US20120102544A1 - Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications - Google Patents
Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications Download PDFInfo
- Publication number
- US20120102544A1 US20120102544A1 US13/340,692 US201113340692A US2012102544A1 US 20120102544 A1 US20120102544 A1 US 20120102544A1 US 201113340692 A US201113340692 A US 201113340692A US 2012102544 A1 US2012102544 A1 US 2012102544A1
- Authority
- US
- United States
- Prior art keywords
- mobile device
- internet
- content
- operable
- server
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/102—Entity profiles
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/2866—Architectures; Arrangements
- H04L67/30—Profiles
- H04L67/306—User profiles
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
- H04W80/08—Upper layer protocols
- H04W80/12—Application layer protocols, e.g. WAP [Wireless Application Protocol]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2149—Restricted operating environment
Definitions
- the methods and systems described here implement techniques for controlling, filtering, and monitoring the access of mobile phones to content from the Internet.
- internet activity of a mobile phone associated with a user profile is managed.
- a request for content is received from the mobile phone.
- the request is processed to determine if the requested content is a valid content accessible by the mobile phone associated with the user profile.
- the request for content by the mobile phone associated with the user profile is responded to by acting as an intermediary for the content to the mobile phone if access to the content is allowed for the user profile and sending an error message to the mobile phone if access to the content is not allowed for the user profile.
- the request for content can be received from a mobile browser executing on the mobile phone.
- the request for content is formatted using a communication protocol comprising a hypertext transfer protocol (HTTP), a secure hypertext transfer protocol (HTTPS), a user datagram protocol, and a file transfer protocol (FTP).
- HTTP hypertext transfer protocol
- HTTPS secure hypertext transfer protocol
- FTP file transfer protocol
- the request for content can also be received as a uniform resource locator (URL) using HTTP.
- URL uniform resource locator
- Only valid protocol exchanges originating from the mobile phone are authorized.
- a limit on a total number of downloads allowed over a period of time for the mobile phone associated with the user profile may be set or turned off.
- the downloads allowed can include text, pictures, games, news feeds, and ring tones.
- a monetary download limit based on usage or accumulation can also be set.
- a limit on a total number of non-verbal communication instances authorized over a period of time for the mobile phone associated with the user profile can also be set or turned off.
- the non-verbal communication can include short message service (SMS) and instant messaging (IM).
- Implementations can also include one or more of the following additional features: For example, Content filtering can be implemented to identify and block access to internet sites deemed not authorized for the mobile phone associated with the user profile.
- the internet sites deemed not authorized can include internet sites containing sexually explicit content, adult content, content inappropriate for the workplace.
- Content filtering can be implemented to compare a request to access an internet site against data in a master database.
- the master database can include a list of frequently accessed sites, protocols, and computer applications. Wireless application protocol sites and other downloadable internet sites can be added to the master database. Presence of viruses can be detected to prevent infection of the mobile phone.
- implementations can also include one or more of the following additional features: For example, the internet activity of the mobile phone associated with the user profile can be monitored to create a report including a list of wireless application protocol sites accessed, downloads obtained, and time spent interacting with online activities is generated.
- Policies for managing internet activity on the mobile phone can be set. Setting the policies can include designating internet websites and contents as either authorized or unauthorized for mobile phone associated with the user profile. Communication between the mobile phone and a carrier server can be mediated to enforce access control and security.
- internet activity for the mobile phone associated with the user profile can be customized. Customizing the internet activity includes selecting authorized internet sites; setting download limits; and setting time limits of the internet activity.
- FIG. 1 is a system drawing and a protocol according to an embodiment.
- FIG. 2A is a flow chart describing a process of controlling, monitoring, and filtering internet activity according to an embodiment.
- FIG. 2B is a block diagram describing a list of possible functions available in the process of controlling, monitoring, and filtering internet activity.
- FIG. 3 depicts a system overview according to an embodiment.
- FIG. 4 depicts a system architecture according to an embodiment with the system infrastructure hosted within a carrier.
- FIG. 5 depicts a system architecture according to an embodiment with the system infrastructure hosted external to a carrier.
- a system 10 is implemented to regulate communication 126 between a server 110 and a mobile phone 100 as shown in FIG. 1A .
- the server 110 is responsible for controlling, filtering, and monitoring Internet activity on the mobile phone.
- a user may send requests to the server 110 from the mobile phone 100 for documents and other files accessible from the Internet.
- the server 110 can be a web server and includes at least a central processing unit (“CPU”) 112 , a memory unit 116 , a storage device 118 , and a communication interface 120 .
- Server 110 can also be implemented as a proxy server, or intermediary between another server.
- the server 110 may be compatible with various platforms including Microsoft WindowsTM, Sun Microsystem SunTM, open source Linux, and other suitable platforms. Depending on the platform, an appropriate operating system 114 is executed by the CPU 112 .
- the memory unit 116 may be a volatile memory including various types of random access memory (“RAM”) such as dynamic RAM (“DRAM”), synchronous DRAM (“SDRAM”), double data rate SDRAM (“DDR”), synchronous graphics RAM (“SDRAM”), and video RAM (“VRAM”).
- the memory unit 116 may also be a non-volatile memory including read only memory (“ROM”), flash memory, and programmable memory such as erasable programmable ROM (“EPROM”) and electrically erasable programmable ROM (“EEPROM”).
- the storage device 118 may be a portable or removable memory including a compact disk ROM (“CDROM”), a tape, and a hard drive.
- the memory unit 116 and/or the storage device 118 may be implemented to store the requests received from the mobile phone 100 .
- the communication interface 120 may be configured to receive requests as data packets from the mobile phone 100 and to forward the requests to the CPU 112 for processing.
- the requests C 1 may be formatted in a compatible mobile device that can include communication protocols such as Hypertext Transfer Protocol (“HTTP”), Secure Hypertext Transfer Protocol (“HTTPS”), File Transfer Protocol (“FTP”), Simple Mail Transfer Protocol (“SMTP”), Post Office Protocol (“POP”), or other suitable communication protocols.
- HTTP Hypertext Transfer Protocol
- HTTPS Secure Hypertext Transfer Protocol
- FTP File Transfer Protocol
- SMTP Simple Mail Transfer Protocol
- POP Post Office Protocol
- the requests may be in the form of a Universal Resource Locator (“URL”) using HTTP.
- Processing the requests C 1 can include a log-on validation intrinsic to the mobile device, associated enterprise or user to ensure that the mobile phone 100 associated with a user profile is authorized to access the server.
- URL Universal Resource Locator
- the requests C 1 are further processed by the CPU 112 to determine if the content specified by the requests C 1 is accessible by the mobile phone 100 associated with the user profile. If the requests C 1 are for authorized content, the content is either retrieved and forwarded to the mobile phone 100 in a reply signal S 1 , or an authorization is made to the mobile device (e.g., a key) so that the content can be requested directly. If the requested content is unauthorized, an error message is forwarded in the reply signal 51 .
- the server 110 may also be communicatively linked to multiple databases 122 , 124 used in validating the requests C 1 .
- FIG. 2 is a flow chart describing a process 200 of controlling, monitoring, and filtering Internet access on the mobile phone 100 .
- the server 110 receives the request C 1 for content from the mobile phone 100 .
- the request C 1 is forwarded to the CPU 112 for processing at 212 .
- the user profile associated with the mobile phone 100 is validated to determine if the mobile phone represents an authorized user at 216 . If the user is not authorized, an error message is returned to the mobile phone 100 at 214 . If the mobile phone represents a valid user, the request C 1 is further processed at 218 .
- the server 110 can interact with a back-end database 122 for file system that contains a categorized listing of domain names, sub-domain names, websites, keywords, and/or individual files.
- the server 110 will also interact with a back-end database 124 that contains a categorized listing of user, carrier, or enterprise settings that allow or disallow access by the particular mobile phone 100 communicating with the server 110 to a particular domain name, sub-domain name, website, keyword, and/or individual file.
- the request C 1 is determined to be valid, the content requested can be retrieved with the server acting as a proxy, and transmitted to the mobile phone 100 at 222 . However, if the requested content is not accessible for the mobile phone 100 , an error message is transmitted to the mobile phone 100 at 214 .
- Processing the request at 222 can further include additional functions to control and manage the Internet activity on the mobile phone 100 .
- FIG. 2B describes possible functions executed at 222 .
- the system 10 can be implemented to manage and limit the server 110 from responding to the requests C 1 from the mobile phone 100 at 226 .
- the system 10 can allow users to place limits on the number of downloads over a specific period of time.
- the downloads can include text, pictures, games, news feeds, ring tones, applications, and other content available from the Internet.
- the system 10 can allow an administrator to place limits on the number of non-verbal communications over a specific period of time.
- Non-verbal communications may include Short Message Service (“SMS”) text messaging and Instant Messaging (“IM”). Users can also choose to turn off downloads and SMS/IM messaging.
- SMS Short Message Service
- IM Instant Messaging
- Each of the functions in process request 222 (monitor usage 224 , manage request 226 , filter content 228 , and virus detection 230 ) references another data source such as user/policy lists, virus lists, spammer or white/black lists, web site lists, and other suitable data sources for completing the functions.
- monetary download limits can be implemented to facilitate simplification of user account management.
- the system 10 can be implemented to control the incremental expenditures associated with a subscriber's mobile phone 100 on a usage or accumulation basis. This can help minimize frivolous personal use of the mobile phone 100 and simplify management of monthly expenses.
- An administrator may be allowed to place limits on non-verbal use of the mobile phone 100 to restrict undesirable or excess WAP resources.
- the system 10 can be implemented to perform content filtering at 228 .
- the system 10 can also be implemented to identify and block access to Internet sites containing content that may be offensive or otherwise not allowed or desired at home or at the workplace.
- the system 10 can block access to Internet sites containing sexually explicit or other material deemed inappropriate at the workplace.
- the system 10 may identify and block access to Internet sites containing content other than adult content that may be offensive or not allowed for certain users.
- the system 10 may take advantage of a master database (not shown) for filtering content and managing Internet use.
- the database can include a list of the frequently accessed Internet sites, communication protocols, and computer applications on the Web. Furthermore, it can include multiple lists, one each for web sites, spammers, viruses, and other suitable data used for filtering content and managing Internet use.
- a single master database can be used to store and manage all information related to the multiple lists described above.
- the master database can include multiple databases, with each database used to store and manage different types of information, including additional security provisioning. For example, a first database can be used to store and manage the list of frequently accessed Internet sites; a second database can be used to store and manage communication protocols; and a third database can be used to store and manage computer applications on the Web. In still other implementations, WAP sites and other downloadable locations can be added to the database.
- the system 10 can also be implemented to include virus detection at 230 . Downloading content from Internet sites may leave the mobile phone 100 susceptible to infections from viruses. The danger from viral infection is greater when downloading from Internet sites outside the approved locations.
- the system 10 can include virus detection capabilities to help prevent infection of the user's mobile phone 100 .
- the system 10 can also be implemented to monitor Internet activity on the mobile phone 100 at 224 .
- the system 10 can provide a report including information about the use of the mobile phone 100 in connection with the requests made to the server 110 .
- This report can include WAP sites visited, downloads obtained, and time spent interacting with online activities such as games.
- the system 10 can be implemented to allow a company to regulate unproductive and undesired mobile phone usage by its employees by limiting or denying inappropriate downloads.
