Source: http://www.freepatentsonline.com/5987611.html
Timestamp: 2018-09-26 00:51:44
Document Index: 499215334

Matched Legal Cases: ['art 1', 'art 2', 'art 3', 'art 4', 'art 5', 'art 1', 'art 2', 'art 3', 'art 4', 'art 5']

System and methodology for managing internet access on a per application basis for client computers connected to the internet - Zone Labs, Inc.
United States Patent 5987611
Freund, Gregor (San Francisco, CA)
08/851777
Zone Labs, Inc. (San Francisco, CA)
H04L12/26; H04L12/28; H04L29/06; H04L29/08; (IPC1-7): G06F13/00
395/187.01, 395/186, 364/222.5, 364/286.4, 364/286.5, 711/163, 707/9, 707/10, 707/203, 713/200, 713/201
Download PDF 5987611 PDF help
5881230 Method and system for remote automation of object oriented applications 1999-03-09 Christensen et al. 395/200.33
5864665 Auditing login activity in a distributed computing environment 1999-01-26 Tran 395/187.01
5764887 System and method for supporting distributed computing mechanisms in a local area network server environment 1998-06-09 Kells et al. 395/186
Mullender, "Distributed Systems", Second Edition, ACM Press New York, Addison-Wesley, pp. 3. 12-13, 543-578, Dec. 1993.
ORFALI et al., "Essential Client/Server Survival Guide", Van Nostrand Reinhold, pp. 153-154, Dec. 1994.
Postel, J., "RFC 821--Simple Mail Transfer Protocol," Information Science Institute, University of Southern California, Aug. 1982, pp. 1-68.
Croker, D., "RFC 822--Standard for the format of ARPA Internet Text Messages," Department of Electrical Engineering, University of Delaware, Aug. 13, 1982, pp. 1-47.
Postel, J. and Reynolds, J., "RFC 959--File Transfer Protocol (FTP)," Information Science Institute, University of Southern California, Oct. 1985, pp. 1-47.
Kantor, B. (U.C. San Diego) and Lapsley, P. (U.C. Berkeley), "RFC 977--Network News Transfer Protocol, " Feb. 1986, pp. 1-27.
Berners-Lee, T., "RFC 1630--Universal Resource Identifiers in WWW," Jun. 1994, pp. 28.
Klensin, J., Freed, N., Rose, M., Stefferud, E. and Crocker, D., "RFC 1869--SMTP Service Extensions," Nov. 1995, pp. 1-11.
Kessler, G. and Shepard, S., "RFC 1739--A Primer On Internet And TCP/IP Tools," Hill Associates, Inc., Dec. 1994, pp. 1-46.
Myers, J. (Carnegie Mellon) and Rose, M. (Dover Beach Consulting, Inc.), "RFC 1939--Post Office Protocol--Version 3," May 1996, pp. 1-23.
Freed, N., "RFC 2034--SMTP Service Extension for Returning Enhanced Error Codes," Innosoft, Oct. 1996, pp. 1-6.
Freed, N., Borenstein, N., Moore, K., Klensin, J. and Postel, J., "RFC 2045/2046/2047/2048/2049--Multipurpose Internet Mail Extensions (MIME), Part 1: Format of Internet Message Bodies, Part 2: Media Types, Part 3: Message Header Extensions for Non-ASCII Text, Part 4: Registration Procedures, Part 5: Conformance Criteria and Examples," Nov. 1996, Part 1: pp. 1-31, Part 2: pp. 1-44, Part 3: pp. 1-15, Part 4: pp. 1-21, Part 5: pp. 1-24.
Crispin, M., "RFC 2060--Internet Message Access Protocol--Version 4rev1," University of Washington, Dec. 1996, pp. 1-82.
Palme, J. (Stockholm University) and Hopmann, A. (Microsoft Corporation), "RFC 2110--MIME E-mail Encapsulation of Aggregate Documents, such as
The following description will focus on the presently-preferred embodiment of the present invention, which is operative in an Internet-connected environment, including, for instance, client machines running under the Microsoft® Windows environment and connected to an open network, such as a WAN or the Internet. The present invention, however, is not limited to any particular one application or any particular environment. Instead, those skilled in the art will find that the system and methods of the present invention may be advantageously applied to a variety of system and application software, including database management systems, word processors, spreadsheets, and the like, operating on a variety of different platforms, including the Macintosh® operating system, the UNIX® operating system, NextStep® operating system, and the like. Therefore, the description of the exemplary embodiments which follows is for purposes of illustration and not limitation.
