# US 9,438,683 B2 · Router-host logging

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,438,683 B2
- Document ID: US9438683B2
- Status: Granted
- Kind: B2
- Application number: 11/395,540
- Filed: 2006-04-03
- Published: 2006-10-26
- Granted: 2016-09-06
- Earliest claimed: 2005-04-04
- Assignees: AOL Inc.
- Applicants: Jeffrey Joseph Damick; Sean Cunningham
- Inventors: Jeffrey Joseph Damick; Sean Cunningham
- Web page: https://patentgrep.com/patent/US9438683B2

## CPC

- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/102: {Entity profiles}
- H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals}
- H04L 67/52: specially adapted for the location of the user terminal
- H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)}
- H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54)
- H04L 67/564: Enhancement of application control based on intercepted application data
- H04L 67/63: Routing a service request depending on the request content or context
- H04W 12/08: Access security
- H04W 24/10: Scheduling measurement reports {; Arrangements for measurement reports}
- H04W 48/08: Access restriction or access information delivery, e.g. discovery data delivery (signalling during connection H04W76/00)
- H04L 63/0263: {Rule management}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

According to a general aspect, a method includes receiving, at a network interface device at a user location, a request from a first machine located at the user location, the request including a first-machine identifier and a request to access through the network interface device a first location on a network. The method also includes logging, at the network interface device, the request from the first machine into a first-machine log for requests from the first machine, the logging into the first-machine log being based on the first-machine identifier. The method also includes receiving at the network interface device a request from a second machine located at the user location, the request from the second machine including a second-machine identifier and a request to access through the network interface device a second location on the network, and the network interface device, the first machine, and the second machine being located at a user location. The method further includes logging, at the network interface device, the request from the second machine into a second-machine log for all requests from the second machine, the logging into the second-machine log being based on the second-machine identifier.

## Claims

### Claim 1

A method comprising the following operations performed by one or more processors:
receiving, at a router associated with a local network at a user location, a request from a first machine on the local network, the request including a first-machine identifier and a request to access through the router a first location on the Internet;
determining, by the router based on the first-machine identifier, that the first machine is associated with the router and the local network, and accessing a first-machine network access rule associated with the first-machine identifier, wherein the accessing the first-machine network access rule includes:
forwarding, by the router, a request to a host to access the first-machine network access rule for the first machine, the request to the host including a device token associated with the router and an identification parameter associated with the router for enabling the host to verify the identity of the router based on regeneration of the device token according to the identification parameter;
determining, by the router and based on the accessed first-machine network access rule, to grant the first machine access to the first location on the Internet;
logging, at the router, the request from the first machine into a first-machine log for requests from the first machine, the logging into the first-machine log being based on the first-machine identifier and including the determination to grant the first machine access to the first location on the Internet;
receiving, at the router, a request from a second machine on the local network, the request from the second machine including a second-machine identifier and a request to access through the router the first location on the Internet;
determining, by the router based on the second-machine identifier, that the second machine is not associated with the router and the local network, and accessing a non-associated-machine network access rule;
determining, by the router and based on the accessed non-associated-machine network access rule, to deny the second machine access to the first location on the Internet, the non-associated-machine network access rule providing limited access to Internet locations relative to the first-machine-network access rule;
logging, at the router, the request from the second machine into a second-machine log for requests from the second machine, the logging into the second-machine log being based on the second-machine identifier and including the determination to deny the second machine access to the first location on the Internet; and
sending, from the router over the Internet to a computer system at a second location on the Internet, the first-machine log and the second-machine log.

### Claim 2 (depends on 1)

The method of claim 1, wherein receiving the request from the second machine comprises receiving the request from the second machine while the router is coupled to both the first machine and the second machine.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
receiving, at the router, a second request from the first machine, the second request from the first machine including the first-machine identifier and a request to access through the router a third location on the Internet; and
logging, at the router, the second request from the first machine into the first-machine log, the logging into the first-machine log being based on the first-machine identifier; and wherein:
the request from the first machine is sent using a first user identity that is logged in to a first account in a network service provider, and
the second request from the first machine is sent using a second user identity that is logged in to a second account in the network service provider.

### Claim 4 (depends on 3)

The method of claim 3, further comprising:
determining, by the router and based on the accessed first-machine network access rule, whether to grant the first machine access to the third location on the Internet.

### Claim 5 (depends on 1)

The method of claim 1, wherein the non-associated-machine network access rule provides that the second machine is prohibited from accessing the first location on the Internet based on the determination that the second machine is not associated with the router and the local network.

### Claim 6 (depends on 1)

The method of claim 1, further comprising providing the first-machine log and the second-machine log to the host.

### Claim 7 (depends on 6)

The method of claim 6, further comprising receiving at the router the token from the host, and
wherein providing the first-machine log to the host further comprises transmitting a communication to the host based on the token.

### Claim 8 (depends on 1)

The method of claim 1, wherein the first-machine log includes multiple requests from the first machine, the second-machine log includes multiple requests from the second machine, and the method further comprises:
providing the first-machine log and the second-machine log to the host;
receiving at the host settings from a control user associated with the router and the local network, wherein the settings include:
first-machine report compilation instructions specifying how to compile requests from the first machine in the first-machine log, and
second-machine report compilation instructions specifying how to compile requests from the second machine in the second-machine log;
compiling requests from the first-machine log according to the first-machine report compilation settings;
compiling requests from the second-machine log according to the second-machine report compilation settings;
generating at least one report based on the compiled requests from the first-machine log and the compiled requests from the second-machine log; and
providing the at least one report to the control user.

### Claim 9 (depends on 8)

The method of claim 8, wherein providing the at least one report to the control user comprises sending the at least one report to the control user in an email.

### Claim 10 (depends on 8)

The method of claim 8, wherein providing the at least one report to the control user comprises making the at least one report accessible to the control user.

### Claim 11 (depends on 8)

The method of claim 8, wherein:
the first-machine report compilation instructions and the second-machine report compilation instructions are different;
generating at least one report comprises:
generating a first report based on the compiled requests from the first-machine log, and
generating a second report based on the compiled requests from the second-machine log; and
providing the at least one report comprises:
providing the first report to the control user, and
providing the second report to the control user.

### Claim 12 (depends on 1)

The method of claim 1, wherein the logged request from the first machine includes a time at which the request was received at the router.

### Claim 13 (depends on 1)

The method of claim 1, further comprising:
receiving, at the router from a third machine, a request to view a report of requests from the first and second machines, and
sending, from the router to the computer system at the second location on the Internet, the request to view the report of requests from the first and second machines; and
enabling the report of requests from the first and second machines to be received from the computer system at the second location on the Internet, wherein the enabling includes:
receiving, at the router from the computer system at the second location of the Internet, the report of requests from the first and second machines, and
sending, from the router to the third machine, the report of requests from the first and second machines received from the computer system at the second location on the Internet.

### Claim 14 (depends on 1)

The method of claim 1, wherein the router associated with the local network at a user location is configured to control access to the Internet for each machine on the local network.

### Claim 15 (depends on 1)

The method of claim 1, wherein the determining that the first machine is associated with the router and the local network is based on whether a profile designating access control for the first machine on the local network has been established.