- the system 10 can also be implemented to allow an enterprise to control which WAP web sites can be accessed by its employees and to limit the time that employees can surf or access these sites.
- WAP web sites can be accessed by its employees and to limit the time that employees can surf or access these sites.
- the system 10 can be implemented in a consumer environment to provide parents the ability to control, filter, and monitor internet activity on their children's mobile phones 100 .
- the system 10 may be implemented to allow parents to control costs as well as the types of content accessed by their children.
- the techniques can be implemented to design a system to focus on scanning Internet traffic and requests for content, determining the type of request being made, and then using information corresponding to the determined request type to decide which one of multiple adaptors to send the request.
- Each adaptor can be designed to process specific types of request for content.
- the adaptor can then interface with off-the-shelf databases or lists of: categorized websites; viruses; SPAM white/black lists; categorized list of carrier-hosted applications; and a carrier's user database for profiles and options.
- off-the-shelf virus lists can be used.
- This design flexibility allows a carrier or an enterprise to decide who can make the best-of-breed lists for each category, and allows for easy removal or replacement of the lists.
- the carrier's customer profile can specify content restriction policy such as no pornography and no hacking.
- content restriction policy such as no pornography and no hacking.
- the request is sent to the appropriate adaptor, with the information that no pornography is allowed and no hacking is allowed.
- the URL request is referenced against a database (which can be an off-the-shelf database rented or licensed from a vendor) to determine if the request is in the pornography category. The result of the determination is used to decide whether the request should be served or refused.
- logical filters can be implemented to dynamically scan all requests and determine the likely category for each request. Either of the two options can be implemented via the adaptor.
- FIG. 3 illustrates a system upon which an embodiment of the current invention may be implemented.
- Mobile Phone 100 is a device capable of transmitting, receiving, and accessing voice and data information.
- Mobile Phone 100 also contains a mobile browser (not shown) used to access content on the Internet.
- Such Internet content can be in the form of web pages, downloadable applications, or downloadable ring tones, wall papers, screen savers, and other content accessible on the Internet.
- the web pages can be documents written in HyperText Markup Language (“HTML”), Extensible HyperText Markup Language (“XHTML”), Java, Active Server Pages (“ASP”), Hypertext Preprocessor (“PHP”), Wireless Markup Language (“WML”), or other suitable programming platforms.
- the applications can be executable binaries compatible with the Mobile Phone 100 written in JAVA, BREW, Symbian, or other suitable programming platforms.
- the downloadable ring tones, wall papers, screen savers, etc. can be files of any audio or video format that can be displayed by the Mobile Phone 100 .
- the Mobile Phone 100 may access content on the Internet through a Transmissions System 301 .
- the Transmission System 301 is a communications system capable of transmitting and receiving voice and data information passing between the Mobile Phone 100 and a Wireless Application Protocol Proxy (“WAP Proxy”) 302 .
- the Transmission System 301 may include cellular phone networks, transmission towers, and other suitable mobile communication networks.
- the cellular phone networks or MVNOs may be compatible with GSM or CDMA supporting CDMA 2000, 3G, GPRS, and EDGE networks.
- WAP Proxy 302 is used for encoding and decoding requests for content from the Mobile Phone 100 and content sent to the Mobile Phone 100 .
- the content sent to the Mobile Phone 100 includes content generated in response to a request for content from the Mobile Phone 100 . Examples of such content are web pages, downloadable applications, or downloadable ring tones, wall papers, screen savers, etc.
- WAP Proxy 302 is also used for optimizing communication to and from the Mobile Phone 100 .
- the WAP Proxy 302 passes the request for content from the Mobile Phone 100 to a Carrier Server 303 , which is used by carriers to check user accounts, log user activity, and allow or disallow access to the Internet.
- the Carrier server 303 relies on a Customer Database 304 for information related to these activities.
- the Customer Database 304 contains customer account information such as names, telephone numbers, addresses, and profiles among others. This information can be in any known database format.
- proprietary carrier architectures tied into proprietary billing systems can be implemented to process and store billing and customer records.
- the Carrier Server 303 also passes the request for content to a Mobile Device Server 305 .
- the Mobile Device Server 305 is used to control user access to domain names, sub-domain names, websites, and/or individual files. This control is achieved based on information stored in the Customer Database 304 and a Mobile Device Database 306 .
- the Customer Database 304 may include carrier's user database for storing and managing customer profiles and options. Such information is passed to the Mobile Device Server 305 in response to a request for such information by the Carrier Server 303 or the Mobile Device Server 305 .
- the Mobile Device Database 306 contains various content identifiers such as approved and disapproved content.
- the Mobile Device Database 306 may further categorize or authorize sub-portions or groupings of data in Filter Adaptor 514 (Further described with reference to FIG. 5 ).
- the Mobile Device Database 306 can include a categorization of domain names, sub-domain names, websites, keywords, and/or individual files.
- the Mobile Device Database 306 can also include a list of categorized Internet websites based on content and/or meta data describing and/or associated with the website or individual webpage. This information can be in any known database format.
- the categorizations can be based on content topic such as adult, sports, news, or other content topics or types.
- the Mobile Device Database 306 can further include lists of viruses, SPAM, while/black lists, and a categorized list of carrier-hosted applications.
- the Mobile Device Database 306 can be an off-the-shelf database.
- the Mobile Device Server 305 also contains software that monitors and stores the activity of the user (not shown) of the Mobile Phone 100 . This information can be logged and stored on the Mobile Device Server 305 , the Customer Database 304 , or elsewhere.
- the Mobile Device Server 305 If the Mobile Device Server 305 does not authorize a request by the Mobile Phone 100 , it returns an error message to the Mobile Phone 100 . If the Mobile Device Server 305 does authorize a request by the Mobile Phone 100 , the authorized request is passed to a Firewall 307 .
- the Firewall 307 controls access to the Internet 308 from within the carrier network and also restricts unauthorized incoming traffic from the Internet 308 to the carrier network.
- the severs on the Internet 308 relay the request from the Firewall 307 to a Website 309 .
- the connection between the Firewall 307 and Website 309 can be direct or indirect.
- the Website 309 contains the content requested by the Mobile Phone 100 .
- the Website 309 can be information stored on a server (not shown) that is connected to the Internet 308 and the server may accept external requests for information such as the Website 309 .
- the Website 309 transfers the information requested by the Mobile Phone 100 to the Firewall 307 .
- the information is relayed to the Firewall 307 through the Internet 308 .
- the Firewall 307 passes the requested information to the Mobile Device Server 305 .
- the Mobile Device Server 305 passes the requested information to the Carrier Server 303 .
- the Carrier Server 303 passes the requested information to the WAP Proxy 302 .
- the WAP Proxy 302 passes the information to the Transmissions System 301 .
- the Transmissions System 301 then transmits the information to the Mobile Phone 100 .
- the Mobile Phone 100 is a device capable of transmitting, receiving, and accessing voice and data information.
- the Mobile Phone 100 must be activated and have data and voice access capabilities.
- the Mobile Phone 100 may be implemented to establishes a data call through the Transmissions System 301 and connect to the WAP Proxy 302 .
- the request and transmission process starts when the Mobile Phone 100 generates a request over the air to access a particular URL or to download a particular file.
- This request may normally be made using a mobile browser on the Mobile Phone 100 .
- the request may also be generated as an HTTP, User Datagram Protocol (“UDP”), socket, or any other suitable protocol request that use a URL.
- UDP User Datagram Protocol
- the WAP proxy 302 receives the request through the Transmission System 301 and translates the request.
- the translated request is passed onto the Carrier Server 303 .
- the Carrier Server 303 sends a request to the Customer Database 304 to send information contained in the user profile associated with the Mobile Phone 100 or with the current user of the Mobile Phone 100 .
- the Carrier Server 303 then validates access to the requested data service for the mobile phone account associated with Mobile Phone 100 or with the current user of Mobile Phone 100 . If access to the requested data service is not allowed, a service denied response is sent through the WAP Proxy 302 to Mobile Phone 100 , and the process starts over again. If access to the requested data service is allowed, the URL is passed to the Mobile Device Server 305 .
- the Mobile Device Server 305 searches for the requested URL (or a portion of the URL or request) in the Mobile Device Database 306 . If found, the requested URL may be retrieved along with its category or any other meta data associated with the requested URL. Next, the Mobile Device Server 305 tries to match the category or other meta data of the requested URL against the categories or other meta data permitted to Mobile Phone 100 or the current user of Mobile Phone 100 based on the profile information contained in the customer database 304 .
- the Mobile Device Server 305 also logs the activity associated with browsing and/or website interaction and meta data associated with the applications and/or content that is accessed in the Mobile Device Database 306 .
- the URL request is sent to the Firewall 307 .
- the Firewall 307 then routes the URL request over the Internet 308 to the Website 309 , the ultimate destination of the URL request initiated by the Mobile Phone 100 .
- Website 309 attempts to redirect the user to another site or the user goes to another site by means of clicking on a hyperlink, selecting a bookmark, entering a new URL or other, the process can start over and the new URL is evaluated.
- the systems and methods described herein can be performed by one or more programmable processors executing programmed instructions to perform functions by operating on input data and generating an output.
- the methods can also be performed by, and the systems can be implemented as, special purpose logic circuitry. Examples of such special purpose logic circuitry include a Field Programmable Gate Array (“FPGA”), a Complex Programmable Logic Device (“CPLD”, an Application Specific Integrated Circuit (“ASIC”), or flash memory.
- FPGA Field Programmable Gate Array
- CPLD Complex Programmable Logic Device
- ASIC Application Specific Integrated Circuit
- processors suitable for the execution of programmed instructions include, by way of example, both general and special purpose microprocessors. Generally, a processor will receive instructions and data from a read only memory (“ROM”) or a random access memory (“RAM”) or both. Information carriers suitable for embodying programmed instructions and data include, by way of example, semiconductor memory devices such as EPROM, EEPROM, and flash memory devices. The processor and the memory can be supplemented by, or incorporated in special purpose logic circuitry.
- connections between the processors and other hardware used to execute programmed instructions include both wired and wireless connections.
- wired connections include Ethernet networks, Token Ring networks, phone lines, and other network connections.
- wireless connections include wireless networks according to the protocols established by the IEEE 802.11a, 802.11b, and 802.11g standards.
- FIG. 4 depicts a system architecture according to an embodiment with the system infrastructure hosted within a carrier. Both the hardware, described with reference to FIG. 3 and software stack 400 for Mobile Device server 305 are depicted.
- FIG. 4 includes an application distribution system 410 , which is a server that functions to distribute and, in some instances, balance the work through the distributed intranet or virtually private network associated with a large corporation.
- the application distribution system 410 allows a corporation to remotely access and update their users' information and make this data available for incorporation into the carrier's user/customer database, interacting with the carrier server 303 .
- the Mobile Device server 305 can provide the means to control and/or monitor mobile applications and data transfer through following features: (1) allowing/disallowing access to carrier-sponsored applications (e.g., Java, BREW, and Symbian); (2) content filtering of WAP data to prevent inappropriate access and/or desktop end-around; (3) virus/spyware/peer-to-peer (“P2.pi.”) network management and detection to prevent network and phone damage; (4) short message service (“SMS”)/spam/instant messaging (“IM”)/spam over instant messaging (“SPIM”) detection and filtering to prevent nuisance and maintain customer satisfaction; (5) digital rights management (“DRM”)/P2P network management to minimize significant carrier exposure to IP protection issues; and (6) account management to set monetary limits on data use and purchases for customer convenience and ease of payment collection for the carrier.