System 220 includes a user interface (UI) 260, preferably a Graphical User Interface (GUI), for receiving user commands and data. These inputs, in turn, may be acted upon by the system 100 in accordance with instructions from operating module 240, windows 250, and/or client application module(s) 245. The UI 260 also serves to display the results of operation from the OS 240, windows 250, and application(s) 245, whereupon the user may supply additional inputs or terminate the session. OS 240 and windows 245 can be provided by Microsoft® Windows 95, by Microsoft® Windows NT, or by Microsoft® Windows 3.x (operating in conjunction with MS-DOS); these are available from Microsoft Corporation of Redmond, Wash. Alternatively, OS 240 and windows 245 can be provided by IBM OS/2® (available from IBM of Armonk, N.Y.) or Macintosh® OS (available from Apple Computers of Cupertino, Calif.). Although shown conceptually as a separate module, the UI is typically provided by interaction of the application modules with the windows shell, both operating under OS 240.
The access management application is employed by the LAN administrator, workgroup administrator, and/or LAN user to maintain a database of the access rules for the workstations being administrated. These access rules can include criteria such as total time a user can be connected to the Internet (e.g., per day, week, month, or the like), time a user can interactively use the Internet (e.g., per day, week, month, or the like), a list of applications or application versions that a user can or cannot use in order to access the Internet, a list of URLs (or WAN addresses) that a user application can (or cannot) access, a list of protocols or protocol components (such as Java Script™) that a user application can or cannot use, and rules to determine what events should be logged (including how long are logs to be kept). These access rules can be qualified by optionally specifying: to whom should a rule apply (list of users, list of workgroups, or all); start date and expiration date of a rule; time of day when the rule should be applied (for example from 9 am to 5 pm); whether the rule is "disclosed" to the user or workgroup manager or remains hidden; whether a rule can be overwritten or modified by the workgroup manager or user; and what should happen if a rule is violated (e.g., denying Internet access, issuing a warning, redirecting the access, creating a log entry, or the like).
Client Monitor The monitor component or program that runs on every workstation that can access the Internet Client VxD Kernel mode component of Client Monitor Supervisor The central program that runs on a server or a secure Client Monitor and coordinates the system Application Third party application that can access the Internet or WAN via the WinSock API or a similar API Firewall Third party filter program that sits between the LAN and the Internet Host Third party server prograrn that can be contacted through the Intemet ISP Server Internet Service Provider Server application that authenticates user and serves as gateway to Internet ISP Supervisor Version Qf Supervisor that coordinates Internet access with ISP Server RAS Remote Access Service component of Windows 95/NT that dials the remote computer and initializes the contact ISP Authentication Internet Service Provider Server application that Server authenticates user and serves as gateway to Internet ISP "Sandbox" HTTP Server used when client has only restricted Server Internet access ISP POP Internet Service Provider Point-Of-Presence com- prising modems, server, and router ISP POP Server Server component of ISP POP
With reference to FIG. 4, client-side operation of the system is shown in further detail. As shown in FIG. 4 for client 410, a given client generally includes one or more applications (e.g., applications 421, 423) which require Internet access. A Web browser (e.g., Netscape Navigator™ or Microsoft Internet Explorer™ browser software) is but one of a multitude of such applications. Each application, in turn, communicates directly with a client-side communication driver, such as Winsock driver 430--a Windows implementation and encapsulation of TCP/IP.
