with a second set of domain identifiers. For example, the populatingcomponent 280 may review a set of domain identifiers in thefile 270 appropriate for the Restricted zone and determine whether those domain identifiers currently populate the Restricted zone of the browser. - At a
block 620, the first security-context zone is populated with at least one second-set identifier not included in the first set of domain identifiers. For example, as discussed above, sites corresponding to those identifiers in thefile 270 that do not currently populate the Restricted zone may be displayed in a probe-results pane 330. After reviewing the sites listed in theresults pane 330, the user may select a populatebutton 340 of thewindow 300 to populate the Restricted zone with all of the sites displayed in theresults pane 330. In an embodiment, the populatingcomponent 280 or other associated implementation may be operable to restrict the number of domain identifiers that can populate a given one or more of the zones and, as such, restrict the number of web sites to which a given one or more security policies are applied. - At a
block 630, a third set of domain identifiers populating a second security-context zone is compared with a fourth set of domain identifiers. For example, the populatingcomponent 280 may review a set of domain identifiers in thefile 270 appropriate for the Trusted zone and determine whether those domain identifiers currently populate the Trusted zone of the browser. - At a
block 640, the second security-context zone is populated with at least one fourth-set identifier not included in the third set of domain identifiers. For example, sites corresponding to those identifiers in thefile 270 that do not currently populate the Trusted zone may be displayed in a probe-results pane 330. After reviewing the sites listed in theresults pane 330, the user may select a populatebutton 340 of thewindow 300 to populate the Trusted zone with all of the sites displayed in theresults pane 330. - While a preferred embodiment of the invention has been illustrated and described, as noted above, many changes can be made without departing from the spirit and scope of the invention. Accordingly, the scope of the invention is not limited by the disclosure of the preferred embodiment. Instead, the invention should be determined entirely by reference to the claims that follow.
Claims (21)
1-21. (canceled)
22. A method for enhancing browser security, the method comprising:
receiving a first request to update a first set of domain identifiers associated with a first security-context of a browser, the first security-context being associated with at least a first security policy;
responsive to the first request, comparing the first set of domain identifiers with a second set of domain identifiers and updating the first set of domain identifiers to include at least one domain identifier in the second set that is not already in the first set of domain identifiers;
receiving a second request to update a third set of domain identifiers associated with a second security-context of the browser, the second security-context being associated with at least a second security policy;
responsive to the second request, comparing the third set of domain identifiers with a fourth set of domain identifiers and updating the third set of domain identifiers to include at least one domain identifier in the fourth set that is not already in the third set of domain identifiers; and
providing data for presentation by the browser in accordance with at least one of the first security-context and the second security-context,
wherein the first security policy is more restrictive than the second security policy.
23. The method of claim 22 , wherein the browser is a web site browser and the domain identifiers correspond to at least portions of web sites.
24. The method of claim 23 , wherein said at least portions of web sites associated with the first set of domain identifiers populate the first security-context of the web site browser and the first security policy applies to said at least portions of web sites associated with the first set of domain identifiers.
25. The method of claim 23 , wherein the first and second security policies control browser functionality that is able to be activated by said at least portions of web sites.
26. The method of claim 25 , wherein said at least portions of web sites under control of the more restrictive security policy are able to activate less browser functionality.
27. The method of claim 22 , wherein the browser comprises a user interface having at least one element configured at least to generate the first request when activated by a user.
28. The method of claim 22 , further comprising:
presenting, with a user interface of the browser, a list of domain identifiers in the second set that are not already in the first set of domain identifiers; and
receiving a selection of one or more of the list for inclusion in first set of domain identifiers.