- the software stack 400 can be implemented to carry out at least some of the features described above and will be discussed further in connection with the system infrastructure within an enterprise.
- FIG. 5 depicts a system architecture according to an embodiment with the system infrastructure external to a carrier.
- FIG. 5 may also include the application distribution system 410 .
- a software stack 500 for the Mobile Device server comprises sets of software modules and combinations of off-the-shelf hardware specially configured and communicatively coupled to implement the methods and systems described above.
- the application server 502 may be implemented as an open-source Apache Tomcat server.
- the application server 502 may be a Sun One Web server (formerly iPlanet Web server), which runs under NT/2000, Solaris and HP-UX supporting JavaServer Pages (“JSP”) technology, Java servlets, and Server-Side JavaScript (“SSJS”).
- JSP JavaServer Pages
- SSJS Server-Side JavaScript
- the application server 302 may be other suitable Web Servers.
- the software stack 500 can also include an application data layer 504 .
- the application data layer 504 may include at least one electronic storage medium such as a database, flat file system, or cache for storing data associated with the application and/or the various modules in the software stack 500 .
- the software stack 500 can include a policy management layer 518 configured to manage Internet activity for users.
- a policy management layer 518 configured to manage Internet activity for users.
- an employer can set policies for regulating Internet activity of it's employees on the mobile phone 100 provided by the employer.
- the employer can determine which Internet Websites and contents can be accessible by the employees.
- the software stack 500 can include an application distribution proxy 520 to mediate communication between the mobile phone 100 and the carrier server 503 to enforce access control and security. Instead of blindly forwarding packets, the application distribution proxy 520 can be implemented to allow only valid protocol exchanges to take place. The application distribution proxy can also enforce complex access control policies and rules.
- the software stack 500 can also include a customization server 522 configured to customize Internet access for each employer and/or each employee.
- a customization server 522 configured to customize Internet access for each employer and/or each employee.
- each employer may customize Internet access for its employees based on various employer set factors such as job duties.
- Customizing Internet access can include selecting approved Internet sites, setting download limits, and allocating time limits on Internet access and activity.
- the customization server 522 may communicate with the customer database 504 and/or the Mobile Device database 506 to determine if the requested content is a valid content accessible by the mobile phone 100 associated with a user profile.
- various adaptor layers may be included in the software stack 500 to facilitate monitoring, controlling, and filtering Internet activity on the mobile phone 100 .
- These adaptors may includes a client connection adaptor 506 , a virus scanner adaptor 508 , a content filtering adaptor 510 , a SMSC adaptor 512 , a filter adaptor 514 , and a WAP adaptor 516 .
- the client connection adaptor 506 can facilitate log-in validation of the user when requesting access to certain Internet websites from the mobile phone 100 .
- the virus scanner adaptor 508 can handle downloads obtained from sources outside of approved locations that may contain viruses.
- the content filtering adaptor 510 can filter carrier-hosted applications and content directed to the mobile device by referencing a licensed database or external filter.
- the SMSC adaptor 512 can place limits on the number of non-verbal communications (e.g. SMS, instant messages, or other text messaging) over a time specific period.
- the filter adaptor 514 can be an off the shelf filtering component or stand-alone database.
- the filter adapter 514 can identify and block access to Internet sites containing sexually explicit, offensive, or other material deemed inappropriate in the workplace. It can also identify and toggle Internet sites that are necessary for some employees, but not necessary for others to do their work.
- the WAP adaptor 516 can be used to filter applications and/or programs provided for execution, both binary or scripted type program content.
- one or more relational databases can be employed, such as all or parts of customer database 304 and Mobile Device database 306 , with a table or combination of fields for each adaptor, maybe used for filtering the content and managing Internet usage.
- the software packet 500 may also include a logs, statistics & licensing layer 524 configure to facilitate monitoring of the Internet activity.
- a log may be crated to keep track of all Internet activity of each user. For example, an employer may maintain a history of Internet activity of all employees, which can be used to analyze work productivity levels and calculate costs associated with mobile device usage.
Abstract
Systems and methods for controlling, filtering, and monitoring mobile device access to the internet are disclosed. According to an embodiment a server is responsible for controlling, filtering and monitoring internet activity. For every request, the server interacts with back-end databases that categorize requests, and based on user/carrier/corporate settings, allow or disallow access to particular content.
Description
- This application is a divisional of U.S. patent application Ser. No. 13/215,128 filed Aug. 22, 2011, which is a continuation of U.S. patent application Ser. No. 12/574,638, filed Oct. 6, 2009, now issued U.S. Pat. No. 8,005,913, which is a continuation of U.S. patent application Ser. No. 11/336,297, filed Jan. 19, 2006, now abandoned, which claims priority to U.S. Provisional Application No. 60/646,173, filed Jan. 20, 2005, the contents of each hereby incorporated by reference in their entireties.
- The disclosure pertains to the access of mobile devices to content from the Internet, for example, to control, filter, and monitor activity and applications on the mobile device. A mobile phone or mobile device can now be used to engage in chat room discussions, receive video, receive email, receive picture mail, play or download games, download ring tones, download screen savers, receive daily comics or other types of feeds including RSS feeds, Wireless Application Protocol (“WAP”) browser access, phone blogging, and other uses. Before long, mobile phones will demonstrate the ability to interact with vending machines, tollbooths, mobile marketing, and more. In addition to the increased benefits brought on by the advancement in mobile phone technology, greater problems are also on the horizon.
- Increased use of mobile phones for Internet activities is of concern in both business and consumer environments. In a business setting, employers may desire to monitor and manage Internet activities on mobile phones of their employees to limit access to Internet sites inappropriate for a workplace, promote productivity, and control costs. Similarly, parents may wish to prevent their children from accessing inappropriate Internet sites and to limit their Internet activities on the mobile phone. Internet activities on personal computers are already being monitored and managed, and the proliferation of the mobile phone use merits a system to control Internet activities on mobile phones.
- The methods and systems described here implement techniques for controlling, filtering, and monitoring the access of mobile phones to content from the Internet. In one aspect, internet activity of a mobile phone associated with a user profile is managed. A request for content is received from the mobile phone. The request is processed to determine if the requested content is a valid content accessible by the mobile phone associated with the user profile. The request for content by the mobile phone associated with the user profile is responded to by acting as an intermediary for the content to the mobile phone if access to the content is allowed for the user profile and sending an error message to the mobile phone if access to the content is not allowed for the user profile.
- Implementations can include one or more of the following features: For example, the request for content can be received from a mobile browser executing on the mobile phone. The request for content is formatted using a communication protocol comprising a hypertext transfer protocol (HTTP), a secure hypertext transfer protocol (HTTPS), a user datagram protocol, and a file transfer protocol (FTP). The request for content can also be received as a uniform resource locator (URL) using HTTP. Only valid protocol exchanges originating from the mobile phone are authorized. A limit on a total number of downloads allowed over a period of time for the mobile phone associated with the user profile may be set or turned off. The downloads allowed can include text, pictures, games, news feeds, and ring tones. A monetary download limit based on usage or accumulation can also be set. A limit on a total number of non-verbal communication instances authorized over a period of time for the mobile phone associated with the user profile can also be set or turned off. The non-verbal communication can include short message service (SMS) and instant messaging (IM).
- Implementations can also include one or more of the following additional features: For example, Content filtering can be implemented to identify and block access to internet sites deemed not authorized for the mobile phone associated with the user profile. The internet sites deemed not authorized can include internet sites containing sexually explicit content, adult content, content inappropriate for the workplace. Content filtering can be implemented to compare a request to access an internet site against data in a master database. The master database can include a list of frequently accessed sites, protocols, and computer applications. Wireless application protocol sites and other downloadable internet sites can be added to the master database. Presence of viruses can be detected to prevent infection of the mobile phone.
- Furthermore, implementations can also include one or more of the following additional features: For example, the internet activity of the mobile phone associated with the user profile can be monitored to create a report including a list of wireless application protocol sites accessed, downloads obtained, and time spent interacting with online activities is generated. Policies for managing internet activity on the mobile phone can be set. Setting the policies can include designating internet websites and contents as either authorized or unauthorized for mobile phone associated with the user profile. Communication between the mobile phone and a carrier server can be mediated to enforce access control and security. Also, internet activity for the mobile phone associated with the user profile can be customized. Customizing the internet activity includes selecting authorized internet sites; setting download limits; and setting time limits of the internet activity.
- Aspects of these systems and methods are embodied in computer hardware and software. These and other features of these systems and methods are described below in the claims.
-
FIG. 1 is a system drawing and a protocol according to an embodiment. -
FIG. 2A is a flow chart describing a process of controlling, monitoring, and filtering internet activity according to an embodiment. -
FIG. 2B is a block diagram describing a list of possible functions available in the process of controlling, monitoring, and filtering internet activity. -
FIG. 3 depicts a system overview according to an embodiment. -
FIG. 4 depicts a system architecture according to an embodiment with the system infrastructure hosted within a carrier. -
FIG. 5 depicts a system architecture according to an embodiment with the system infrastructure hosted external to a carrier. - Techniques for controlling and monitoring WAP applications are described herein. Particularly, systems and methods for controlling, filtering, and monitoring mobile phone access to the Internet are disclosed. In the following description, for the purpose of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. It will be apparent, however, to one of ordinary skill in the art that the present disclosure may be practiced without these specific details. In other instances, well-known structures are shown in block diagram form to avoid unnecessarily obscuring the present disclosure.