Msg: #0000 10020024 Process: ffff38ff Handle: c307bd1c open Len: 00000016 Address: 82859080 C:.backslash.WINDOWS.backslash.SYSTEM.DAT #0001 Msg: 0002000b Process: ffff38ff Handle: c307bd1c close Size: 00000000:000a752c Msg: #0002 00010010 Process: fffae7b7 Handle: 00000000 socket #0003 Msg: 00010110 Process: fffae7b7 Handle: c34075cc socket-x #0004 Msg: 80010003 Process: fffae7b7 Handle: c34075cc connect Family: 0002 Port: 0053 IP: 204.94.129.65 Msg: #0005 00010103 Process: fffae7b7 Handle: c34075cc connect-x Family: 0002 Port: 0053 IP: 204.94.129.65 Msg: #0006 00010004 Process: fffae7b7 Handle: c34075cc getpeername #0007 Msg: 00010104 Process: fffae7b7 Handle: c34075cc getpeername- x #0008 Msg: 0001000d Process: fffae7b7 Handle: c34075cc send Family: 0002 Port: 0053 IP: 204.94.129.65 Len: 00000023 Address: 82859890 00: #0009 Msg: 0001010d Process: fffae7b7 Handle: c34075cc send-x #000a Msg: 0001000a Process: fffae7b7 Handle: 00000000 select- - setup #000b Msg: 0001010a Process: fffae7b7 Handle: 00000000 select- - setup-x #000c Msg: 0001000b Process: fffae7b7 Handle: 00000000 select- - cleanup #000d Msg: 0001010b Process: fffae7b7 Handle: 00000000 select- - cleanup-x #000e Msg: 80010003 Process: fffae7b7 Handle: c34075cc connect #000f Msg: 00010103 Process: fffae7b7 Handle: c34075cc connect-x #0010 Msg: 00010004 Process: fffae7b7 Handle: c34075cc getpeername #0011 Msg: 00010104 Process: fffae7b7 Handle: c34075cc getpeername- x Result: 00002749 WSAENOTCONN Msg: 2 0001000d Process: fffae7b7 Handle: c34075cc send Family: 0002 Port: 0053 JP: 204.94.129.66 Len: 00000023 Address: 8285a290 00: #0013 Msg: 0001010d Process: fffae7b7 Handle: c3407Scc send-x Family: 0002 Port: 0053 IP: 204.94.129.66 Msg: #0014 0001000a Process: fffae7b7 Handle: 00000000 select-- setup #0015 Msg: 0001010a Process: fffae7b7 Handle: 00000000 select- - setup-x #0016 Msg: 0001000b Process: fffae7b7 Handle: 00000000 select-- cleanup #0017 Msg: 0001010b Process: fffae7b7 Handle: 00000000 select-- cleanup-x #0018 Msg: 00010009 Process: fffae7b7 Handle: c34075cc recv #0019 Msg: 00010109 Process: fffae7b7 Handle: c34075cc recv-x Len: 000000ad Address: 8285a990 00 00: 06 85 80 00 01 00 03 00 02 00 02 03 77 77 77 . . . . . . . . . . . . .www 10: 09 77 65 62 6d 6f 6e 6b 65 79 03 63 6f 6d 00 00 .webmonkey.com. . 20: 01 00 01 c0 0c 00 01 00 01 00 00 a8 c0 00 04 cc. . . . . . . . . . . . . . . . 30: 3e 81 13 c0 0c 00 01 00 01 00 00 a8 c0 00 04 cc >. . . . . . . . . . . . . . . 40: 3e 81 93 c0 0c 00 01 00 01 00 00 a8 c0 00 04 cc >. . . . . . . . . . . . . . . 50: 3e 83 93 09 77 65 62 6d 6f 6e 6b 65 79 03 63 6f >. . .webmonkey.co 60: 6d 00 00 02 00 01 00 00 a8 c0 00 0f 03 6e 73 31 m . . . . . . . . . . . .ns1 70: 08 68 6f 74 77 69 72 65 64 c0 5d c0 53 00 02 00 .hotwired.].S . . . 80: 01 00 00 a8 c0 00 06 03 6e 73 32 c0 70 c0 6c 00. . . . . . . .ns2.p.1. 90: 01 00 01 00 00 a8 c0 00 04 cc 3e 84 20 c0 87 00. . . . . . . . . .>. . . a0: 01 00 01 00 00 a8 c0 00 04 cc 3e 82 7c . . . . . . . . . .>.│ Msg: 001a 00010002 Process: fffae7b7 Handle: c34075cc closesocket #001b Msg: 00010102 Process: fffae7b7 Handle: c34075cc closesocket- x #00lc Msg: 00010010 Process: fffae7b7 Handle: 000000CO socket #001d Msg: 00010110 Process: fffae7b7 Handle: c34075cc socket-x #001e Msg: 00010007 Process: fffae7b7 Handle: c34075cc ioctisocket #001f Msg: 00010107 Process: fffae7b7 Handle: c34075cc ioctlsocket-x #0020 Msg: 00010001 Process: fffae7b7 Handle: c34075cc bind #0021 Msg: 0O010101 Process: fffae7b7 Handle: c34075cc bind-x #0022 Msg: 80010003 