A METHOD AND A SERVER FOR EVALUATING A REQUEST FOR ACCESS TO CONTENT FROM A SERVER IN A COMPUTER NETWORK

The invention concerns a method to evaluate, in particular on a server (101), a request for access to content from a further server (130) in a computer network (100), wherein upon receipt of the request for access to the further server (130) comprising information about the further server (130), a test is performed to determine whether the access is allowed or denied, the test comprising the steps of—sending a further request for user input to confirm the request for access comprising information about the further server (130) to a pre-determined device (120) in case no link can be established between the information about the further server (130) and pre-determined information about servers,—evaluating the request upon receipt of a response to said further request.

FIELD OF THE INVENTION

The invention relates to a method, a server, a computer program and a computer program product for evaluating a request for access to content from a server in a computer network.

BACKGROUND

In an implementation capable to evaluate a request for access to content from a server in a computer network a firewall installed between the client and the server is used in order to filter undesired requests for access to the content from the server. Such firewalls typically are implemented either on the client or on a network node between the client and the server. Another implementation capable of evaluating such requests for access to content from a server comprise of a proxy server that is adapted to evaluate requests for access to content from servers for example based on blacklists or whitelists. Blacklists and whitelists in this context are for example data files comprising a list addresses, Unified Resource Locators, keywords or any other means to identify servers or content that is to be blocked (Blacklist) or allowed (whitelist). In yet another implementation capable of evaluating request for access to content from a server, content filtering software is used to block requests based on the content requested.

These implementations work automatically and process requests from clients for access to servers for example in the internet.

However, firewalls, proxy servers and content filtering software need to be configured and updated frequently in order to block undesired requests properly. Typically this configuration and updates are triggered by an administrator on a regular basis for example once a day. Blacklists and whitelists are for example provided by authorities or private companies and typically are updated once a day.

A significant amount of work is required to personalize the settings of firewalls, proxy servers and content filtering software in order to fit the settings to the need of a certain client. The changes being triggered by administrators or update processes on the server the solutions using firewalls, proxy servers and content filtering software are static within an update cycle. They do not allow on-the-fly control of the configuration of the settings of the details.

SUMMARY

The object of the invention is thus to provide a more dynamic access control.

The main idea of the invention is to evaluate, in particular on a server, a request for access to content from a further server in a computer network, wherein upon receipt of the request for access to the further server comprising information about the further server, a test is performed to determine whether the access is allowed or denied, the test comprising the steps ofsending a further request for user input to confirm the request for access comprising information about the further server to a pre-determined device in case no link can be established between the information about the further server and pre-determined information about servers,evaluating the request upon receipt of a response to said further request. This way the evaluation is performed request based and forwarded to a pre-determined device for approval in case the automatic evaluation failed. This allows dynamic configuration of the static setting in real time.

Advantageously the further request comprises information about at least a part of the content, in particular a preview of the content, requested from the further server. This way the pre-determined device can be used to take a look at the requested content to facilitate the approval decision.

Advantageously the further request is sent with information about the requester, in particular the username. This allows identifying the requester on the pre-determined device to facilitate the approval decision, for example in cases where one pre-determined device is used to control access of several different requesters.

Advantageously the pre-determined device is selected from a plurality of pre-determined devices depending on information about the requester, in particular an identification of a client device determined from the request. This way a method can be applied using several different pre-determined devices, for example for each requester a pre-determined device.

Advantageously a message comprising information about the result of the evaluation is sent in particular in a short message service message, in particular from the server to the client device.

Advantageously the result of the evaluation is stored, in particular in a blacklist or whitelist on the client device.

Advantageously a direct link between the client device and the further server is established via a further data link only after the access is allowed.

Advantageously a server, a computer program or a computer program product is adapted or operable to implement the method.

Further developments of the invention can be gathered from dependant claims and the following description.

DESCRIPTION OF THE EMBODIMENTS

FIG. 1shows part of a computer network100comprising a server101, a client device110, a pre-determined device120and a further server130. The servers and devices are connectable to each other via data links depicted as solid lines inFIG. 1. The data links are for example according to the internet protocol multimedia subsystem well known as IMS.

For example transmission control protocol/internet protocol links well known as TCP/IP links are used between the server101and the further server130. For example a wireless data link according to the IEEE811.2or the long term evolution standard (well known as LTE) is used to connect the client device110or the pre-determined device120to the computer network100. The data links may connect the servers and devices directly or via multiple network nodes.

The client device110and the pre-determined device120are, for example, mobile phones, smartphones, or personal computers.

The server101comprises a receiver102and a sender102for example a transceiver adapted or operable to send and receive data in particular messages. The server101furthermore comprises a processor103adapted or operable to execute a computer program and storage104to store a computer program for implementing the method described below.

The server101according to a first embodiment of the invention is a Short Message Service Gateway, specialized in sending and receiving Short Message Service Messages well known as SMS. According to the first embodiment the server101operates as a proxy server in the computer network100. In this embodiment the client device110is a smartphone configured to access the computer network100only via the proxy server101. The data link between the two is adapted or operable to allow sending of Short Message Service Messages and other data as well. Methods to configure smartphones to connect to the computer network100only via a pre-determined proxy server are well known to a person skilled in the art and not explained here in detail.