- According to one aspect of the techniques, a
system 10 is implemented to regulatecommunication 126 between aserver 110 and amobile phone 100 as shown inFIG. 1A . Particularly, theserver 110 is responsible for controlling, filtering, and monitoring Internet activity on the mobile phone. For example, a user may send requests to theserver 110 from themobile phone 100 for documents and other files accessible from the Internet. Theserver 110 can be a web server and includes at least a central processing unit (“CPU”) 112, amemory unit 116, astorage device 118, and acommunication interface 120.Server 110 can also be implemented as a proxy server, or intermediary between another server. - The
server 110 may be compatible with various platforms including Microsoft Windows™, Sun Microsystem Sun™, open source Linux, and other suitable platforms. Depending on the platform, anappropriate operating system 114 is executed by theCPU 112. Thememory unit 116 may be a volatile memory including various types of random access memory (“RAM”) such as dynamic RAM (“DRAM”), synchronous DRAM (“SDRAM”), double data rate SDRAM (“DDR”), synchronous graphics RAM (“SDRAM”), and video RAM (“VRAM”). Thememory unit 116 may also be a non-volatile memory including read only memory (“ROM”), flash memory, and programmable memory such as erasable programmable ROM (“EPROM”) and electrically erasable programmable ROM (“EEPROM”). Thestorage device 118 may be a portable or removable memory including a compact disk ROM (“CDROM”), a tape, and a hard drive. Thememory unit 116 and/or thestorage device 118 may be implemented to store the requests received from themobile phone 100. - The
communication interface 120 may be configured to receive requests as data packets from themobile phone 100 and to forward the requests to theCPU 112 for processing. The requests C1 may be formatted in a compatible mobile device that can include communication protocols such as Hypertext Transfer Protocol (“HTTP”), Secure Hypertext Transfer Protocol (“HTTPS”), File Transfer Protocol (“FTP”), Simple Mail Transfer Protocol (“SMTP”), Post Office Protocol (“POP”), or other suitable communication protocols. - In some implementations, the requests may be in the form of a Universal Resource Locator (“URL”) using HTTP. Processing the requests C1 can include a log-on validation intrinsic to the mobile device, associated enterprise or user to ensure that the
mobile phone 100 associated with a user profile is authorized to access the server. - If authorized, the requests C1 are further processed by the
CPU 112 to determine if the content specified by the requests C1 is accessible by themobile phone 100 associated with the user profile. If the requests C1 are for authorized content, the content is either retrieved and forwarded to themobile phone 100 in a reply signal S1, or an authorization is made to the mobile device (e.g., a key) so that the content can be requested directly. If the requested content is unauthorized, an error message is forwarded in the reply signal 51. Theserver 110 may also be communicatively linked tomultiple databases -
FIG. 2 is a flow chart describing aprocess 200 of controlling, monitoring, and filtering Internet access on themobile phone 100. At 210, theserver 110 receives the request C1 for content from themobile phone 100. The request C1 is forwarded to theCPU 112 for processing at 212. - The user profile associated with the
mobile phone 100 is validated to determine if the mobile phone represents an authorized user at 216. If the user is not authorized, an error message is returned to themobile phone 100 at 214. If the mobile phone represents a valid user, the request C1 is further processed at 218. - For each request, the
server 110 can interact with a back-end database 122 for file system that contains a categorized listing of domain names, sub-domain names, websites, keywords, and/or individual files. Theserver 110 will also interact with a back-end database 124 that contains a categorized listing of user, carrier, or enterprise settings that allow or disallow access by the particularmobile phone 100 communicating with theserver 110 to a particular domain name, sub-domain name, website, keyword, and/or individual file. If the request C1 is determined to be valid, the content requested can be retrieved with the server acting as a proxy, and transmitted to themobile phone 100 at 222. However, if the requested content is not accessible for themobile phone 100, an error message is transmitted to themobile phone 100 at 214. - Processing the request at 222 can further include additional functions to control and manage the Internet activity on the
mobile phone 100.FIG. 2B describes possible functions executed at 222. - The
system 10 can be implemented to manage and limit theserver 110 from responding to the requests C1 from themobile phone 100 at 226. Thesystem 10 can allow users to place limits on the number of downloads over a specific period of time. The downloads can include text, pictures, games, news feeds, ring tones, applications, and other content available from the Internet. - In some implementations, the
system 10 can allow an administrator to place limits on the number of non-verbal communications over a specific period of time. Non-verbal communications may include Short Message Service (“SMS”) text messaging and Instant Messaging (“IM”). Users can also choose to turn off downloads and SMS/IM messaging. Each of the functions in process request 222 (monitor usage 224, managerequest 226,filter content 228, and virus detection 230) references another data source such as user/policy lists, virus lists, spammer or white/black lists, web site lists, and other suitable data sources for completing the functions. - In controlling and limiting Internet activity on the
mobile phone 100 for the users at 226, monetary download limits can be implemented to facilitate simplification of user account management. Thesystem 10 can be implemented to control the incremental expenditures associated with a subscriber'smobile phone 100 on a usage or accumulation basis. This can help minimize frivolous personal use of themobile phone 100 and simplify management of monthly expenses. An administrator may be allowed to place limits on non-verbal use of themobile phone 100 to restrict undesirable or excess WAP resources. - In addition to limiting the internet activity, the
system 10 can be implemented to perform content filtering at 228. Thesystem 10 can also be implemented to identify and block access to Internet sites containing content that may be offensive or otherwise not allowed or desired at home or at the workplace. For example, thesystem 10 can block access to Internet sites containing sexually explicit or other material deemed inappropriate at the workplace. In some implementations, thesystem 10 may identify and block access to Internet sites containing content other than adult content that may be offensive or not allowed for certain users. - According to another aspect of the techniques, the
system 10 may take advantage of a master database (not shown) for filtering content and managing Internet use. The database can include a list of the frequently accessed Internet sites, communication protocols, and computer applications on the Web. Furthermore, it can include multiple lists, one each for web sites, spammers, viruses, and other suitable data used for filtering content and managing Internet use. - In one implementation, a single master database can be used to store and manage all information related to the multiple lists described above. In other implementations, the master database can include multiple databases, with each database used to store and manage different types of information, including additional security provisioning. For example, a first database can be used to store and manage the list of frequently accessed Internet sites; a second database can be used to store and manage communication protocols; and a third database can be used to store and manage computer applications on the Web. In still other implementations, WAP sites and other downloadable locations can be added to the database.
- The
system 10 can also be implemented to include virus detection at 230. Downloading content from Internet sites may leave themobile phone 100 susceptible to infections from viruses. The danger from viral infection is greater when downloading from Internet sites outside the approved locations. Thesystem 10 can include virus detection capabilities to help prevent infection of the user'smobile phone 100. - The
system 10 can also be implemented to monitor Internet activity on themobile phone 100 at 224. Thesystem 10 can provide a report including information about the use of themobile phone 100 in connection with the requests made to theserver 110. This report can include WAP sites visited, downloads obtained, and time spent interacting with online activities such as games. - Controlling, filtering, and monitoring Internet activity in an enterprise environment may be necessary to control expenditures and increase productivity. The
system 10 can be implemented to allow a company to regulate unproductive and undesired mobile phone usage by its employees by limiting or denying inappropriate downloads. Thesystem 10 can also be implemented to allow an enterprise to control which WAP web sites can be accessed by its employees and to limit the time that employees can surf or access these sites. Currently, many companies provide their employees with mobile phones and control the contract with the carrier, but the companies do nothing to differentiate between professional and personal mobile phone use. - In some implementations, the
system 10 can be implemented in a consumer environment to provide parents the ability to control, filter, and monitor internet activity on their children'smobile phones 100. With ring tones and other downloadable applications (screen savers, pictures, games, etc.) on the rise, many of the downloads costing several dollars per download, thesystem 10 may be implemented to allow parents to control costs as well as the types of content accessed by their children. - In operation, the techniques can be implemented to design a system to focus on scanning Internet traffic and requests for content, determining the type of request being made, and then using information corresponding to the determined request type to decide which one of multiple adaptors to send the request. Each adaptor can be designed to process specific types of request for content. The adaptor can then interface with off-the-shelf databases or lists of: categorized websites; viruses; SPAM white/black lists; categorized list of carrier-hosted applications; and a carrier's user database for profiles and options.
- Similarly, off-the-shelf virus lists, website lists, other suitable information lists for filtering, controlling, and monitoring Internet activity can be used. This design flexibility allows a carrier or an enterprise to decide who can make the best-of-breed lists for each category, and allows for easy removal or replacement of the lists.
- For example, in some implementations, the carrier's customer profile can specify content restriction policy such as no pornography and no hacking. When a URL request is received, the request is sent to the appropriate adaptor, with the information that no pornography is allowed and no hacking is allowed. Then the URL request is referenced against a database (which can be an off-the-shelf database rented or licensed from a vendor) to determine if the request is in the pornography category. The result of the determination is used to decide whether the request should be served or refused. Alternatively, logical filters can be implemented to dynamically scan all requests and determine the likely category for each request. Either of the two options can be implemented via the adaptor.
-
FIG. 3 illustrates a system upon which an embodiment of the current invention may be implemented.Mobile Phone 100 is a device capable of transmitting, receiving, and accessing voice and data information.Mobile Phone 100 also contains a mobile browser (not shown) used to access content on the Internet. - Such Internet content can be in the form of web pages, downloadable applications, or downloadable ring tones, wall papers, screen savers, and other content accessible on the Internet. The web pages can be documents written in HyperText Markup Language (“HTML”), Extensible HyperText Markup Language (“XHTML”), Java, Active Server Pages (“ASP”), Hypertext Preprocessor (“PHP”), Wireless Markup Language (“WML”), or other suitable programming platforms. The applications can be executable binaries compatible with the
Mobile Phone 100 written in JAVA, BREW, Symbian, or other suitable programming platforms. The downloadable ring tones, wall papers, screen savers, etc. can be files of any audio or video format that can be displayed by theMobile Phone 100. - The
Mobile Phone 100 may access content on the Internet through aTransmissions System 301. TheTransmission System 301 is a communications system capable of transmitting and receiving voice and data information passing between theMobile Phone 100 and a Wireless Application Protocol Proxy (“WAP Proxy”) 302. TheTransmission System 301 may include cellular phone networks, transmission towers, and other suitable mobile communication networks. The cellular phone networks or MVNOs may be compatible with GSM or CDMA supporting CDMA 2000, 3G, GPRS, and EDGE networks. -
WAP Proxy 302 is used for encoding and decoding requests for content from theMobile Phone 100 and content sent to theMobile Phone 100. The content sent to theMobile Phone 100 includes content generated in response to a request for content from theMobile Phone 100. Examples of such content are web pages, downloadable applications, or downloadable ring tones, wall papers, screen savers, etc.WAP Proxy 302 is also used for optimizing communication to and from theMobile Phone 100. - The
WAP Proxy 302 passes the request for content from theMobile Phone 100 to aCarrier Server 303, which is used by carriers to check user accounts, log user activity, and allow or disallow access to the Internet. TheCarrier server 303 relies on aCustomer Database 304 for information related to these activities. TheCustomer Database 304 contains customer account information such as names, telephone numbers, addresses, and profiles among others. This information can be in any known database format. In some implementations, proprietary carrier architectures tied into proprietary billing systems can be implemented to process and store billing and customer records. - The
Carrier Server 303 also passes the request for content to aMobile Device Server 305. TheMobile Device Server 305 is used to control user access to domain names, sub-domain names, websites, and/or individual files. This control is achieved based on information stored in theCustomer Database 304 and aMobile Device Database 306. TheCustomer Database 304 may include carrier's user database for storing and managing customer profiles and options. Such information is passed to theMobile Device Server 305 in response to a request for such information by theCarrier Server 303 or theMobile Device Server 305. - The
Mobile Device Database 306 contains various content identifiers such as approved and disapproved content. For instance, theMobile Device Database 306 may further categorize or authorize sub-portions or groupings of data in Filter Adaptor 514 (Further described with reference toFIG. 5 ). For example, theMobile Device Database 306 can include a categorization of domain names, sub-domain names, websites, keywords, and/or individual files. TheMobile Device Database 306 can also include a list of categorized Internet websites based on content and/or meta data describing and/or associated with the website or individual webpage. This information can be in any known database format. The categorizations can be based on content topic such as adult, sports, news, or other content topics or types. TheMobile Device Database 306 can further include lists of viruses, SPAM, while/black lists, and a categorized list of carrier-hosted applications. In some implementations, theMobile Device Database 306 can be an off-the-shelf database. - The