29. A method for enhancing browser security, the method comprising:
receiving a first request to update a first set of domain identifiers associated with a first security-context of a first browser, the first security-context being associated with at least a first security policy;
responsive to the first request, sending a second request to obtain a second set of domain identifiers associated with the first security-context of the first browser;
responsive to the second request, receiving the second set of domain identifiers, the second set of domain identifiers including at least one domain identifier submitted for review by a browser user;
responsive to receiving the second set of domain identifiers, comparing the first set of domain identifiers with the second set of domain identifiers and updating the first set of domain identifiers to include at least one domain identifier in the second set that is not already in the first set of domain identifiers; and
providing data for presentation by the first browser in accordance with at least the first security-context.
30. The method of claim 29 , further comprising:
receiving a second request to update a third set of domain identifiers associated with a second security-context of the first browser, the second security-context being associated with at least a second security policy; and
responsive to the second request, comparing the third set of domain identifiers with a fourth set of domain identifiers and updating the third set of domain identifiers to include at least one domain identifier in the fourth set that is not already in the third set of domain identifiers,
wherein the first security policy is more restrictive than the second security policy.
31. The method of claim 29 , further comprising submitting said at least one domain identifier for review with a user interface of the first browser.
32. The method of claim 29 , wherein the first request to update the first set of domain identifiers is initiated by a first user of the first browser and said at least one domain identifier was submitted for review by at least a second user of at least a second browser.
33. The method of claim 29 , wherein said at least one domain identifier was manually reviewed and included in the second set of domain identifiers responsive to the submission for review by the browser user.
34. The method of claim 29 , wherein said at least one domain identifier was automatically reviewed and included in the second set of domain identifiers responsive to the submission for review by the browser user.
35. The method of claim 29 , wherein said at least one domain identifier is reviewed by a service located remotely from the first browser.
36. The method of claim 29 , wherein the second set of domain identifiers is received from a service located remotely from the first browser.
37. A method for enhancing browser security, the method comprising:
receiving a first request to update a first set of domain identifiers associated with a first security-context of a browser, the first security-context being associated with at least a first security policy, the first request including at least one domain identifier to be considered for inclusion in the update;
responsive to the first request, sending a second request to obtain a second set of domain identifiers associated with the first security-context of the browser, the second request including said at least one domain identifier to be considered for inclusion in the update;
responsive to the second request, receiving the second set of domain identifiers, the second set of domain identifiers including said at least one domain identifier considered and found suitable for inclusion in the update;
responsive to receiving the second set of domain identifiers, comparing the first set of domain identifiers with the second set of domain identifiers and updating the first set of domain identifiers to include said at least one domain identifier; and
providing data for presentation by the browser in accordance with at least the first security-context.
38. The method of claim 37 , wherein said at least one domain identifier to be considered for inclusion in the update is included in the first request with a user interface of the browser.
39. The method of claim 37 , wherein the second request is sent from the browser to a service configured at least to consider said at least one domain identifier for association with the first security-context.
40. The method of claim 37 , wherein the browser is one of a plurality of browsers and the plurality of browsers has a plurality of security-contexts including the first security-context.