A first method for evaluating a request for access to content from the further server130is described below making reference to the sequence diagram of theFIG. 2. In this method the further server130is an Internet web server providing access to content via the hypertext transfer protocol well known as HTTP. The method is described using the server101according to the first embodiment of the invention. The method applies likewise if the server101according to the second embodiment of the invention is implemented as add-on to the smartphone's internet web browser. The only difference there is then, that the messages sent between the server101and the client device110are internal messages in the second embodiment of the invention.

Unified resource locators, internet protocol addresses or any other type of addressing the content or the further server130may be used instead of the hyper text transfer protocol.

The method for example starts upon receipt of user input on the client device110. The user input for example is a hypertext transfer protocol address typed by a user into an address field of the smartphone's internet web browser via a graphical user interface of the client device110.

After the start a message201, request, is sent from the client device110to the server101. The message201is for example a request for access to content from further server130. The message201for example comprises information about the further server130. For example the request in message201comprises of an internet protocol address of the further server130. Alternatively the message201may comprise any other type of information allowing identifying the content or the further server130in the computer network100. Upon receipt of the message201, request for access to the further server130, in a step202a test is performed to determine whether the access to the further server130is allowed or denied.

In step202it is determined whether a link between the information about further server130and pre-determined information about servers of the computer network100can be established or not. The link consists for example of a match in filter rules like a blacklist or a whitelist that are used to identify internet protocol addresses that are allowed or denied. For example the information about the further server130is the internet protocol address of the further server130received in the message201. In this case for example the access is allowed in case the Internet protocol address is stored in the whitelist of servers of the computer network100that may be accessed. Likewise the access is denied in case the internet protocol address of the further server is not on the whitelist or is listed on the blacklist.

Afterwards a message203, request content from the further server130, is sent from the server101to the further server130.

Upon receipt of the request for content in message203the further server130sends a message204, response, including the requested content to the server101. The request and response messages203and204are for example hypertext transport protocol requests and responses.

In case the decision to allow or deny access can be made in step202the method continues by providing the requested access. This means that in case access is allowed by the server101in step202the response in message204is forwarded to the client device110. In case access is denied by the server101in step202the response in message204is not forwarded to the client device110.

Alternatively to sending the messages203,204after step202the messages request203and response204are not sent in case access is denied by the server101in step202.

Optionally a response message not displayed inFIG. 2is sent from the server101to the client device110in case the access is denied in step202. The response message is for example an error message.

In case no link can be established between the information about the further server130and pre-determined information about servers in step202it may be unclear from the static configuration of the proxy server whether access shall be granted or denied. According to the method a further request205is sent to a pre-determined device120. The further request205is a request for user input to confirm the message request201. The further request205comprises information about the further server130or the requested content. In the example the further request205is sent to the pre-determined device120in case the internet protocol address of the further server130is neither in the blacklist nor in the whitelist.

According to the example the pre-determined device120is a mobile phone adapted or operable to receive the further request205and display a prompt for user input according to the further request205. For example the further request205is a message comprising information about at least a part of the content requested, in particular a preview of the content requested from the further server130. In this case the further request205is sent after the response message204comprising the content of further server130has been received at server101.

Additionally or alternatively the further request205is sent with information about the requester, in particular, a username of the requester. To that end, for example, the client device110is identified by its internet protocol address and met to a particular username stored on the storage104in a list mapping users to client devices110.

In case a plurality of pre-determined devices120are managed by the server101the pre-determined device120is selected from the plurality of pre-determined devices depending on the information about the requester, in particular an identification of the client device110determined from the request message201. For example the internet protocol address of the client device110is determined from the message201and mapped to the pre-determined device120that is to be selected from the plurality of pre-determined devices. To that end, for example, the storage104comprises a list of pre-determined devices120and the mapping to respective Internet protocol addresses of client devices110.

Upon receipt of the further request205, the pre-determined device120is adapted or operable to prompt for a user input in a step206. The user prompt may comprise information about the requester or the content as received in the further request205. In any case the pre-determined device120is adapted or operable to send a response207upon receipt of a user input. The user input is for example detected by a graphical user interface of the pre-determined device120.

The response207to the further request205is either to allow or to deny access to the requested further server130.

This response207is determined depending on the user input, for example, to allow the access to the further server in case the pre-determined device120determines that the user input indicates that access shall be granted. Such user interfaces are well known to the person skilled in the art and not explained further here. For example, a touchscreen display on the pre-determined device120is used to display an allow or deny button next to the request for access showing the hypertext protocol address of the further server120, the requester and/or the preview of the content requested.

The response is sent in a message207from pre-determined device120to the server101.

Upon receipt of the response to the further request205in message207the request201is evaluated in a step208. For example, access to the further server130is allowed in case the response to the further request205received in message207indicated to allow access. Likewise, the access to the further server130is denied in case the response207indicates that access is denied.

