US 10,540,651 B1Granted

Technique for restricting access to information

AssigneeIntuit Inc.

InventorsRodney A. Robinson, Joann Ferguson, Thomas J. Holodnik, Thomas E. Dockman, Spencer W. Fong, Michael P. Owen

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system that communicates information is described. This system includes: a network interface, a proxy device coupled to the network interface, and an interface node coupled to the proxy device and configured to couple to a channel. Note that the network interface is configured to transmit outbound messages from the system to a location and to receive inbound messages to the system from the location, and the channel is configured to convey the outbound messages and the inbound messages. Moreover, the proxy device is configured to inspect a given message inbound or outbound based on a pre-determined profile of the location and pre-defined communication rules. Then, the proxy device is configured to restrict the given message based on a result of the inspection, where the restriction occurs after the system begins a communication session with the location and is performed for the duration of the communication session.

Claims3

Dependent claims

A method to communicate information between a computer and a server via a computer-implemented proxy device, comprising:

receiving, by the computer-implemented proxy device, a message directed to the server from a second user, wherein the message includes a request for information associated with a first user account that is associated with a first user, wherein the second user is different from the first user;
inspecting, by the computer-implemented proxy device, the received message from the second user based on one or more pre-determined profiles and one or more pre-defined communication rules comprising a filter, wherein the inspecting comprises looking for data patterns in the received message using the filter;
determining, based on the inspecting, the message includes a request for information that is restricted from the second user;
in response to determining that the message includes the request for information that is restricted from the second user, preventing the message from triggering access to at least a portion of a uniform resource locator (URL) associated with the first user account by the second user by sending a modified message to the server, wherein the modified message comprises the message with a masked portion;
determining, based on the inspecting, the message includes a request for performing a task that is restricted from the second user on information that is unrestricted from the second user;
and
in response to determining that the message includes the request for performing a task that is restricted from the second user on information that is unrestricted from the second user, preventing the second user from performing the task that is restricted from the second user by filtering the message by the computer-implemented proxy device to produce a filtered message before sending the filtered message to the server.

4 more elements

A non-transitory computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform a method for communicating information between computer and a server via a computer-implemented proxy device, the method comprising:

receiving, by the computer-implemented proxy device, a message directed to the server from a second user, wherein the message includes a request for information associated with a first user account that is associated with a first user, wherein the second user is different from the first user;
inspecting, by the computer-implemented proxy device, the received message from the second user based on one or more pre-determined profiles and one or more pre-defined communication rules comprising a filter, wherein the inspecting comprises looking for data patterns in the received message using the filter;
determining, based on the inspecting, the message includes a request for information that is restricted from the second user;
in response to determining that the message includes the request for information that is restricted from the second user, preventing the message from triggering access to at least a portion of a uniform resource locator (URL) associated with the first user account by the second user by sending a modified message to the server, wherein the modified message comprises the message with a masked portion;
determining, based on the inspecting, the message includes a request for performing a task that is restricted from the second user on information that is unrestricted from the second user;
and
in response to determining that the message includes the request for performing a task that is restricted from the second user on information that is unrestricted from the second user, preventing the second user from performing the task that is restricted from the second user by filtering the message by the computer-implemented proxy device to produce a filtered message before sending the filtered message to the server.

4 more elements

An apparatus, comprising:

a processor;
and
a non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the apparatus to perform a method for communicating information between computer and a server via a computer-implemented proxy device, the method comprising:
receiving, by the computer-implemented proxy device, a message directed to the server from a second user, wherein the message includes a request for information associated with a first user account that is associated with a first user, wherein the second user is different from the first user;
inspecting, by the computer-implemented proxy device, the received message from the second user based on one or more pre-determined profiles and one or more pre-defined communication rules comprising a filter, wherein the inspecting comprises looking for data patterns in the received message using the filter;
determining, based on the inspecting, the message includes a request for information that is restricted from the second user;
in response to determining that the message includes the request for information that is restricted from the second user, preventing the message from triggering access to at least a portion of a uniform resource locator (URL) associated with the first user account by the second user by sending a modified message to the server, wherein the modified message comprises the message with a masked portion;
determining, based on the inspecting, the message includes a request for performing a task that is restricted from the second user on information that is unrestricted from the second user;
and
in response to determining that the message includes the request for performing a task that is restricted from the second user on information that is unrestricted from the second user, preventing the second user from performing the task that is restricted from the second user by filtering the message by the computer-implemented proxy device to produce a filtered message before sending the filtered message to the server.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 11/831,173Filed 31 Jul 2007
Granted: 21 Jan 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 63/02
Network architectures or network communication protocols for network security: for separating internal from external traffic, e.g. firewalls
H04L 63/0227
For separating internal from external traffic, e.g. firewalls: filtering policies
H04L 63/0236
Filtering policies: filtering by address, protocol, port number or service, e.g. IP-address or URL
H04L 63/0281
For separating internal from external traffic, e.g. firewalls: proxies