41. The method of claim 40 , wherein inclusion of said at least one domain identifier in the update for the browser results in inclusion of said at least one domain identifier in updates associated with each of the plurality of browsers.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/205,821 US20120096511A1 (en) | 2005-10-14 | 2011-08-09 | Enhanced browser security |
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US72728805P | 2005-10-14 | 2005-10-14 | |
US80568306P | 2006-06-23 | 2006-06-23 | |
US11/549,812 US8020190B2 (en) | 2005-10-14 | 2006-10-16 | Enhanced browser security |
US13/205,821 US20120096511A1 (en) | 2005-10-14 | 2011-08-09 | Enhanced browser security |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/549,812 Continuation US8020190B2 (en) | 2005-10-14 | 2006-10-16 | Enhanced browser security |
Publications (1)
Publication Number | Publication Date |
---|---|
US20120096511A1 true US20120096511A1 (en) | 2012-04-19 |
Family
ID=38429913
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/549,812 Expired - Fee Related US8020190B2 (en) | 2005-10-14 | 2006-10-16 | Enhanced browser security |
US13/205,821 Abandoned US20120096511A1 (en) | 2005-10-14 | 2011-08-09 | Enhanced browser security |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/549,812 Expired - Fee Related US8020190B2 (en) | 2005-10-14 | 2006-10-16 | Enhanced browser security |
Country Status (1)
Country | Link |
---|---|
US (2) | US8020190B2 (en) |
Cited By (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2014052026A1 (en) * | 2012-09-27 | 2014-04-03 | Intel Corporation | Secure data container for web applications |
CN104423354A (en) * | 2013-09-05 | 2015-03-18 | 珠海格力电器股份有限公司 | Method and device for controlling equipment |
CN107103244A (en) * | 2017-05-12 | 2017-08-29 | 天津大学 | The appraisal procedure of Web application architecture securities based on AADL |
US11122013B2 (en) * | 2017-02-16 | 2021-09-14 | Emerald Cactus Ventures, Inc. | System and method for encrypting data interactions delineated by zones |
US11165751B2 (en) | 2017-02-16 | 2021-11-02 | Emerald Cactus Ventures, Inc. | System and method for establishing simultaneous encrypted virtual private networks from a single computing device |
US11165825B2 (en) | 2017-02-16 | 2021-11-02 | Emerald Cactus Ventures, Inc. | System and method for creating encrypted virtual private network hotspot |
Families Citing this family (22)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8020190B2 (en) * | 2005-10-14 | 2011-09-13 | Sdc Software, Inc. | Enhanced browser security |
US10015122B1 (en) | 2012-10-18 | 2018-07-03 | Sitting Man, Llc | Methods and computer program products for processing a search |
US20140172998A1 (en) * | 2012-12-16 | 2014-06-19 | Deep River Ventures, Llc | Methods, Systems, and Computer Program Products for Browsing Via a Communications Agent |
US10158590B1 (en) | 2010-07-09 | 2018-12-18 | Gummarus LLC | Methods, systems, and computer program products for processing a request for a resource in a communication |
US10212112B1 (en) | 2010-07-09 | 2019-02-19 | Gummarus LLC | Methods, systems, and computer program products for processing a request for a resource in a communication |
US10171392B1 (en) | 2010-07-09 | 2019-01-01 | Gummarus LLC | Methods, systems, and computer program products for processing a request for a resource in a communication |
US10419374B1 (en) | 2010-07-09 | 2019-09-17 | Gummarus, Llc | Methods, systems, and computer program products for processing a request for a resource in a communication |
US8671175B2 (en) * | 2011-01-05 | 2014-03-11 | International Business Machines Corporation | Managing security features of a browser |
AU2012100460B4 (en) | 2012-01-04 | 2012-11-08 | Uniloc Usa, Inc. | Method and system implementing zone-restricted behavior of a computing device |
AU2012100462B4 (en) | 2012-02-06 | 2012-11-08 | Uniloc Usa, Inc. | Near field authentication through communication of enclosed content sound waves |
