Abstract:
Protection against spoofing is provided in a LAN having at least two service classes, where one service class includes allows access to the LAN, the internet, and the intranet containing the LAN and a more limited service class which allows access to the LAN and the internet but not the intranet databases. A user gains access to the LAN using his or her ID which identifies the user&#39;s access level. To prevent limited access users from gaining access to the intranet by changing addresses, the system continuously performs periodic checks for address changes. If there is an address change, the port assigned to, or used by the user, is disabled throwing the user off the LAN prior to his or her obtaining the requested data.

Description:
RELATED APPLICATIONS 
     The contents of the following listed applications are hereby incorporated by reference: 
     (1) U.S. patent application Ser. No. 10/157,243, filed on May 30, 2002 and entitled “Method and Apparatus for Providing Multiple Views of Virtual Documents” which application was published on Dec. 4, 2003 as Publication #US20030225722A1. 
     (2) U.S. patent application Ser. No. 10/159,373, filed on Jun. 3, 2002 and entitled “A System and Method for Generating and Retrieving Different Document Layouts from a Given Content” which application has now issued as U.S. Pat. No. 7,254,571 on Aug. 17, 2007. 
     (3) U.S. patent application Ser. No. 10/180,195, filed on Jun. 27, 2002 and entitled “Retrieving Matching Documents by Queries in Any National Language” which application has now issued as U.S. Pat. No. 7,260,570 on Aug. 21, 2007. 
     (4) U.S. patent application Ser. No. 10/202,564 filed on Jul. 23, 2002 and entitled “Method of Search Optimization Based on Generation of Context Focused Queries” which application was published Jan. 29, 2004 as Publication #US20040019588A1. 
     (5) U.S. patent application Ser. No. 10/209,619 filed on Jul. 31, 2002 and entitled “A Method of Query Routing Optimization” which application has now issued as U.S. Pat. No. 7,143,085 on Nov. 28, 2006. 
     (6) U.S. patent application Ser. No. 10/066,346 filed on Feb. 1, 2002 and entitled “Method and System for Searching a Multi-Lingual Database” which application has now issued as U.S. Pat. No. 6,952,691 on Oct. 4, 2005. 
     (7) U.S. patent application Ser. No. 10/229,552 filed on Aug. 28, 2002 and entitled “Universal Search Management Over One or More Networks” which application has now issued as U.S. Pat. No. 7,092,938 on Aug. 15, 2006. 
     (8) U.S. patent application Ser. No. 10/302,108 filed on Nov. 22, 2002 and entitled “An International Information Search and Delivery System Providing Search Results Personalized to a Particular Natural Language” which application has now issued as U.S. Pat. No. 7,039,625 on May 2, 2006. 
     (9) U.S. patent application Ser. No. 10/412,808 filed on Apr. 11, 2003 and entitled “Dynamic Comparison of Search Systems in a Controlled Environment.” 
     FIELD OF THE INVENTION 
     The present invention relates to network security in secured intranet work sites connected to the internet. More particularly, it relates to security from access of protected information the secured network from within the secured site by unauthorized users. 
     BACKGROUND OF THE INVENTION 
     In a protected intranet site, it is desirable that a local area network (LAN) be provided with two or more service classes. One of the service classes could be a broad service class which could permit access to the LAN, the internet and an intranet containing the LAN. Other service classes would limit access to one or more of the LAN and the intranet In a LAN, a user is assigned a workplace location identified by a LAN address (MAC) and logical address (IP). Based on the user&#39;s personal identification (ID) on the intranet, the MAC and IP addresses are assigned a level of access to the networks and the information in them. However, this mode of protection can be defeated by a procedure called “Spoofing” where a user masquerades as someone else on the intranet and bypasses several levels of security. An example of spoofing would be to change a LAN work station location from one physical address and/or logical address to another after access has been obtained for the work station. 
     Therefore it is an object of the present invention to improve network security and/or accessibility in security in secured intranet work sites. 
     It is further an object of the present invention to provide increased security protection for such intra work sites by unauthorized users using insecure work site. 
     BRIEF DESCRIPTION OF THE INVENTION 
     In accordance with the present invention, protection against spoofing is provided in a LAN which has at least two service classes, one access class that allows access to the LAN, the internet, and a intranet containing the LAN and the other class which allows access to the LAN and the internet but not the intranet. A user gains access to the LAN using his/her ID which identifies the user as having broad access that includes access to intranet databases or more limited access which excludes access to the intranet databases. To prevent limited access users from gaining access to the intranet databases by changing addresses, the LAN continuously performs periodic checks for address changes at a rate which insures the check proceeds any data request. If there is an address change, the port assigned to the user and/or the one he/she is using is disabled throwing the user off the LAN without obtaining the requested data. 
    
    
     
       DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a schematic diagram for system organization of an on-line area network; 
         FIG. 2  is a schematic diagram of a private network incorporating the present invention and connected to the network shown in  FIG. 1 ; 
         FIG. 3  is a schematic diagram showing arrangement of LANs within the private network of  FIG. 2 ; 
         FIG. 4  is a flow diagram of software of the present invention for use on a LAN with dynamic site application; and 
         FIG. 5  is a schematic diagram showing software for the present invention for use in connection with a LAN having fixed site applications. 