Mobile Device Server 305 also contains software that monitors and stores the activity of the user (not shown) of theMobile Phone 100. This information can be logged and stored on theMobile Device Server 305, theCustomer Database 304, or elsewhere. - If the
Mobile Device Server 305 does not authorize a request by theMobile Phone 100, it returns an error message to theMobile Phone 100. If theMobile Device Server 305 does authorize a request by theMobile Phone 100, the authorized request is passed to aFirewall 307. TheFirewall 307 controls access to theInternet 308 from within the carrier network and also restricts unauthorized incoming traffic from theInternet 308 to the carrier network. - The severs on the
Internet 308 relay the request from theFirewall 307 to aWebsite 309. The connection between theFirewall 307 andWebsite 309 can be direct or indirect. - The
Website 309 contains the content requested by theMobile Phone 100. TheWebsite 309 can be information stored on a server (not shown) that is connected to theInternet 308 and the server may accept external requests for information such as theWebsite 309. In response to the external request for information (e.g., from the Mobile Phone 100) theWebsite 309 transfers the information requested by theMobile Phone 100 to theFirewall 307. The information is relayed to theFirewall 307 through theInternet 308. - The
Firewall 307 passes the requested information to theMobile Device Server 305. TheMobile Device Server 305 passes the requested information to theCarrier Server 303. TheCarrier Server 303 passes the requested information to theWAP Proxy 302. TheWAP Proxy 302 passes the information to theTransmissions System 301. TheTransmissions System 301 then transmits the information to theMobile Phone 100. - Thus far, the components and characteristics of the system have been described. Referring again to
FIG. 3 , one implementation of an operating environment or “software stack” is described below. As described above, theMobile Phone 100 is a device capable of transmitting, receiving, and accessing voice and data information. TheMobile Phone 100 must be activated and have data and voice access capabilities. TheMobile Phone 100 may be implemented to establishes a data call through theTransmissions System 301 and connect to theWAP Proxy 302. - The request and transmission process starts when the
Mobile Phone 100 generates a request over the air to access a particular URL or to download a particular file. This request may normally be made using a mobile browser on theMobile Phone 100. In some implementations, the request may also be generated as an HTTP, User Datagram Protocol (“UDP”), socket, or any other suitable protocol request that use a URL. - The
WAP proxy 302 receives the request through theTransmission System 301 and translates the request. The translated request is passed onto theCarrier Server 303. TheCarrier Server 303 sends a request to theCustomer Database 304 to send information contained in the user profile associated with theMobile Phone 100 or with the current user of theMobile Phone 100. TheCarrier Server 303 then validates access to the requested data service for the mobile phone account associated withMobile Phone 100 or with the current user ofMobile Phone 100. If access to the requested data service is not allowed, a service denied response is sent through theWAP Proxy 302 toMobile Phone 100, and the process starts over again. If access to the requested data service is allowed, the URL is passed to theMobile Device Server 305. - The
Mobile Device Server 305 searches for the requested URL (or a portion of the URL or request) in theMobile Device Database 306. If found, the requested URL may be retrieved along with its category or any other meta data associated with the requested URL. Next, theMobile Device Server 305 tries to match the category or other meta data of the requested URL against the categories or other meta data permitted toMobile Phone 100 or the current user ofMobile Phone 100 based on the profile information contained in thecustomer database 304. - The
Mobile Device Server 305 also logs the activity associated with browsing and/or website interaction and meta data associated with the applications and/or content that is accessed in theMobile Device Database 306. - If the category of the URL sent to the
Mobile Device Server 305 is an allowed category for theMobile Phone 100 or the current user of theMobile Phone 100 as defined by theCustomer Database 304, the URL request is sent to theFirewall 307. TheFirewall 307 then routes the URL request over theInternet 308 to theWebsite 309, the ultimate destination of the URL request initiated by theMobile Phone 100. - Back and forth communication can then proceed between the
Website 309 and theMobile Phone 100. If theWebsite 309 attempts to redirect the user to another site or the user goes to another site by means of clicking on a hyperlink, selecting a bookmark, entering a new URL or other, the process can start over and the new URL is evaluated. - The systems and methods described herein can be performed by one or more programmable processors executing programmed instructions to perform functions by operating on input data and generating an output. The methods can also be performed by, and the systems can be implemented as, special purpose logic circuitry. Examples of such special purpose logic circuitry include a Field Programmable Gate Array (“FPGA”), a Complex Programmable Logic Device (“CPLD”, an Application Specific Integrated Circuit (“ASIC”), or flash memory.
- Processors suitable for the execution of programmed instructions include, by way of example, both general and special purpose microprocessors. Generally, a processor will receive instructions and data from a read only memory (“ROM”) or a random access memory (“RAM”) or both. Information carriers suitable for embodying programmed instructions and data include, by way of example, semiconductor memory devices such as EPROM, EEPROM, and flash memory devices. The processor and the memory can be supplemented by, or incorporated in special purpose logic circuitry.
- The connections between the processors and other hardware used to execute programmed instructions include both wired and wireless connections. Examples of wired connections include Ethernet networks, Token Ring networks, phone lines, and other network connections. Examples of wireless connections include wireless networks according to the protocols established by the IEEE 802.11a, 802.11b, and 802.11g standards.
- Infrastructure within a Carrier
-
FIG. 4 depicts a system architecture according to an embodiment with the system infrastructure hosted within a carrier. Both the hardware, described with reference toFIG. 3 andsoftware stack 400 forMobile Device server 305 are depicted. Notably,FIG. 4 includes anapplication distribution system 410, which is a server that functions to distribute and, in some instances, balance the work through the distributed intranet or virtually private network associated with a large corporation. Theapplication distribution system 410 allows a corporation to remotely access and update their users' information and make this data available for incorporation into the carrier's user/customer database, interacting with thecarrier server 303. - The
Mobile Device server 305 can provide the means to control and/or monitor mobile applications and data transfer through following features: (1) allowing/disallowing access to carrier-sponsored applications (e.g., Java, BREW, and Symbian); (2) content filtering of WAP data to prevent inappropriate access and/or desktop end-around; (3) virus/spyware/peer-to-peer (“P2.pi.”) network management and detection to prevent network and phone damage; (4) short message service (“SMS”)/spam/instant messaging (“IM”)/spam over instant messaging (“SPIM”) detection and filtering to prevent nuisance and maintain customer satisfaction; (5) digital rights management (“DRM”)/P2P network management to minimize significant carrier exposure to IP protection issues; and (6) account management to set monetary limits on data use and purchases for customer convenience and ease of payment collection for the carrier. Thesoftware stack 400 can be implemented to carry out at least some of the features described above and will be discussed further in connection with the system infrastructure within an enterprise. -
FIG. 5 depicts a system architecture according to an embodiment with the system infrastructure external to a carrier.FIG. 5 may also include theapplication distribution system 410. More particularly, asoftware stack 500 for the Mobile Device server comprises sets of software modules and combinations of off-the-shelf hardware specially configured and communicatively coupled to implement the methods and systems described above. - At the lowest layer of the
software stack 500 is anapplication server 502 configured to manage the communication and brokering of the various components in thesoftware stack 500 and the rest of the system architecture. Theapplication server 502 may be implemented as an open-source Apache Tomcat server. In some implementations, theapplication server 502 may be a Sun One Web server (formerly iPlanet Web server), which runs under NT/2000, Solaris and HP-UX supporting JavaServer Pages (“JSP”) technology, Java servlets, and Server-Side JavaScript (“SSJS”). In yet other implementations, theapplication server 302 may be other suitable Web Servers. - The
software stack 500 can also include anapplication data layer 504. Theapplication data layer 504 may include at least one electronic storage medium such as a database, flat file system, or cache for storing data associated with the application and/or the various modules in thesoftware stack 500. - The
software stack 500 can include apolicy management layer 518 configured to manage Internet activity for users. For example, an employer can set policies for regulating Internet activity of it's employees on themobile phone 100 provided by the employer. Using thepolicy management layer 518, the employer can determine which Internet Websites and contents can be accessible by the employees. - The
software stack 500 can include anapplication distribution proxy 520 to mediate communication between themobile phone 100 and the carrier server 503 to enforce access control and security. Instead of blindly forwarding packets, theapplication distribution proxy 520 can be implemented to allow only valid protocol exchanges to take place. The application distribution proxy can also enforce complex access control policies and rules. - The
software stack 500 can also include acustomization server 522 configured to customize Internet access for each employer and/or each employee. For example, each employer may customize Internet access for its employees based on various employer set factors such as job duties. - Customizing Internet access can include selecting approved Internet sites, setting download limits, and allocating time limits on Internet access and activity. The
customization server 522 may communicate with thecustomer database 504 and/or theMobile Device database 506 to determine if the requested content is a valid content accessible by themobile phone 100 associated with a user profile. - In addition, various adaptor layers may be included in the
software stack 500 to facilitate monitoring, controlling, and filtering Internet activity on themobile phone 100. These adaptors may includes aclient connection adaptor 506, avirus scanner adaptor 508, acontent filtering adaptor 510, aSMSC adaptor 512, afilter adaptor 514, and aWAP adaptor 516. For example, theclient connection adaptor 506 can facilitate log-in validation of the user when requesting access to certain Internet websites from themobile phone 100. Thevirus scanner adaptor 508 can handle downloads obtained from sources outside of approved locations that may contain viruses. Thecontent filtering adaptor 510 can filter carrier-hosted applications and content directed to the mobile device by referencing a licensed database or external filter. TheSMSC adaptor 512 can place limits on the number of non-verbal communications (e.g. SMS, instant messages, or other text messaging) over a time specific period. Thefilter adaptor 514 can be an off the shelf filtering component or stand-alone database. Thefilter adapter 514 can identify and block access to Internet sites containing sexually explicit, offensive, or other material deemed inappropriate in the workplace. It can also identify and toggle Internet sites that are necessary for some employees, but not necessary for others to do their work. TheWAP adaptor 516 can be used to filter applications and/or programs provided for execution, both binary or scripted type program content. - With each or all of the adaptors, one or more relational databases can be employed, such as all or parts of
customer database 304 andMobile Device database 306, with a table or combination of fields for each adaptor, maybe used for filtering the content and managing Internet usage. - The
software packet 500 may also include a logs, statistics &licensing layer 524 configure to facilitate monitoring of the Internet activity. Each time a user successfully connects to the Internet and sends requests for content, a log may be crated to keep track of all Internet activity of each user. For example, an employer may maintain a history of Internet activity of all employees, which can be used to analyze work productivity levels and calculate costs associated with mobile device usage. - Multiple embodiments of the disclosure have been described. Nevertheless, it will be understood that various modifications may be made to these embodiments without departing from the spirit and scope of the disclosure and as defined in the accompanying claims.
Claims (23)
1. A system for managing internet activity of a mobile device associated with a user profile, wherein the mobile device is operable to transmit, receive, and access voice and data information, the system comprising:
a transmission system operable to transmit and receive voice data information between the mobile device and a wireless application protocol proxy, wherein the wireless application protocol proxy is operable to mediate communication between the mobile device and a network;
a carrier server operable to check user accounts, log user activity, and allow or disallow the mobile device access to the network; and
a mobile device server operable to control user access to content.
2. The system of claim 1 , wherein the mobile device server includes a software stack comprising a plurality of software modules and hardware.
3. The system of claim 2 , wherein the carrier server is further operable to look for information related to user accounts and user activity stored in a customer database when allowing or disallowing the mobile device access to the internet and operable to pass a request for content from the mobile device to the mobile device server.
4. The system of claim 3 , wherein the customer database contains formatted information comprising user names, profiles, and content identifiers.
5. The system of claim 3 , where in the mobile device server is operable to control user access to domain names, sub-domain names, websites, and individual files based on information stored in the customer database and a mobile device database.
6. The system of claim 5 , wherein the mobile device database contains formatted information comprising a categorization of domain names and keywords.
7. The system of claim 6 , wherein the mobile device database contains formatted information further comprising a complete list of all internet websites with associated categories based on content or meta data describing the website.
8. The system of claim 2 , wherein the software stack further comprises a filter adaptor operable to monitor and store internet activity associated with the user profile.