Process: fffae7b7 Handle: c34075cc connect Family: 0002 Port: 0080 IP: 204.62.129.147 #0023 Msg: 00010103 Process: fffae7b7 Handle: c34075cc connect-x Result: 00002733 WSAEWOULDBLOCK Family: 0002 Port: 0080 IP: 204.62.129.147 Msg: 0024 0001000a Process: fffae7b7 Handle: 00000000 select-- setup #0025 Msg: 0001010a Process: fffae7b7 Handle: 00000000 select- - setup-x #0026 Msg: 0001000b Process: fffae7b7 Handle: 0000000a select- - cleanup #0027 Msg: 0001010b Process: fffae7b7 Handle: 00000000 select- - cleanup-x #0028 Msg: 00010009 Process: fffae7b7 Handle: c0f005f4 recv #0029 Msg: 00010109 Process: fffae7b7 Handle: c0f00Sf4 recv-x Family: 0002 Port: 1028 IP: 127.0.0.1 Len: 00000001 Address: 8285b990 00: #002a Msg: 0001000a Process: fffae7b7 Handle: 00000000 select-- setup #002b Msg: 0001010a Process: fffae7b7 Handle: 00000000 select- - setup-x #002c Msg: 0001000b Process: fffae7b7 Handle: 00000000 seiect- - cleanup #002d Msg: 0001010b Process: fffae7b7 Handle: 000C0000 select- - cleanup-x #002e Msg: 0001000e Process: fffae7b7 Handle: c34075cc setsockopt #002f Msg: 0001010e Process: fffae7b7 Handle: c34075cc setsockopt-x #0030 Msg: 0001000e Process: fffae7b7 Handle: c34075cc setsockopt #0031 Msg: 0001010e Process: fffae7b7 Handle: c3407Scc setsockopt-x #0032 Msg: 0001000e Process: fffae7b7 Handle: c34075cc setsockopt #0033 Msg: 0001010e Process: fffae7b7 Handle: c34075cc setsockopt-x #0034 Msg: 00010004 Process: fffae7b7 Handle: c34075cc getpeername #0035 Msg: 00010104 Process: fffae7b7 Handle: c34075cc getpeername- x #0036 Msg: 8801000d Process: fffae7b7 Handle: c34075cc send Family: 0002 Port: 0080 IP: 204.62.129.147 0000011d Address: c279a3a0 00: GET / HTTP/1.0 10: Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */* 52: Accept-Language: en 67: UA-pixels: 640 × 480 7b: UA-color: color8 8d: UA-OS: Windows 95 a0: UA-CPU: ×86 ad: User-Agent: Mozilla/2.0 (compatible; MSIE 3.01; Windows 95) ea: Host: www.webmonkey.com 03: Connection: Keep-Alive 1b: #0037 Msg: 0001010d Process: fffae7b7 Handle: c34075cc send-x #0038 Msg: 00010009 Process: fffae7b7 Handle: c34075cc recv #0039 Msg: 00010109 Process: fffae7b7 Handle: c34075cc recv-x Result: 00002733 WSAEWOULDBLOCK Family: 0002 Port: 0080 IP: 204.62.129.147 Msg: 003a 0001000a Process: fffae7b7 Handle: 00000000 select-- setup #003b Msg: 0001010a Process: fffae7b7 Handle: 00000000 select-- setup-x #003c Msg: 0001000b Prccess: fffae7b7 Handle: 00000000 select- - cleanup #003d Msg: 0001010b Process: fffae7b7 Handle: 00000000 select- - cleanup-x #003e Msg: 00010009 Process: fffae7b7 Handle: c34075cc recv #003f Msg: 88010109 Process: fffae7b7 Handle: c34075cc recv-x Family: 0002 Port: 0080 IP: 204.62.129.147 Len: 00000149 Address: c279a544 HTTP/1.0302 Found 14: Date: Fri, 03 Jan 1997 23:02:57 GMT 39: Server: Apache/1.1.1 HotWired/1.0 5c: Location: http://www.webmonkey.com/webmonkey/ 8b: Content-type: text/html a4: a6: <HEAD><TITLE>Document moved</TITLE></HEAD> d1: <BODY><H1>Document moved</H1> ef: The document has moved <A HREF="http://www.webmonkey.com/webmonkey/">here </A>.