     
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
     Referring now to  FIG. 1 , communication between a plurality of user computers  100   a  to  100   n  and a plurality of information servers  102   a  to  102   n  is accomplished via an on-line service through a wide area network such as the Internet  104  that includes network node servers. The network node servers manage network traffic such as the communications between any given user&#39;s computer and an information server. 
     The computers  100  are equipped with communications software, including a WWW browser such as the Netscape browser of Netscape Communications Corporation, that allows a shopper to connect and use on-line shopping services via the Internet. The software on a user&#39;s computer  100  manages the display of information received from the servers to the user and communicates the user&#39;s actions back to the appropriate information servers  102  so that additional display information may be presented to the user or the information acted on. The connections  106  to the network nodes of the Internet may be established via a modem or other means such as a cable connection. 
     The servers illustrated in  FIG. 1 , and discussed hereafter, are those of merchants which, for a fee provide products, services and information over the Internet. While the following discussion is directed at communication between shoppers and such merchants over the Internet, it is generally applicable to any information seeker and any information provider on a network. (For instance, the information provider can be a library such as a University library, a public library or the Library of Congress or other type of information providers.) Information regarding a merchant and the merchant&#39;s products is stored in a shopping database  108  to which the merchants servers  102  have access. This may be the merchants own database or a database of a supplier of the merchant. All product information accessible by the merchant servers that is publishable as web pages is indexed and a full-text index database  110  which records the number of occurrences of each of the words and their use in the location. In addition to the servers of individual merchants, and other information providers, there are the servers  114   a  to  114  of plurality of search service providers, such as Google of Google, Inc., which providers maintain full text indexes  116  of the products of the individual merchants  102   a  to  102   n  obtained by interrogating the product information databases  108  of the individual merchants. Some of these search service providers, like Google, are general purpose search providers while others are topic specific search providers. 
     The merchants and the search application service providers each may maintain a database of information about shoppers and their buying habits to customize on-line shopping for the shopper. Operations to accomplish a customized electronic shopping environment for the shopper include accumulating data regarding the shopper&#39;s preferences. Data relating to the electronic shopping options, such as specific sites and specific products selected by the shopper, entry and exit times for the sites, number of visits to the sites, etc., are recorded and processed by each merchant to create a shopping profile for the shopper. Raw data may then be processed to create a preference profile for the shopper. The profile may also include personal data or characteristics (e.g. age, occupation, address, hobbies) regarding the shopper as provided by the shopper when subscribing to the service or obtained from other sources. Profile data can help in discerning the meaning of words used in a keyword query. For instance, a keyword in the query of a medical doctor could have an entirely different meaning to the use of the same keyword presented by a civil engineer. The data accumulation on the shoppers are placed in the shoppers profile database  112  or  118  of each of the merchants. Each individual shopper&#39;s profile in the databases of the merchants and the search application service providers can differ from one to another based on the particular merchant&#39;s or service providers experience with the shopper and their profiling software. Data collection may continue during searches made by the shopper so that up-to-date profile data for the shopper is obtained and used. 
     With information regarding the shopper involved in the shopping transaction, the merchant is able to meet the needs of the shopper, and the shopper is presented with the opportunity to view and purchase that merchandise that is most likely to be of interest since the merchant&#39;s products and services are directed toward those shoppers who have, either directly or indirectly, expressed an interest in them. 
     When the search characteristics in the form for key words are entered by the shopper into the space provided on the default or home page of his/her browser, the search engine of the merchant web server  102  does a search of the accessed full text index database  110  or  118  using the key words and gets a list of documents describing those products and services that contain matches to the key words. This list of documents contain basic test ranking Tf (including the number of hits, their location, etc. which are used to order the list of documents) with documents with higher scores at the top. This list is then sent to a ranking module which will apply a ranking algorithm, such as the one described in the article entitled “The Anatomy of a Large-Scale Hypertextual Web Search Engine” by Sergey Brin and Lawrence Page of the Computer Science Department, Stanford University, Stanford Calif. 94305 (which article is hereby incorporated by reference) to rank the list of documents using the text factors and other rank factors, such as link analysis, popularity, the user&#39;s preferences from the users profile, and may also introduce factors reflecting the information, providers biases and interests. A reordered list of documents based on the ranking algorithm is then provided to the user. 
       FIG. 2  shows how an intranet search management server  120  can be used as one of the merchants web server  120  of  FIG. 1  which is incorporated into a merchant&#39;s internal network to obtain information from the merchant and supply it to a user. As shown in  FIG. 2 , the server  120  is connected in the private intranet network  200  which has a network server  202  and a number of computers  100 , such as those described in  FIG. 1 , arranged on multiple  1  LANS  224  so that the computers  100  can obtain information stored in the internal sources of the private intranet. The LANS  224  can be located at a number of different internal corporate sites. 