9. The system of claim 1 , wherein the mobile device server is further operable to send an error message to the mobile device if a request for content by the mobile device is determined to be not authorized, and to pass the request for content to a firewall if the request for content is determined to be authorized.
10. The system of claim 9 , wherein the firewall is operable to control access to the internet from within a carrier network and to restrict unauthorized incoming traffic from the internet to the carrier network.
11. The system of claim 10 , wherein the firewall is further operable to relay the authorized request for content through the internet to a website containing the requested content.
12. The system of claim 11 , wherein the website is further operable to transfer the requested content to the mobile device by passing the requested content through the firewall, the mobile device server, the carrier server, the WAP proxy, and the transmission system.
13. The system of claim 1 , wherein the mobile device further comprises a mobile browser operable to send a request for content.
14. The system of claim 1 , wherein the request for content is formatted using a communication protocol comprising a hypertext transfer protocol (HTTP), a secure hypertext transfer protocol (HTTPS), a user datagram protocol (UDP), and a file transfer protocol (FTP).
15. The system of claim 14 , wherein the request for content is received as a uniform resource locator (URL) using HTTP.
16. The system of claim 2 , wherein the software stack further comprises an application server operable to manage communication amongst the plurality of software modules and hardware.
17. The system of claim 2 , wherein the software stack further comprises a policy management layer operable to set policies for managing internet activity on the mobile phone.
18. The system of claim 2 , wherein the policy management layer is further operable to designating internet websites and contents as either authorized or unauthorized for the mobile device associated with the user profile.
19. The system of claim 2 , wherein the software stack further comprises an application distribution proxy operable to mediate communication between the mobile device and the carrier server to enforce access control and security.
20. The system of claim 19 , wherein the application distribution proxy is further operable to authorize only valid protocol exchanges originating from the mobile phone.
21. The system of claim 2 , wherein the software stack further comprises a customization server operable to customize the internet activity for the mobile device associated with the user profile.
22. The system of claim 21 , wherein the customization server is further operable to:
selecting authorized internet sites;
setting download limits; and
setting time limits of the internet activity.
23. The system of claim 22 , wherein the customization server is further operable to communicate with one or more databases to select authorized internet sites.
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/340,692 US20120102544A1 (en) | 2005-01-20 | 2011-12-30 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
US13/492,613 US8601084B2 (en) | 2005-01-20 | 2012-06-08 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
Applications Claiming Priority (5)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US64617305P | 2005-01-20 | 2005-01-20 | |
US33629706A | 2006-01-19 | 2006-01-19 | |
US12/574,638 US8005913B1 (en) | 2005-01-20 | 2009-10-06 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
US13/215,128 US20120071132A1 (en) | 2005-01-20 | 2011-08-22 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
US13/340,692 US20120102544A1 (en) | 2005-01-20 | 2011-12-30 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/215,128 Division US20120071132A1 (en) | 2005-01-20 | 2011-08-22 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/492,613 Continuation US8601084B2 (en) | 2005-01-20 | 2012-06-08 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
Publications (1)
Publication Number | Publication Date |
---|---|
US20120102544A1 true US20120102544A1 (en) | 2012-04-26 |
Family
ID=44455509
Family Applications (6)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US12/574,638 Active US8005913B1 (en) | 2005-01-20 | 2009-10-06 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
US13/215,128 Abandoned US20120071132A1 (en) | 2005-01-20 | 2011-08-22 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
US13/340,692 Abandoned US20120102544A1 (en) | 2005-01-20 | 2011-12-30 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
US13/340,693 Active US8769044B2 (en) | 2005-01-20 | 2011-12-30 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
US13/492,613 Active US8601084B2 (en) | 2005-01-20 | 2012-06-08 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
US14/296,464 Active 2027-11-03 US9924356B2 (en) | 2005-01-20 | 2014-06-05 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
Family Applications Before (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US12/574,638 Active US8005913B1 (en) | 2005-01-20 | 2009-10-06 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
US13/215,128 Abandoned US20120071132A1 (en) | 2005-01-20 | 2011-08-22 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
Family Applications After (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/340,693 Active US8769044B2 (en) | 2005-01-20 | 2011-12-30 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
US13/492,613 Active US8601084B2 (en) | 2005-01-20 | 2012-06-08 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
US14/296,464 Active 2027-11-03 US9924356B2 (en) | 2005-01-20 | 2014-06-05 | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
Country Status (1)
Country | Link |
---|---|
US (6) | US8005913B1 (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN108881145A (en) * | 2017-12-26 | 2018-11-23 | 北京安天网络安全技术有限公司 | Inbreak detection rule optimization method, device, electronic equipment and storage medium |
Families Citing this family (130)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8346733B2 (en) | 2006-12-22 | 2013-01-01 | Commvault Systems, Inc. | Systems and methods of media management, such as management of media to and from a media storage library |
WO2004090789A2 (en) | 2003-04-03 | 2004-10-21 | Commvault Systems, Inc. | System and method for extended media retention |
US9275052B2 (en) | 2005-01-19 | 2016-03-01 | Amazon Technologies, Inc. | Providing annotations of a digital work |
US8005913B1 (en) * | 2005-01-20 | 2011-08-23 | Network Protection Sciences, LLC | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
US8533199B2 (en) | 2005-12-14 | 2013-09-10 | Unifi Scientific Advances, Inc | Intelligent bookmarks and information management system based on the same |
US7539783B2 (en) | 2006-09-22 | 2009-05-26 | Commvault Systems, Inc. | Systems and methods of media management, such as management of media to and from a media storage library, including removable media |
US8725565B1 (en) | 2006-09-29 | 2014-05-13 | Amazon Technologies, Inc. | Expedited acquisition of a digital item following a sample presentation of the item |
US9672533B1 (en) | 2006-09-29 | 2017-06-06 | Amazon Technologies, Inc. | Acquisition of an item based on a catalog presentation of items |
US7865817B2 (en) | 2006-12-29 | 2011-01-04 | Amazon Technologies, Inc. | Invariant referencing in digital works |
US9665529B1 (en) | 2007-03-29 | 2017-05-30 | Amazon Technologies, Inc. | Relative progress and event indicators |
US7921309B1 (en) | 2007-05-21 | 2011-04-05 | Amazon Technologies | Systems and methods for determining and managing the power remaining in a handheld electronic device |
US8706976B2 (en) | 2007-08-30 | 2014-04-22 | Commvault Systems, Inc. | Parallel access virtual tape library and drives |
US8402111B2 (en) | 2009-01-28 | 2013-03-19 | Headwater Partners I, Llc | Device assisted services install |
US8626115B2 (en) | 2009-01-28 | 2014-01-07 | Headwater Partners I Llc | Wireless network service interfaces |
US8346225B2 (en) | 2009-01-28 | 2013-01-01 | Headwater Partners I, Llc | Quality of service for device assisted services |
US8275830B2 (en) | 2009-01-28 | 2012-09-25 | Headwater Partners I Llc | Device assisted CDR creation, aggregation, mediation and billing |
US8635335B2 (en) | 2009-01-28 | 2014-01-21 | Headwater Partners I Llc | System and method for wireless network offloading |
US8832777B2 (en) | 2009-03-02 | 2014-09-09 | Headwater Partners I Llc | Adapting network policies based on device service processor configuration |
US8548428B2 (en) | 2009-01-28 | 2013-10-01 | Headwater Partners I Llc | Device group partitions and settlement platform |
US8331901B2 (en) | 2009-01-28 | 2012-12-11 | Headwater Partners I, Llc | Device assisted ambient services |
US8589541B2 (en) | 2009-01-28 | 2013-11-19 | Headwater Partners I Llc | Device-assisted services for protecting network capacity |
US8406748B2 (en) | 2009-01-28 | 2013-03-26 | Headwater Partners I Llc | Adaptive ambient services |
US8380176B2 (en) | 2008-08-08 | 2013-02-19 | Websafery, Inc. | Method of inhibiting functions of a mobile communications device |
US20100235306A1 (en) * | 2008-08-11 | 2010-09-16 | Seth Wagoner | Adaptive timelog system |
US20100070466A1 (en) | 2008-09-15 | 2010-03-18 | Anand Prahlad | Data transfer techniques within data storage devices, such as network attached storage performing data migration |
US9087032B1 (en) | 2009-01-26 | 2015-07-21 | Amazon Technologies, Inc. | Aggregation of highlights |
US10484858B2 (en) | 2009-01-28 | 2019-11-19 | Headwater Research Llc | Enhanced roaming services and converged carrier networks with device assisted services and a proxy |
US10248996B2 (en) | 2009-01-28 | 2019-04-02 | Headwater Research Llc | Method for operating a wireless end-user device mobile payment agent |
US10200541B2 (en) | 2009-01-28 | 2019-02-05 | Headwater Research Llc | Wireless end-user device with divided user space/kernel space traffic policy system |
US8793758B2 (en) | 2009-01-28 | 2014-07-29 | Headwater Partners I Llc | Security, fraud detection, and fraud mitigation in device-assisted services systems |
US9351193B2 (en) | 2009-01-28 | 2016-05-24 | Headwater Partners I Llc | Intermediate networking devices |
US9858559B2 (en) | 2009-01-28 | 2018-01-02 | Headwater Research Llc | Network service plan design |
US9270559B2 (en) | 2009-01-28 | 2016-02-23 | Headwater Partners I Llc | Service policy implementation for an end-user device having a control application or a proxy agent for routing an application traffic flow |
US10715342B2 (en) | 2009-01-28 | 2020-07-14 | Headwater Research Llc | Managing service user discovery and service launch object placement on a device |
US9955332B2 (en) | 2009-01-28 | 2018-04-24 | Headwater Research Llc | Method for child wireless device activation to subscriber account of a master wireless device |
US9392462B2 (en) | 2009-01-28 | 2016-07-12 | Headwater Partners I Llc | Mobile end-user device with agent limiting wireless data communication for specified background applications based on a stored policy |
US10326800B2 (en) | 2009-01-28 | 2019-06-18 | Headwater Research Llc | Wireless network service interfaces |
US9980146B2 (en) | 2009-01-28 | 2018-05-22 | Headwater Research Llc | Communications device with secure data path processing agents |
US10057775B2 (en) | 2009-01-28 | 2018-08-21 | Headwater Research Llc | Virtualized policy and charging system |