US20150235215A1 (en) * | 2012-08-16 | 2015-08-20 | Tango Mobile, LLC | System and Method for Mobile or Web-Based Payment/Credential Process |
US10013158B1 (en) | 2012-09-22 | 2018-07-03 | Sitting Man, Llc | Methods, systems, and computer program products for sharing a data object in a data store via a communication |
US10021052B1 (en) | 2012-09-22 | 2018-07-10 | Sitting Man, Llc | Methods, systems, and computer program products for processing a data object identification request in a communication |
US10019135B1 (en) | 2012-10-18 | 2018-07-10 | Sitting Man, Llc | Methods, and computer program products for constraining a communication exchange |
US10033672B1 (en) | 2012-10-18 | 2018-07-24 | Sitting Man, Llc | Methods and computer program products for browsing using a communicant identifier |
CN103019734B (en) * | 2012-12-25 | 2016-08-03 | 北京奇虎科技有限公司 | A kind of activity object implementation, system and browser |
CN103019735B (en) * | 2012-12-25 | 2016-08-03 | 北京奇虎科技有限公司 | Execution method, system and the browser of browser moving object |
US10218767B2 (en) | 2012-12-25 | 2019-02-26 | Beijing Qihoo Technology Company Limited | Method, system and browser for executing active object of browser |
AU2013100355B4 (en) * | 2013-02-28 | 2013-10-31 | Netauthority, Inc | Device-specific content delivery |
US9680872B1 (en) | 2014-03-25 | 2017-06-13 | Amazon Technologies, Inc. | Trusted-code generated requests |
US9854001B1 (en) * | 2014-03-25 | 2017-12-26 | Amazon Technologies, Inc. | Transparent policies |
CN107885768B (en) * | 2017-09-27 | 2021-08-20 | 昆明理工大学 | User comment mining method for APP software use quality |
Citations (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6141778A (en) * | 1998-06-29 | 2000-10-31 | Mci Communications Corporation | Method and apparatus for automating security functions in a computer system |
US6208995B1 (en) * | 1997-11-24 | 2001-03-27 | International Business Machines Corporation | Web browser download of bookmark set |
US6211871B1 (en) * | 1997-11-21 | 2001-04-03 | International Business Machines Corporation | Named bookmark sets |
US6366912B1 (en) * | 1998-04-06 | 2002-04-02 | Microsoft Corporation | Network security zones |
US20050075115A1 (en) * | 2003-10-07 | 2005-04-07 | Accenture Global Services Gmbh. | Mobile provisioning tool system |
US20050073982A1 (en) * | 2003-10-07 | 2005-04-07 | Accenture Global Services Gmbh. | Connector gateway |
US20060041508A1 (en) * | 2004-08-20 | 2006-02-23 | Pham Quang D | Method and system for tracking fraudulent activity |
US20080162698A1 (en) * | 2003-12-10 | 2008-07-03 | Chirs Hopen | Rule-Based Routing to Resources through a Network |
US7398549B2 (en) * | 2001-05-18 | 2008-07-08 | Imprivata, Inc. | Biometric authentication with security against eavesdropping |
US7606821B2 (en) * | 2004-06-30 | 2009-10-20 | Ebay Inc. | Method and system for preventing fraudulent activities |
Family Cites Families (54)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5257020C1 (en) * | 1991-06-12 | 2002-08-13 | Fiber Optics Sales Co Inc | Variable message traffic signalling trailer |
US6212535B1 (en) * | 1996-09-19 | 2001-04-03 | Digital Equipment Corporation | Browser-based electronic messaging |
US5828839A (en) * | 1996-11-14 | 1998-10-27 | Interactive Broadcaster Services Corp. | Computer network chat room based on channel broadcast in real time |
US6115471A (en) * | 1996-11-28 | 2000-09-05 | Fujitsu Limited | Member-exclusive service system and method through internet |
US5987611A (en) * | 1996-12-31 | 1999-11-16 | Zone Labs, Inc. | System and methodology for managing internet access on a per application basis for client computers connected to the internet |
US6029245A (en) * | 1997-03-25 | 2000-02-22 | International Business Machines Corporation | Dynamic assignment of security parameters to web pages |