In case the access is allowed or denied, a message209is sent from the server101to the client device110. The message209comprises information about the result of the evaluation, for example, an indication whether the access is allowed or denied. Alternatively or additionally the message209may comprise the content requested from the further server130by the client device110. In this case the response message209may not comprise a dedicated indication that access is allowed.

Furthermore, message209is optional and may be omitted in case of the denial of the access.

Alternatively in case no preview is sent in the further request205, the request203and response204may not be sent after step202but at a later time after the approval has been received in response207to the further request205. In this case the request203and response204may not be sent in case the access was denied in the response207.

According to a second embodiment of the invention the server101is a Short Message Service Gateway, specialized in sending and receiving Short Message Service Messages well known as SMS. According to the second embodiment SMS based authorization is implemented in the client device110for example as a web browser add-on integrated in the smartphone's internet web browser.FIG. 3shows another part of the computer network100that comprises the server101, the client device110, the pre-determined device120and the further server130according to the second embodiment. In this case the client device110, for example the smartphone, is configured to access the computer network100via a further data link. The further data link is depicted as dashed line between the client device110and the further server130inFIG. 3. The connection between the client device110and the further server130may be directly as depicted inFIG. 3or via one or more network nodes in between the two. Furthermore the data link between the client device110and the server101is adapted or operable to transfer Short Message Service Messages between the two. According to this second embodiment, the client device110is adapted or operable to perform a SMS based authorization i.e. to send request for access to the further server130as a Short Message Service Message and to receive a response either granting or denying access in a Short Message Service Message.

Furthermore the SMS based authorization comprises of allowing or denying access depending on the content of the received Short Message Service Message. For example the client device110is adapted or operable to allow access to the computer network100only via the browser add-on implementing the functions of SMS based authorization. In this case also the receiver102and the sender102as well as the processor103and the storage104are part of the server101. Alternatively they may be part of the client device110, for example the smartphone.

A second method for evaluating a request for access to content from the further server130is described below making reference to the sequence diagram of theFIG. 4. In this method the further server130is an internet web server providing access to content via the hypertext transfer protocol well known as HTTP. The method is described using the server101, the client device110and the pre-determined device120according to the second embodiment of the invention. The steps201to208according to the first method apply likewise in the second method and are labeled identically inFIG. 4.

Furthermore the in case the access is allowed or denied, according to the second method the message209is sent from the server101to the client device110. The message209comprises information about the result of the evaluation, for example, an indication whether the access is allowed or denied.

Upon receipt of the message209the client device101determines in a step210whether access is allowed or denied. Furthermore the client device101is adapted or operable to establish a connection211to the further server130via the further data link directly when access is allowed or to deny access otherwise by not establishing the connection211. In the latter case an error message may be displayed. The direct connection211hence is a direct link, i.e. not via the server101, to the further server130only after successful authorization.

Message209is optional and may be omitted in case of the denial of the access. In this case the client device110is configured to not allow access in case no response is received.

For example the browser add-on is adapted or operable to perform the steps described above.

The methods described allows prompting the user of the pre-determined device120for approval or denial of access to the further server130and the content of the further server130before the client device110is able to access the content or information on the further server130. Because the automatic filter rules like blacklist and whitelist are not the only indication whether access shall be allowed or denied the method described above improves the evaluation of the requests for access and allows real-time configuration of the access control.

In an amendment to either of the two embodiments described above the result of the evaluation regarding access or denial may be stored, for example, as new filter rules or new blacklist or whitelist entries. This way the filter rules like blacklist and whitelist are automatically updated based on the decision of the approval received from the pre-determined device120.

According to the second embodiment the blacklist/whitelist entries may be stored on the client device110in step210as well.

In the specific embodiment of the invention described above in the first embodiment request205and response207and in the second embodiment messages201,205,207and209are messages according to the Short Message Service well known as SMS. In this cases the server101comprises a Short Message Service gateway adapted or operable to send the requests and receive the responses of the messages respectively as Short Message

Service messages. In case of the first embodiment the server101is adapted or operable to create Short Message Service messages from the request message201and optionally the content received in the response message204in order to provide the pre-determined device120with the further request205. Likewise the server101is adapted or operable to receive the response207as Short Message Service message from the pre-determined device120and determine whether the access is allowed or denied by processing the content of the Short Message Service message in step208. In case of the second embodiment, the messages201,205,207and209are processed as SMS.

In this case the pre-determined device120is adapted or operable to send the response in a Short Message Service message and to determine the content of this message. The pre-determined device120is for example adapted or operable to display the content of the request received in the Short Message Service message optionally with the preview of the requested content. For example the string “allowed” or the string “denied” is displayed next to a user prompt and the response is sent in a Short Message Service message, for example, containing the string “allowed” or the string “denied” depending on whether the user input detected by pre-determined device120is “allowed” or “denied”.

Instead of using Short Message Service messages, any other protocol or method for sending the respective data may be used.

Furthermore the server101or the client device110may comprise of an interface allowing access to the storage104and to configure the filter rules of the server101, e.g. blacklists or whitelists.

Furthermore, the address of the pre-determined device120or the mapping of the pre-determined device120to the client device110may be configured via this interface.

Optionally a plurality of pre-determined devices120and individual mappings to client devices110may be configured this way as well.