US9572019B2 (en) | 2009-01-28 | 2017-02-14 | Headwater Partners LLC | Service selection set published to device agent with on-device service selection |
US10779177B2 (en) | 2009-01-28 | 2020-09-15 | Headwater Research Llc | Device group partitions and settlement platform |
US9578182B2 (en) | 2009-01-28 | 2017-02-21 | Headwater Partners I Llc | Mobile device and service management |
US9647918B2 (en) | 2009-01-28 | 2017-05-09 | Headwater Research Llc | Mobile device and method attributing media services network usage to requesting application |
US10798252B2 (en) | 2009-01-28 | 2020-10-06 | Headwater Research Llc | System and method for providing user notifications |
US10783581B2 (en) | 2009-01-28 | 2020-09-22 | Headwater Research Llc | Wireless end-user device providing ambient or sponsored services |
US11218854B2 (en) | 2009-01-28 | 2022-01-04 | Headwater Research Llc | Service plan design, user interfaces, application programming interfaces, and device management |
US10237757B2 (en) | 2009-01-28 | 2019-03-19 | Headwater Research Llc | System and method for wireless network offloading |
US10064055B2 (en) | 2009-01-28 | 2018-08-28 | Headwater Research Llc | Security, fraud detection, and fraud mitigation in device-assisted services systems |
US8745191B2 (en) | 2009-01-28 | 2014-06-03 | Headwater Partners I Llc | System and method for providing user notifications |
US9706061B2 (en) | 2009-01-28 | 2017-07-11 | Headwater Partners I Llc | Service design center for device assisted services |
US9565707B2 (en) | 2009-01-28 | 2017-02-07 | Headwater Partners I Llc | Wireless end-user device with wireless data attribution to multiple personas |
US9755842B2 (en) | 2009-01-28 | 2017-09-05 | Headwater Research Llc | Managing service user discovery and service launch object placement on a device |
US9954975B2 (en) | 2009-01-28 | 2018-04-24 | Headwater Research Llc | Enhanced curfew and protection associated with a device group |
US10492102B2 (en) | 2009-01-28 | 2019-11-26 | Headwater Research Llc | Intermediate networking devices |
US10264138B2 (en) | 2009-01-28 | 2019-04-16 | Headwater Research Llc | Mobile device and service management |
US9557889B2 (en) * | 2009-01-28 | 2017-01-31 | Headwater Partners I Llc | Service plan design, user interfaces, application programming interfaces, and device management |
US9571559B2 (en) | 2009-01-28 | 2017-02-14 | Headwater Partners I Llc | Enhanced curfew and protection associated with a device group |
US10841839B2 (en) | 2009-01-28 | 2020-11-17 | Headwater Research Llc | Security, fraud detection, and fraud mitigation in device-assisted services systems |
US8695058B2 (en) * | 2009-05-20 | 2014-04-08 | Mobile Iron, Inc. | Selective management of mobile device data in an enterprise environment |
US20100299152A1 (en) * | 2009-05-20 | 2010-11-25 | Mobile Iron, Inc. | Selective Management of Mobile Devices in an Enterprise Environment |
US8692763B1 (en) | 2009-09-28 | 2014-04-08 | John T. Kim | Last screen rendering for electronic book reader |
US8997092B2 (en) * | 2010-02-03 | 2015-03-31 | Symantec Corporation | Method, system, and computer readable medium for provisioning and remote distribution |
US8359642B1 (en) * | 2010-06-25 | 2013-01-22 | Sprint Communications Company L.P. | Restricting mature content |
US9495322B1 (en) | 2010-09-21 | 2016-11-15 | Amazon Technologies, Inc. | Cover display |
US8719927B2 (en) * | 2010-09-28 | 2014-05-06 | Empire Technology Development Llc | Data filtering by using a communication device including an interface on a display showing a domain name |
US9244779B2 (en) | 2010-09-30 | 2016-01-26 | Commvault Systems, Inc. | Data recovery operations, such as recovery from modified network data management protocol data |
US20120098758A1 (en) * | 2010-10-22 | 2012-04-26 | Fearless Designs, Inc. d/b/a The Audience Group | Electronic program guide, mounting bracket and associated system |
US8700409B1 (en) * | 2010-11-01 | 2014-04-15 | Sprint Communications Company L.P. | Real-time versioning of device-bound content |
US9342381B2 (en) | 2011-02-03 | 2016-05-17 | Symantec Corporation | Method and system for establishing a DLP-compliant environment |
US20120311673A1 (en) * | 2011-06-01 | 2012-12-06 | Comcast Cable Communications, Llc | Media usage monitoring and control |
WO2013048364A1 (en) * | 2011-09-26 | 2013-04-04 | Vogel Brett R | System and method for restricting internet access |
US9158741B1 (en) | 2011-10-28 | 2015-10-13 | Amazon Technologies, Inc. | Indicators for navigating digital works |
US8938755B2 (en) | 2012-03-27 | 2015-01-20 | Roku, Inc. | Method and apparatus for recurring content searches and viewing window notification |
US8977721B2 (en) | 2012-03-27 | 2015-03-10 | Roku, Inc. | Method and apparatus for dynamic prioritization of content listings |
US8627388B2 (en) | 2012-03-27 | 2014-01-07 | Roku, Inc. | Method and apparatus for channel prioritization |
US9137578B2 (en) | 2012-03-27 | 2015-09-15 | Roku, Inc. | Method and apparatus for sharing content |
US9519645B2 (en) * | 2012-03-27 | 2016-12-13 | Silicon Valley Bank | System and method for searching multimedia |
AU2013202553B2 (en) | 2012-03-30 | 2015-10-01 | Commvault Systems, Inc. | Information management of mobile device data |
US9563336B2 (en) * | 2012-04-26 | 2017-02-07 | Liveperson, Inc. | Dynamic user interface customization |
US9288387B1 (en) * | 2012-09-11 | 2016-03-15 | Amazon Technologies, Inc. | Content display controls based on environmental factors |
CN103780451B (en) * | 2012-10-24 | 2018-12-28 | 南京中兴软件有限责任公司 | The control method and device of internet access |
US9069799B2 (en) | 2012-12-27 | 2015-06-30 | Commvault Systems, Inc. | Restoration of centralized data storage manager, such as data storage manager in a hierarchical data storage system |
US10491458B2 (en) | 2013-01-31 | 2019-11-26 | Dell Products L.P. | System and method for reporting peer-to-peer transfer events |
US10574744B2 (en) | 2013-01-31 | 2020-02-25 | Dell Products L.P. | System and method for managing peer-to-peer information exchanges |
CN103973749A (en) * | 2013-02-05 | 2014-08-06 | 腾讯科技(深圳)有限公司 | Cloud server and website processing method based on same |
US9565526B2 (en) | 2013-02-25 | 2017-02-07 | Dell Products L.P. | System and method for dynamic geo-fencing |
WO2014159862A1 (en) | 2013-03-14 | 2014-10-02 | Headwater Partners I Llc | Automated credential porting for mobile devices |
US20150095985A1 (en) * | 2013-09-27 | 2015-04-02 | Alcatel-Lucent Usa Inc. | Parental Control System For Controlling Access To Online Store Contents |
US9485206B2 (en) | 2013-12-19 | 2016-11-01 | Websafety, Inc. | Devices and methods for improving web safety and deterrence of cyberbullying |
USD792421S1 (en) | 2014-10-01 | 2017-07-18 | Websafety, Inc. | Display screen or portion thereof with graphical user interface |
US9922197B2 (en) * | 2014-01-15 | 2018-03-20 | Microsoft Technology Licensing, Llc | Privacy-based degradation of activity signals and automatic activation of privacy modes |
US9762490B2 (en) | 2014-10-27 | 2017-09-12 | Telefonaktiebolaget L M Ericsson (Publ) | Content filtering for information centric networks |
US10397066B2 (en) | 2014-10-27 | 2019-08-27 | Telefonaktiebolaget Lm Ericsson (Publ) | Content filtering for information centric networks |
US20160127461A1 (en) * | 2014-10-30 | 2016-05-05 | Barracuda Networks, Inc. | Method and apparatus for real time interactive moderation of network traffic |
US10757216B1 (en) | 2015-02-20 | 2020-08-25 | Amazon Technologies, Inc. | Group profiles for group item recommendations |
US11363460B1 (en) | 2015-03-03 | 2022-06-14 | Amazon Technologies, Inc. | Device-based identification for automated user detection |
US9928144B2 (en) | 2015-03-30 | 2018-03-27 | Commvault Systems, Inc. | Storage management of data using an open-archive architecture, including streamlined access to primary data originally stored on network-attached storage and archived to secondary storage |
US10305816B1 (en) | 2015-03-31 | 2019-05-28 | Cisco Technology, Inc. | Adjustable bit mask for high-speed native load balancing on a switch |
US9985894B1 (en) | 2015-04-01 | 2018-05-29 | Cisco Technology, Inc. | Exclude filter for load balancing switch |
US10404532B2 (en) | 2015-04-10 | 2019-09-03 | Comcast Cable Commnications, LLC | Virtual gateway control and management |
US10469389B1 (en) | 2015-04-23 | 2019-11-05 | Cisco Technology, Inc. | TCAM-based load balancing on a switch |
US10412157B2 (en) | 2015-04-23 | 2019-09-10 | Cisco Technology, Inc. | Adaptive load balancing |
US10523745B2 (en) | 2015-04-23 | 2019-12-31 | Cisco Technology, Inc. | Load balancing mobility with automated fabric architecture |
US10230642B1 (en) | 2015-04-23 | 2019-03-12 | Cisco Technology, Inc. | Intelligent data paths for a native load balancer |
US10091112B1 (en) | 2015-04-24 | 2018-10-02 | Cisco Technology, Inc. | Highly-scalable virtual IP addresses in a load balancing switch |
WO2016210327A1 (en) | 2015-06-25 | 2016-12-29 | Websafety, Inc. | Management and control of mobile computing device using local and remote software agents |
US10101913B2 (en) | 2015-09-02 | 2018-10-16 | Commvault Systems, Inc. | Migrating data to disk without interrupting running backup operations |
US10992678B1 (en) * | 2015-09-15 | 2021-04-27 | Sean Gilman | Internet access control and reporting system and method |
US20170272435A1 (en) | 2016-03-15 | 2017-09-21 | Global Tel*Link Corp. | Controlled environment secure media streaming system |
US10523524B2 (en) | 2016-09-13 | 2019-12-31 | Gogo Llc | Usage-based bandwidth optimization |
US10511680B2 (en) | 2016-09-13 | 2019-12-17 | Gogo Llc | Network profile configuration assistance tool |
US10491531B2 (en) | 2016-09-13 | 2019-11-26 | Gogo Llc | User directed bandwidth optimization |
US10848432B2 (en) | 2016-12-18 | 2020-11-24 | Cisco Technology, Inc. | Switch fabric based load balancing |
US10405007B2 (en) | 2017-07-27 | 2019-09-03 | Global Tel*Link Corporation | Systems and methods for a video sharing service within controlled environments |
US10122825B1 (en) | 2017-07-27 | 2018-11-06 | Global Tel*Link Corporation | Systems and methods for providing a visual content gallery within a controlled environment |
US10015546B1 (en) * | 2017-07-27 | 2018-07-03 | Global Tel*Link Corp. | System and method for audio visual content creation and publishing within a controlled environment |
US11213754B2 (en) | 2017-08-10 | 2022-01-04 | Global Tel*Link Corporation | Video game center for a controlled environment facility |
US10742735B2 (en) | 2017-12-12 | 2020-08-11 | Commvault Systems, Inc. | Enhanced network attached storage (NAS) services interfacing to cloud storage |
US10587623B2 (en) * | 2018-01-31 | 2020-03-10 | T-Mobile Usa, Inc. | Mobile device platform for access privilege control system |
US20190236470A1 (en) * | 2018-01-31 | 2019-08-01 | T-Mobile Usa, Inc. | User behavior determination from corroborating control data |
US11070562B2 (en) * | 2018-04-25 | 2021-07-20 | Vmware, Inc. | Fine-grained IoT access control via device proxies and SDN-based micro-segmentation |
RU2701990C1 (en) * | 2018-07-12 | 2019-10-02 | Акционерное Общество "Ремпаро" | Method of using document identification system for information security purposes |
CN109636774B (en) * | 2018-11-08 | 2020-12-18 | 温州瑞智门窗有限公司 | Safety base field driving system |
US11611877B2 (en) | 2020-07-08 | 2023-03-21 | T-Mobile Usa, Inc. | User authentication |