<P> 41: </BODY> Msg: 0 00010009 Process: fffae7b7 Handle: c34075cc recv #0041 Msg: 00010109 Process: fffae7b7 Handle: c34075cc recv-x Family: 0002 Port: 0080 IP: 204.62.129.147 Msg: #0042 00010002 Process: fffae7b7 Handle: c34075cc closesocket #0043 Msg: 00010102 Process: fffae7b7 Handle: c34075cc closesocket- x #0044 Msg: 00010010 Process: fffae7b7 Handle: 00000000 socket #0045 Msg: 00010110 Process: fffae7b7 Handle: c34075cc socket-x #0046 Msg: 00010007 Process: fffae7b7 Handle: c34075cc ioctlsocket #0047 Msg: 00010107 Process: fffae7b7 Handle: c3407Scc ioctlsocket-x #0048 Msg: 00010001 Process: fffae7b7 Handle: c34075cc bind #0049 Msg: 00010101 Process: fffae7b7 Handle: c34075cc bind-x #004a Msg: 80010003 Process: fffae7b7 Handle: c34075cc connect Family: 0002 Port: 0080 IP: 204.62.131.147 Msg: #004b 00010103 Process: fffae7b7 Handle: c34075cc connect-x Result: 00002733 WSAEWOULDBLOCK Family: 0002 Port: 0080 IP: 204.62.131.147 Msg: #004c 0001000a Process: fffae7b7 Handle: 00000000 select-- setup #004d Msg: 0001010a Process: fffae7b7 Handle: 00000000 select-- setup-x #004e Msg: 0001000b Process: fffae7b7 Handle: 00000000 select- - cleanup #004f Msg: 0001010b Process: fffae7b7 Handle: 00000000 select- - cleanup-x #0050 Msg: 0001000e Process: fffae7b7 Handle: c34075cc setsockopt #0051 Msg: 0001010e Process: fffae7b7 Handle: c34075cc setsockopt-x #0052 Msg: 0001000e Process: fffae7b7 Handle: c34075cc setsockopt #0053 Msg: 0001010e Process: fffae7b7 Handle: c34075cc setsockopt-x #0054 Msg: 0001000e Process: fffae7b7 Handle: c34075cc setsockopt #0055 Msg: 0001010e Process: fffae7b7 Handle: c34075cc setsockopt-x #0056 Msg: 00010004 Process: fffae7b7 Handle: c34075cc getpeername #0057 Msg: 00010104 Process: fffae7b7 Handle: c34075cc getpeername-x #0058 Msg: 8801000d Process: fffae7b7 Handle: c34075cc send Family: 0002 Port: 0080 IP: 204.62.131.147 00000127 Len: Address: c279a3a0 GET /webmonkey/ HTTP/1.0 1a: Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */* 5c: Accept-Language: en 71: UA-pixels: 640 × 480 85: UA-color: color8 97: UA-OS: Windows 95 aa: UA-CPU: ×86 b7: User-Agent: Mozilla/2.0 (compatible; MSIE 3.01; Windows 95) f4: Host: www.webmonkey.com 0d: Connection: Keep-Alive 25:
FIG. 6B illustrates appearance of the interface 600 (now 600a) during operation of a Web browser (e.g., Netscape Navigator™ or Microsoft Internet Explorer™ browser software). The applications panel 610 (now 610a) shows the currently-executing applications or processes. As shown at 611, current Web processes for this example include Internet Explorer. In the currently-preferred embodiment, processes are illustrated in an outline (hierarchical) view, with individual processes represented by nodes of the outline. Upon the user selecting to expand an application node (e.g., by clicking on node 611), the system, in response, displays dependent or child nodes representing protocols employed by that application. For the application node 611, for instance, the system displays child nodes 612.
FIG. 6E illustrates operation of the interface 600 (now 600e) for the WebFerret application. As shown at 655, the application employs the DNS protocol for looking up the addresses of several Web search engines, including Alta Vista™, Yahoo™, Infoseek™, and Lycos™ search engines.
Note also that the applications outline 745 provides a version-based list of applications. Under "Internet Explorer," for instance, the outline displays "latest release," "version 3.02," and subsequent prior versions (not shown). By tracking applications on a per version basis, the system can selectively enforce rules against individual versions of an application. Versions 3.01 and 3.00 of Microsoft's Internet Explorer™browser software, for instance, have known security flaws. Using a per-version rule in accordance with the present invention, the user can create a rule blocking Internet access for Internet Explorer versions 3.01 and 3.00, yet allow access for other versions (e.g., version 3.02).