US6418466B1 (en) * | 1997-07-10 | 2002-07-09 | International Business Machines Corporation | Management of authentication discovery policy in a computer network |
US5974454A (en) * | 1997-11-14 | 1999-10-26 | Microsoft Corporation | Method and system for installing and updating program module components |
US6151708A (en) * | 1997-12-19 | 2000-11-21 | Microsoft Corporation | Determining program update availability via set intersection over a sub-optical pathway |
US6035423A (en) * | 1997-12-31 | 2000-03-07 | Network Associates, Inc. | Method and system for providing automated updating and upgrading of antivirus applications using a computer network |
US6430567B2 (en) * | 1998-06-30 | 2002-08-06 | Sun Microsystems, Inc. | Method and apparatus for multi-user awareness and collaboration |
US6175619B1 (en) * | 1998-07-08 | 2001-01-16 | At&T Corp. | Anonymous voice communication using on-line controls |
US6192394B1 (en) * | 1998-07-14 | 2001-02-20 | Compaq Computer Corporation | Inter-program synchronous communications using a collaboration software system |
US6473800B1 (en) * | 1998-07-15 | 2002-10-29 | Microsoft Corporation | Declarative permission requests in a computer system |
US6338094B1 (en) * | 1998-09-08 | 2002-01-08 | Webtv Networks, Inc. | Method, device and system for playing a video file in response to selecting a web page link |
US6487583B1 (en) * | 1998-09-15 | 2002-11-26 | Ikimbo, Inc. | System and method for information and application distribution |
US6411966B1 (en) * | 1998-09-21 | 2002-06-25 | Microsoft Corporation | Method and computer readable medium for DNS dynamic update to minimize client-server and incremental zone transfer traffic |
US6412073B1 (en) * | 1998-12-08 | 2002-06-25 | Yodiee.Com, Inc | Method and apparatus for providing and maintaining a user-interactive portal system accessible via internet or other switched-packet-network |
US7130831B2 (en) * | 1999-02-08 | 2006-10-31 | Copyright Clearance Center, Inc. | Limited-use browser and security system |
AU4061800A (en) | 1999-04-01 | 2000-10-23 | Multitude, Inc. | Apparatus and method for creating audio forums |
US6515681B1 (en) * | 1999-05-11 | 2003-02-04 | Prophet Financial Systems, Inc. | User interface for interacting with online message board |
US6442590B1 (en) * | 1999-05-27 | 2002-08-27 | Yodlee.Com, Inc. | Method and apparatus for a site-sensitive interactive chat network |
US6606657B1 (en) * | 1999-06-22 | 2003-08-12 | Comverse, Ltd. | System and method for processing and presenting internet usage information |
US6510458B1 (en) | 1999-07-15 | 2003-01-21 | International Business Machines Corporation | Blocking saves to web browser cache based on content rating |
US6708276B1 (en) * | 1999-08-03 | 2004-03-16 | International Business Machines Corporation | Architecture for denied permissions in Java |
WO2001018693A2 (en) | 1999-09-09 | 2001-03-15 | Shoptok, Inc. | Internet message board forwarding system |
US20040172415A1 (en) * | 1999-09-20 | 2004-09-02 | Messina Christopher P. | Methods, systems, and software for automated growth of intelligent on-line communities |
US6434599B1 (en) * | 1999-09-30 | 2002-08-13 | Xoucin, Inc. | Method and apparatus for on-line chatting |
US20020002586A1 (en) * | 2000-02-08 | 2002-01-03 | Howard Rafal | Methods and apparatus for creating and hosting customized virtual parties via the internet |
US6532477B1 (en) * | 2000-02-23 | 2003-03-11 | Sun Microsystems, Inc. | Method and apparatus for generating an audio signature for a data item |
US6691159B1 (en) * | 2000-02-24 | 2004-02-10 | General Electric Company | Web-based method and system for providing assistance to computer users |
US20020026572A1 (en) * | 2000-08-31 | 2002-02-28 | Rafael Joory | Reconfiguration incident to enabling an application access to setup information therefor |
US20020029245A1 (en) * | 2000-09-05 | 2002-03-07 | Yuval Nahon | System and method for directing shared data |