US11533619B1 (en) | 2022-05-22 | 2022-12-20 | Starkeys Llc | Access controlling network architectures utilizing novel cellular signaled access control and machine-learning techniques to identify, rank modify and/or control automated programmable entities (such as robots/bots) and their visual schemas, and methods for use thereof |
US11432154B1 (en) | 2021-12-31 | 2022-08-30 | Ari Kahn | Cellular systems having elements modified for access control based on expectation data records in accordance with novel cellular communications protocols and network architectures utilizing cellular network hosted access controlling schemas, and methods for use thereof |
US11516666B1 (en) | 2022-05-22 | 2022-11-29 | Starkeys Llc | Access controlling network architectures utilizing cellular signaled access control to restricted services with expected keys in accordance with novel communications protocols, and methods for use thereof |
US11564266B1 (en) | 2022-07-11 | 2023-01-24 | Starkeys Llc | Permission-based controlling network architectures and systems, having cellular network components and elements modified to host permission controlling schemas designed to facilitates electronic peer-to-peer communication sessions methods for use thereof |
US11477654B1 (en) | 2022-05-31 | 2022-10-18 | Starlogik Ip Llc | Access controlling network architectures and systems, having cellular network components and elements modified to host access controlling schemas designed to transform and/or facilitate cellular communication signals in accordance with novel cellular communications protocols with multi-part multi-functional address signaling, and methods for use thereof |
US11388601B1 (en) | 2021-12-31 | 2022-07-12 | Ari Kahn | Cellular systems having elements modified to transform and/or operate cellular communication signals in accordance with novel cellular communications protocols and network architectures utilizing cellular network hosted access controlling schemas, and methods for use thereof |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020124190A1 (en) * | 2001-03-01 | 2002-09-05 | Brian Siegel | Method and system for restricted biometric access to content of packaged media |
US8005913B1 (en) * | 2005-01-20 | 2011-08-23 | Network Protection Sciences, LLC | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
Family Cites Families (39)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5999942A (en) | 1993-02-11 | 1999-12-07 | Appage Corporation | Method and apparatus for enforcement of behavior of application processing systems without modifying application processing systems |
EP0742670B1 (en) | 1995-05-08 | 2002-04-03 | The Box Worldwide, Inc. | Interactive video system |
US6072870A (en) | 1996-06-17 | 2000-06-06 | Verifone Inc. | System, method and article of manufacture for a gateway payment architecture utilizing a multichannel, extensible, flexible architecture |
US5983270A (en) | 1997-03-11 | 1999-11-09 | Sequel Technology Corporation | Method and apparatus for managing internetwork and intranetwork activity |
US7580856B1 (en) | 1998-04-27 | 2009-08-25 | Robert K. Pliha | Systems and methods for distributing targeted incentives to financial institution customers |
GB2344670B (en) * | 1998-12-12 | 2003-09-03 | Ibm | System, apparatus and method for controlling access |
JP2001202371A (en) | 2000-01-19 | 2001-07-27 | Sony Corp | Data communication system and receiver to be used therefor |
US6606659B1 (en) | 2000-01-28 | 2003-08-12 | Websense, Inc. | System and method for controlling access to internet sites |
US7975021B2 (en) | 2000-10-23 | 2011-07-05 | Clearplay, Inc. | Method and user interface for downloading audio and video content filters to a media player |
US20020103862A1 (en) * | 2001-01-31 | 2002-08-01 | Jeremy Burr | Enabling restricted communications between a plurality of users |
US7330717B2 (en) * | 2001-02-23 | 2008-02-12 | Lucent Technologies Inc. | Rule-based system and method for managing the provisioning of user applications on limited-resource and/or wireless devices |
US20030167250A1 (en) | 2001-05-24 | 2003-09-04 | Yaakov Sash | Information delivery system |
US6947985B2 (en) | 2001-12-05 | 2005-09-20 | Websense, Inc. | Filtering techniques for managing access to internet sites or other software applications |
US7194464B2 (en) | 2001-12-07 | 2007-03-20 | Websense, Inc. | System and method for adapting an internet filter |
US8644797B2 (en) | 2001-12-26 | 2014-02-04 | Apple Inc. | Content-based billing service for wireless prepaid subscribers |
US7089246B1 (en) * | 2002-02-28 | 2006-08-08 | America Online, Inc. | Overriding content ratings and restricting access to requested resources |
US20040064418A1 (en) * | 2002-07-19 | 2004-04-01 | Arian Koster | Method and system for controlled online access from a terminal user to a content service |
US7448067B2 (en) | 2002-09-30 | 2008-11-04 | Intel Corporation | Method and apparatus for enforcing network security policies |
US7470191B2 (en) | 2002-12-20 | 2008-12-30 | Tech Link International Entertainment Ltd. | Responsible gaming system |
US7194254B2 (en) * | 2002-12-30 | 2007-03-20 | Motorola Inc. | Apparatus for restricted browser access within a wireless communication device and method therefor |
JP2006518872A (en) | 2003-01-30 | 2006-08-17 | ムービーラーン・システムズ・リミテッド・ピイティイー | A system for learning languages with content recorded on a single medium |
US7266089B2 (en) | 2003-02-21 | 2007-09-04 | Qwest Communications International Inc. | Systems and methods for creating a wireless network |
US20050282559A1 (en) * | 2003-02-25 | 2005-12-22 | Boston Communications Group, Inc. | Method and system for providing supervisory control over wireless phone data usage |
US7185015B2 (en) | 2003-03-14 | 2007-02-27 | Websense, Inc. | System and method of monitoring and controlling application files |
US7529754B2 (en) | 2003-03-14 | 2009-05-05 | Websense, Inc. | System and method of monitoring and controlling application files |
GB2400273A (en) | 2003-04-05 | 2004-10-06 | Hewlett Packard Development Co | Managing use of services in wireless networks |
US8516536B2 (en) * | 2003-05-28 | 2013-08-20 | Alcatel Lucent | Method and system for internet censorship |
US20050021428A1 (en) | 2003-07-02 | 2005-01-27 | Costello Charles T. | Time management system for mobile employees |
US20050097595A1 (en) * | 2003-11-05 | 2005-05-05 | Matti Lipsanen | Method and system for controlling access to content |
EP1530339B1 (en) * | 2003-11-07 | 2008-03-05 | Harman Becker Automotive Systems GmbH | Method and apparatuses for access control to encrypted data services for a vehicle entertainment and information processing device |
US7797529B2 (en) | 2003-11-10 | 2010-09-14 | Yahoo! Inc. | Upload security scheme |
US7142848B2 (en) * | 2004-02-26 | 2006-11-28 | Research In Motion Limited | Method and system for automatically configuring access control |
US20060015580A1 (en) | 2004-07-01 | 2006-01-19 | Home Box Office, A Delaware Corporation | Multimedia content distribution |
US20060075015A1 (en) * | 2004-10-01 | 2006-04-06 | Nokia Corporation | Control point filtering |
US20060080439A1 (en) * | 2004-10-13 | 2006-04-13 | Andrew Chud | Method and system for reducing bandwidth needed to filter requested content |
US8417953B2 (en) * | 2004-12-30 | 2013-04-09 | Koninklijke Kpn N.V. | Method and system for restricted service access |
US20060173792A1 (en) * | 2005-01-13 | 2006-08-03 | Glass Paul H | System and method for verifying the age and identity of individuals and limiting their access to appropriate material |
US9288078B2 (en) | 2005-03-25 | 2016-03-15 | Qualcomm Incorporated | Apparatus and methods for managing content exchange on a wireless device |
US8453243B2 (en) | 2005-12-28 | 2013-05-28 | Websense, Inc. | Real time lockdown |
-
2009
- 2009-10-06 US US12/574,638 patent/US8005913B1/en active Active
-
2011
- 2011-08-22 US US13/215,128 patent/US20120071132A1/en not_active Abandoned
- 2011-12-30 US US13/340,692 patent/US20120102544A1/en not_active Abandoned
- 2011-12-30 US US13/340,693 patent/US8769044B2/en active Active
-
2012
- 2012-06-08 US US13/492,613 patent/US8601084B2/en active Active
-
2014
- 2014-06-05 US US14/296,464 patent/US9924356B2/en active Active
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020124190A1 (en) * | 2001-03-01 | 2002-09-05 | Brian Siegel | Method and system for restricted biometric access to content of packaged media |
US20090113529A1 (en) * | 2001-03-01 | 2009-04-30 | Sony Corporation | Method and system for restricted biometric access to content of packaged media |
US8286256B2 (en) * | 2001-03-01 | 2012-10-09 | Sony Corporation | Method and system for restricted biometric access to content of packaged media |
US8005913B1 (en) * | 2005-01-20 | 2011-08-23 | Network Protection Sciences, LLC | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN108881145A (en) * | 2017-12-26 | 2018-11-23 | 北京安天网络安全技术有限公司 | Inbreak detection rule optimization method, device, electronic equipment and storage medium |
Also Published As
Publication number | Publication date |
---|---|
US8601084B2 (en) | 2013-12-03 |
US20120244832A1 (en) | 2012-09-27 |
US8005913B1 (en) | 2011-08-23 |
US8769044B2 (en) | 2014-07-01 |
US9924356B2 (en) | 2018-03-20 |
US20120102147A1 (en) | 2012-04-26 |
US20120071132A1 (en) | 2012-03-22 |
US20140287720A1 (en) | 2014-09-25 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US9924356B2 (en) | Controlling, filtering, and monitoring of mobile device access to the internet, data, voice, and applications | |
US8095124B2 (en) | Systems and methods for managing and monitoring mobile data, content, access, and usage | |
EP1971076B1 (en) | A content filtering system, device and method | |
CN101317376B (en) | Method, device and system for contents filtering | |
US9680846B2 (en) | Techniques for sharing network security event information | |
JP5509334B2 (en) | Method for managing access to protected resources in a computer network, and physical entity and computer program therefor | |
CA3099355C (en) | System and method for providing customized response messages based on requested website | |
US10555147B2 (en) | Systems and methods for facilitating service provision between applications | |
US9888290B1 (en) | Service denial notification in secure socket layer (SSL) processing | |
WO2010111914A1 (en) | Method, apparatus and system for network authorization management | |
WO2011113314A1 (en) | Service open method, system and service open server | |
US20100318681A1 (en) | Protocol-independent, mobile, web filter system provisioning dns triage, uri scanner, and query proxy services | |
JP2005536787A (en) | Method and system for managing cookies according to privacy policy | |
US20100191834A1 (en) | Method and system for containing routes | |
JP2004527939A (en) | Remote proxy server agent | |
EP2315407B1 (en) | Address couplet communication filtering | |
CA3152253A1 (en) | Network cyber-security platform | |
WO2021072449A1 (en) | Method and apparatus to control and monitor access to web domains using networked devices | |
US20010018747A1 (en) | Method and system for an access manager granting privileges within a communications network | |
US20050286721A1 (en) | Providing content in a communication system | |
US20160359909A1 (en) | Virtual private network based parental control service | |
AU2012234904A1 (en) | Providing network content |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |
|
AS | Assignment |
Owner name: THOROUGHBRED, SERIES 71 OF ALLIED SECURITY TRUST I Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:NETWORK PROTECTION SCIENCES, LLC;REEL/FRAME:035389/0422 Effective date: 20150409 |