     The search management server  120  contains an integrated search management system which receives queries and information from search engines both in the intranet and internet and accesses information sources that are in the intranet and internet through the computers  100 . The integrated management server contains a central processing unit  230 , network interfaces  232  and sufficient random access memory  234  and high density storage  236  to perform its functions. In addition to its connection to the intranet, the search management system contains a direct link  226  to the internet to enable access of certain merchant data files by customers of the merchant. 
     The intranet  200  is provided with public internet access capability which provides access to services on the public internet  104 . Except for access through the search management system, a “firewall”  222  separates the public internet  104  from the private intranet  200  allowing only those with the proper ID and password to enter the intranet  200  from the public internet  104 . Internal sources of the intranet  200  are company document management systems  204 , and internal databases  206 . 
     While firewall  222  and virus protection software can protect against intruders from the external network  104 , there is still the problem from users of these LANs of the intranet. As best shown in  FIG. 3 , the internal sites of a corporation contain a significant number of LANs  224   a  to  n , where each LAN is devoted to a specific corporate site location and/or to a specific purpose of the corporation, such as development of new products, marketing analysis and corporate business information. The corporate intranet  200  is coupled to the internet  104  through a router  304 . Also, the connections to various LANs through a router of the particular LAN  308 . In each of the LANs  224  there is a dynamic host control (DHCP) server  310  which controls that LAN&#39;s operation and access to the LAN and instructs the router to direct traffic between workstations  100  at ports  312  of the LAN and the intranet, the internet and other LANs on the internet. At various LANs at locations within the corporation, there are various categories of users. Some users would have access to the information on the internet, intranet and that LAN, such as regular corporate employees. Other users would have restricted access to information on a particular LAN and access to the internet without any access to the intranet and its resources  204 ,  206 . An example of such a user would be a subcontractor&#39;s employee. Other groups of people would have more restricted access. For instance, visitors may be limited to only access on the internet. Other individuals may have greater access than most employees have to corporate information. For instance, workers on two LANs cooperating to produce a new product may share access to their databases. 
     A problem encountered with such an arrangement to multiple security levels is restraining people&#39;s access to their assigned security level. This problem exists whether access is assigned statically where a port always has the same access restrictions, or preferably dynamically where a port&#39;s access restrictions are determined from the users ID. 
     Referring now to  FIG. 4 , when a user tries to establish communication from a workstation over LAN ports in step  400 , the machine requests the user ID and a password for the user in step  402 . The software on the DHCP server determines whether the user has LAN access in step  404  and if not, it is determined by step  405  that the number of permitted tries have been exceeded and disables the port in step  406 . If the number of tries has not been exceeded, the user is given another try to gain access. If access is granted, he can proceed as if initially granted to step. If it turns out the user can be granted access to the LAN, software on the DHCP server determines the limitations on that access in step  408 . This would involve looking up the user&#39;s ID on the intranet to determine his security status with its limitations and if not already done so, store them in the DHCP along with the user&#39;s ID, his IP and his MAC address in step  410 . 
     If the user is a visitor, he/she may obtain a temporary ID which would provide limited access out of the intranet to the internet only, in steps  412  and  414 , so that he can communicate through the internet as if he were any other internet user. In this case, communication back to the interne or to a particular LAN, other LANS and other intranet sites would be through the firewall. 
     Each of the LAN port sites are periodically checked in steps  416  and  418  to see if the MAC IP and the ID assigned to that port site are the ones using the port. That is if a user would try to change ports to obtain less limited access this would be noted and the system in step  420  would disable the port and notify security. The reasons for changing ports may be proper but the risk of losing valuable corporate data outweighs any inconveniences caused by the disabling of the port. This includes checking the users security data in the LAN and intranet database one against the other to see if they compare. The periodic checking is rapid to assure that a check always proceeds a user&#39;s request for data If the port is used properly and there is no address changes or any differences between the user&#39;s security level data in the LAN and intranet databases, use of the port  422  can be continued until access is terminated by the user in step  423 . The requests are checked in steps  426  and  428  to see if they are proper. If not, the port is disabled. If they are, proper access is provided in step  432 . 
     The embodiment described above is for dynamically assigned port use restrictions. In certain LANs, the restrictions are fixed for particular ports which would enable a visitor to use a port with only access to the internet, a subcontractor to use a port which would be limited to access to the LAN and the internet and an employee of the corporation to use a less restricted port for the LAN. In  FIG. 5 , steps with functions similar to those in  FIG. 4 , are assigned the same number. The difference being, the two systems the step of determining in step  500  if the user is on a proper port and if not, informing the user that he should change his port in step  502  to one appropriate for the restrictions of his use. Once on a proper port, the user must provide requested user ID and password in step  402  to continue the process. 
     Above we have described one embodiment of the invention and modifications of this embodiment may be apparent to those skilled in the art. For this reason it should be understood that the present invention is not limited to the described embodiments but includes all changes that fall within the spirit and scope of the appended claims.