US7000107B2 (en) * | 2000-09-30 | 2006-02-14 | Microsoft Corporation | System and method for using dynamic web components to remotely control the security state of web pages |
US7912752B2 (en) * | 2000-10-31 | 2011-03-22 | Context Web, Inc. | Internet contextual communication system |
US7191252B2 (en) * | 2000-11-13 | 2007-03-13 | Digital Doors, Inc. | Data security system and method adjunct to e-mail, browser or telecom program |
US7185197B2 (en) * | 2000-12-08 | 2007-02-27 | Itt Manufacturing Enterprises, Inc. | Method and apparatus to facilitate secure network communications with a voice responsive network interface device |
US6510488B2 (en) * | 2001-02-05 | 2003-01-21 | M-Systems Flash Disk Pioneers Ltd. | Method for fast wake-up of a flash memory system |
US7318238B2 (en) * | 2002-01-14 | 2008-01-08 | Microsoft Corporation | Security settings for markup language elements |
US6850255B2 (en) * | 2002-02-28 | 2005-02-01 | James Edward Muschetto | Method and apparatus for accessing information, computer programs and electronic communications across multiple computing devices using a graphical user interface |
US7069318B2 (en) * | 2002-03-27 | 2006-06-27 | International Business Machines Corporation | Content tracking in transient network communities |
US7305436B2 (en) * | 2002-05-17 | 2007-12-04 | Sap Aktiengesellschaft | User collaboration through discussion forums |
US6691155B2 (en) * | 2002-06-20 | 2004-02-10 | Linda Gottfried | Multimedia system for sharing brand information keeps history of modifications of production information by consumers to allow recreating multimedia interface in its previous formats |
US20040098467A1 (en) * | 2002-11-15 | 2004-05-20 | Humanizing Technologies, Inc. | Methods and systems for implementing a customized life portal |
US20040254832A1 (en) * | 2003-06-12 | 2004-12-16 | Michael Harkin | Integrated browser plug-in and user defined database |
US20050114625A1 (en) * | 2003-09-16 | 2005-05-26 | Domonic Snyder | Processing device security setting configuration system and user interface |
GB2412189B (en) * | 2004-03-16 | 2007-04-04 | Netcraft Ltd | Security component for use with an internet browser application and method and apparatus associated therewith |
US7373505B2 (en) * | 2004-04-15 | 2008-05-13 | Microsoft Corporation | Displaying a security element with a browser window |
US7827294B2 (en) * | 2004-05-06 | 2010-11-02 | American Express Travel Related Services Company, Inc. | System and method for dynamic security provisioning of computing resources |
US7877786B2 (en) * | 2004-10-21 | 2011-01-25 | Alcatel-Lucent Usa Inc. | Method, apparatus and network architecture for enforcing security policies using an isolated subnet |
US8074272B2 (en) * | 2005-07-07 | 2011-12-06 | Microsoft Corporation | Browser security notification |
US8020190B2 (en) * | 2005-10-14 | 2011-09-13 | Sdc Software, Inc. | Enhanced browser security |
US8375120B2 (en) * | 2005-11-23 | 2013-02-12 | Trend Micro Incorporated | Domain name system security network |
US8520850B2 (en) * | 2006-10-20 | 2013-08-27 | Time Warner Cable Enterprises Llc | Downloadable security and protection methods and apparatus |
-
2006
- 2006-10-16 US US11/549,812 patent/US8020190B2/en not_active Expired - Fee Related
-
2011
- 2011-08-09 US US13/205,821 patent/US20120096511A1/en not_active Abandoned
Patent Citations (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6211871B1 (en) * | 1997-11-21 | 2001-04-03 | International Business Machines Corporation | Named bookmark sets |
US6208995B1 (en) * | 1997-11-24 | 2001-03-27 | International Business Machines Corporation | Web browser download of bookmark set |
US6366912B1 (en) * | 1998-04-06 | 2002-04-02 | Microsoft Corporation | Network security zones |
US6141778A (en) * | 1998-06-29 | 2000-10-31 | Mci Communications Corporation | Method and apparatus for automating security functions in a computer system |
US7398549B2 (en) * | 2001-05-18 | 2008-07-08 | Imprivata, Inc. | Biometric authentication with security against eavesdropping |