After specifying which application or applications (and versions thereof) should be affected by the new rule, the user proceeds to specify which activities are to be limited. As illustrated in FIG. 7E, the wizard dialog 740 (now 740c) includes an activity pane which allows the user to select one or more activities limited by the new rule. In a manner similar to that described for selecting applications, activities are selected from an outline list 755 for inclusion or exclusion, by using include/exclude buttons 756. Again, the user creates a set representing the sum of included or excluded activities; these are displayed by outline list 757. In an exemplary embodiment, the system provides default activities which can be limited, including, for instance, Worldwide Web (Internet) activity, receiving incoming e-mail, and sending outgoing e-mail. The limitation on outgoing e-mail can be employed, for example, to prevent unknown "spy" applications from using e-mail services (e.g., Microsoft MAPI) to steal confidential information from the user's system. Note that a firewall, in contrast, cannot provide an effective defense against such spy applications, because firewalls do not have the capability to understand the underlying applications. For the new rule being created for the example at hand, all activities have been restricted for all applications except Internet Explorer™ browser software (all versions) and Netscape Navigator™ browser software (all versions).
"People" represent individual users who can log on to the system (from one or more computers). A "computer", on the other hand, represents an individual workstation or other device connected to the system; typically, such a device has a unique IP address assigned to it. A "group" represents a set which includes or excludes certain people and/or computers. This approach permits the system to allow a Web server (a device), for instance, to have unlimited Internet access regardless of which user is logged onto that computer. At the same time, the system can prevent a given user from undertaking certain activity, regardless of which computer that user has logged onto. By using groups, the user can conveniently encapsulate certain people or computers (or subgroups thereof) into a user-specified group, such as a "marketing" group. For the new rule of the example at hand, the rule disallows Internet access for all applications except Internet Explorer™ and Netscape Navigator™ browser software for all users and computers except for the marketing group, the Web server computer, and one individual (the user having username of gfreund).
At step 1216, the Client Monitor loads the content driver for ".html" files. At step 1217, the application invokes WinSock recv.oval-hollow.. At step 1218, the Host sends the contents of "foo.html". At step 1219, the Client Monitor intercepts the return of the recv.oval-hollow. call and passes the contents to the content driver. At step 1220, the content driver parses the contents of "foo.html" and checks for the following components: (a) References to Java™, ActiveX, and the like (<APPLET> or <OBJECT> tags); (b) References to Netscape style plug-ins (<EMBED> tag); (c) Imbedded scripts such as Java Script™, VBScript, and the like (<SCRIPT> tag); (d) References to other files or components (<A HREF=.backslash.f "Symbol">, or <IMG SRC=.backslash.f "Symbol"> tags); and (e) Other syntax elements that are known or suspected to cause security or network problems. At step 1221, the Contents driver checks the application and rules database to see if the specific HTML component is permissible. If it is not permissible, the driver either removes the HTML component or fails the recv.oval-hollow. call depending on the violated rule at step 1222. At step 1223, the Application received (sometimes modified) contents of "foo.html". At step 1224, the Client Monitor intercepts the file I/O calls from the application and tries to determine where (if at all) the Application has saved the file it just received.
At step 1303, the operating system, Windows, sends certain keyboard (WM-- KEY), and mouse (WM-- ?BUTTONDOWN) messages to a window. At step 1304, the Client Monitor intercepts these messages. At step 1305, the Client Monitor identifies the target window and Application of the message and marks the time of the LastInteractiveUse field of the Application's list entry. At step 1306, every minute the Client Monitor checks each entry of the Application list as follows: (a) Has the LastInternetAccess field changed in the last minute; (b) If yes, add one minute to a TotalInternetUse field of the Application's list entry; (c) Have the LastInteractiveAccess and LastlnteractiveUse fields changed in the last five minutes; (d) If yes, add one minute to a TotalInteractiveUse field of the Application's list entry; (e) If the TotalInternetUse or TotalInteractiveUse fields of any Application's list entry have changed, also add one minute to the corresponding field of the global record; and (f) If any of the TotalInternetUse or TotalInteractiveUse fields exceed rule-based quantity either for the specific Application or the user/workstation, the Client Monitor disables future Internet access and/or warns the user.
2. File activities (using the ring 0 IFSMgr-- InstallFileSystemApiHook mechanism)
<- Previous Patent (Computer virus scree...) | Next Patent (Internet accessing s...) ->