US20050075115A1 (en) * | 2003-10-07 | 2005-04-07 | Accenture Global Services Gmbh. | Mobile provisioning tool system |
US20050073982A1 (en) * | 2003-10-07 | 2005-04-07 | Accenture Global Services Gmbh. | Connector gateway |
US20080162698A1 (en) * | 2003-12-10 | 2008-07-03 | Chirs Hopen | Rule-Based Routing to Resources through a Network |
US7606821B2 (en) * | 2004-06-30 | 2009-10-20 | Ebay Inc. | Method and system for preventing fraudulent activities |
US20060041508A1 (en) * | 2004-08-20 | 2006-02-23 | Pham Quang D | Method and system for tracking fraudulent activity |
Cited By (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2014052026A1 (en) * | 2012-09-27 | 2014-04-03 | Intel Corporation | Secure data container for web applications |
CN104603793A (en) * | 2012-09-27 | 2015-05-06 | 英特尔公司 | Secure data container for web applications |
US9245144B2 (en) | 2012-09-27 | 2016-01-26 | Intel Corporation | Secure data container for web applications |
CN104423354A (en) * | 2013-09-05 | 2015-03-18 | 珠海格力电器股份有限公司 | Method and device for controlling equipment |
US11122013B2 (en) * | 2017-02-16 | 2021-09-14 | Emerald Cactus Ventures, Inc. | System and method for encrypting data interactions delineated by zones |
US11165751B2 (en) | 2017-02-16 | 2021-11-02 | Emerald Cactus Ventures, Inc. | System and method for establishing simultaneous encrypted virtual private networks from a single computing device |
US11165825B2 (en) | 2017-02-16 | 2021-11-02 | Emerald Cactus Ventures, Inc. | System and method for creating encrypted virtual private network hotspot |
CN107103244A (en) * | 2017-05-12 | 2017-08-29 | 天津大学 | The appraisal procedure of Web application architecture securities based on AADL |
Also Published As
Publication number | Publication date |
---|---|
US8020190B2 (en) | 2011-09-13 |
US20070199073A1 (en) | 2007-08-23 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US8020190B2 (en) | Enhanced browser security | |
US7945681B2 (en) | Clipboard data modifications system and method for controlling remote communications | |
US9276929B2 (en) | Method and apparatus for multi-domain authentication | |
US11272030B2 (en) | Dynamic runtime interface for device management | |
US8667578B2 (en) | Web management authorization and delegation framework | |
US7571459B2 (en) | System and method for zone transition mitigation with relation to a network browser | |
US8606889B2 (en) | Roaming application settings across multiple computing devices | |
US8701173B2 (en) | System and method for providing silent sign on across distributed applications | |
US20030065951A1 (en) | Information providing server, terminal apparatus, control method therefor, and information providing system | |
US7334039B1 (en) | Techniques for generating rules for a dynamic rule-based system that responds to requests for a resource on a network | |
US20050210285A1 (en) | System and method for intelligent recommendation with experts for user trust decisions | |
US8799355B2 (en) | Client server application manager | |
US20070233686A1 (en) | Isolated access to named resources | |
KR20060134925A (en) | Methods and apparatus for scalable secure remote desktop access | |
US20230342497A1 (en) | Computer device and method for managing privilege delegation | |
US7950000B2 (en) | Architecture that restricts permissions granted to a build process | |
US7383326B1 (en) | Methods and computer systems for directing a client to network locations for network hosted services | |
WO2008002331A2 (en) | Enhanced browser security | |
US20080282258A1 (en) | Sharing the common session between two applications on the same server | |
CN112507253A (en) | H5-based windows-like system and login method | |
CN114065256A (en) | Permission-based page browsing method, service system and electronic equipment | |
KR20040098894A (en) | Thin-client system and management method using the same |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |