TWI489310B - System for web browsing management at the client side and method of the same - Google Patents

Description

Client web browsing control system and method

The present invention generally pertains to a web browsing control system. Specifically, it relates to a system that can perform web browsing control on a client.

In today's era of digital information, computers and the Internet have become an indispensable tool for all walks of life. For the processing of information, computers and networks are indispensable. Many of the personal information and important corporate information are processed and stored as electronic files by computers, then circulated through the Internet, or accessed directly through the Internet. However, the convenience of computers and the Internet has also formed a big gap in information security. Malicious users may invade the internal information system, steal data, or maliciously destroy the network, thus threatening the normal operation of the enterprise. Therefore, most enterprises have a network firewall installed to block foreign invasions. However, the threats faced by enterprises are not only from the outside. Many companies have suffered significant economic losses due to intentional or unintentional information leakage incidents within the company.

In order to prevent insiders from leaking confidential company information via the Internet, many companies have expensive network gateways and computer rooms between the employees' computers (clients) and external networks, as shown in the first figure. Show. Before the client 105 wants to connect to the external network 120, it needs to filter through the network gateway 110 and block any blocked or controlled web links or actions (such as file transfer protocol (FTP) links, networks). The web upload, the webmail (web-mail) or the web hard disk access, etc., can transmit the data packet to the external network 120 through the machine room 115.

However, there are several problems with the above traditional control methods. As shown in the second figure, this method can achieve central control and filter data packets through the network gateway 110, but when the client 105 is not inside the company (such as taking a notebook computer out of the company), Or in the company, but when connected to the external network 120 by the non-company network interface 125 (for example, through hot spots (Hot Spot) or mobile phones (GPRS, EDGE, HSDPA, etc.), then the above method Data packets transmitted to the external network 120 cannot be filtered and no records can be left.

In summary, how to control the web browsing of the client and ignore the way of connecting the Internet, it is a practical thinking direction in the industry, and the present invention proposes a client web browsing control. The system and method to prevent any client's confidential information from leaking through the network.

In view of the above problems, the present invention discloses a client webpage browsing control system and method.

In one aspect, the client web browsing control system of the present invention includes: at least one client computer, wherein the client computer includes at least one application, a socket interface, and at least one network interface card, wherein the client computer The application can transmit the data packet to the network interface card through the communication slot interface, and connect to the external network through the network interface card, and a webpage control module coupled to the client computer. The webpage control module includes a hook unit, a layered service provider (LSP) unit, and an analysis unit, wherein the hook unit is coupled to the communication slot interface, and the LSP unit is Coupled to the hook unit described above, the analysis unit is coupled to the LSP unit. When the communication slot interface receives the data packet, the hook unit will notify and load the LSP unit to intercept the data packet, and then the analysis unit will analyze the header of the data packet to identify the purpose of the data packet. If the purpose of the packet needs to be controlled, the data packet is blocked. Otherwise, the data packet is transmitted to the network interface card.

In another aspect, the client web browsing control method of the present invention includes the following steps: first, installing a hook program on a communication slot interface of a client; and then, when the communication slot interface receives an application from an application When the data packet is to be transmitted to a network interface, the above-mentioned hook program will notify and load a layered service provider (LSP) program; then, the above LSP program is used to intercept the data packet; and then, an analysis unit is used for analysis. The header of the data packet is used to identify the purpose of the data packet; finally, it is determined whether the purpose of the data packet needs to be controlled, and if it is controlled, the data packet is blocked, and vice versa, the data packet is transmitted to the above network interface.

One of the advantages of the present invention is that it prevents the client from streaming confidential information through the Internet.

Another advantage of the present invention is that the web browsing of the client can be controlled regardless of the way the client connects to the network.

The advantages and spirit of the present invention will be further understood from the following detailed description of the embodiments of the invention.

The following description provides specific details of the implementation of the invention and is intended to provide a thorough understanding of the embodiments. Those skilled in the art will appreciate that the present invention may be practiced without these details. Furthermore, the terms used in the detailed description of the specific embodiments of the invention are to be construed in the

In general, all external communications (such as the transmission of data packets) of the Windows system need to pass through a socket interface. The communication slot interface is an application (API) interface that is interposed between the application and the hardware and provides standard functions to conform to different network hardware specifications. Referring to the third figure, it shows how a general client (computer) transmits data packets through the communication slot interface to the external network. Briefly, when the user of the client computer 200 wants to interact with the external network, it needs to use an application 205, such as Internet Explorer (IE), Mozilla or Firefox, to transmit the data packet to the communication. After the slot interface 210 is converted into the conformity of the network interface card 215 by the function of the communication slot interface 210, the data packet can reach the external network 230. Regardless of the network interface card of the client computer 200 (internal network or non-company network interface, such as external Ethernet, wireless network or mobile network (mobile) The interface card of the network) needs to pass through the communication slot interface 210 before reaching the external network 230 by the network interface card 215.

Referring to the fourth figure, it is a schematic diagram of a client webpage browsing control system according to an embodiment of the present invention. In this embodiment, the client computer 200 includes at least one application 205, a communication slot interface 210, and at least one network interface card 215. The application 205 can transmit the data packet to the network interface card 215 through the communication slot interface 210 and connect to the external network 230 by using the communication slot interface 210. Additionally, a web page control module 250 is coupled to the client computer 200. As shown, the webpage control module 250 includes a hook unit 255, a layered service provider (LSP) unit 260, and an analysis unit 265. The hook unit 255 is coupled to the communication slot interface 210 of the client computer 200, the LSP unit 260 is coupled to the hook unit 255, and the analysis unit 265 is coupled to the LSP unit 260.

When the client computer 200 wants to interact with the external network 230, it will transmit the data packet to the communication slot interface 210 through the application 205, and when the communication slot interface 210 receives the data packet, the hook unit 255 will notify and carry it. The LSP unit 260 is configured to intercept the data packet. The data packet will then be passed to analysis unit 265 to analyze the header of the data packet. Since the transmitted data packets are all text files, the header can be used to identify the purpose of the data packet, such as FTP connection, network upload, network mail transmission or network hard disk access. Even if the communication with the client computer 200 and the outside world is through a secure socket layer (SSL), since the SSL is encrypted after the data packet is encrypted through the communication slot interface 210, the communication slot interface 210 is still a clear document. Therefore, the purpose of the data packet can still be identified. If the purpose is to be controlled, the data packet is blocked from reaching the external network 230. Otherwise, the data packet is transmitted to the network interface card 215 to reach the external network 230.

In a preferred embodiment, the control condition of the analysis unit 265 is a pre-set condition, but may also be an authorized personnel, such as a management information system (MIS) personnel of the enterprise, or The company's supervisor changes it as appropriate.

Referring to FIG. 5, it is a schematic diagram of a client webpage browsing control system according to another embodiment of the present invention. In this embodiment, a recording unit 270 and a reporting unit 275 are further added. Recording unit 270 is coupled to analysis unit 265, while reporting unit 275 is coupled to recording unit 270 and client computer 200. When the analysis unit 265 completes the identification of the data packet, the recording unit 270 encapsulates the web activity of the record data regardless of whether the purpose of the data packet needs to be controlled. The recorded network activity will be consolidated into a web browsing report through the reporting unit 275 and transmitted to the client computer 200 to facilitate the MIS personnel or the supervisor to view the web browsing history of the client computer 200.

In one embodiment, the client computer 200 includes a desk machine disposed in a company office and a portable notebook computer. In the preferred embodiment, the Ethernet interface card external to the client computer 200 includes an Ethernet interface card such as 10 Mbps, 100 Mbps, 1 Gbps, or 10 Gbps; the external wireless network interface card includes 802.11a, 802.11b, and 802.11. g or 802.11n and other wireless network interface cards; and external mobile network interface cards include mobile network interface cards such as GPRS, EDGE, UMTS, HSDPA or HSUPA.

Referring to a sixth figure, it is a flowchart of a client webpage browsing control method according to an embodiment of the present invention. As shown in the figure, when the web browser is controlled by the client, a hook program (S302) needs to be installed on the communication slot interface of the client. When the communication slot interface receives an application to be transmitted to a network interface to reach the external network, the hook program notifies and loads an LSP program (S304). Next, the data packet is intercepted by the LSP program (S306). Then, an analysis unit is used to analyze the header of the data packet to identify its purpose (S308). Finally, it is judged whether the purpose of the data packet needs to be regulated (S310), and if it is controlled, the data packet is blocked from being reachable to the external network (S312), and vice versa, the data packet is transmitted to the network interface, thereby reaching the external network. Road (S314).

In summary, the client web browsing control system and method of the present invention can effectively control the network activity of the client regardless of the network connection mode of the client, thereby effectively preventing the client from flowing out the confidential information of the enterprise.

The invention is not limited to the specific details described herein. Many different variations of the invention relating to the foregoing description and drawings are permitted in the spirit and scope of the invention. Therefore, the invention is intended to be limited by the scope of the appended claims.

105. . . Client computer

110. . . Network gateway

115. . . engine room

120. . . External network

125. . . Non-company web interface

200. . . Client computer

205. . . application

210. . . Communication slot interface

215. . . Network interface card

230. . . External network

250. . . Web page control module

255. . . Hook unit

260. . . LSP unit

265. . . Analysis unit

270. . . Record unit

275. . . Report unit

S302. . . step

S304. . . step

S306. . . step

S308. . . step

S310. . . step

S312. . . step

S314. . . step

The first picture is a schematic diagram of a common web browsing control system;

The second picture is a schematic diagram of how to bypass the common web browsing control system of the first figure;

The third picture shows a schematic diagram of how a general client computer transmits data packets to an external network;

The fourth figure is a schematic diagram of a client webpage browsing control system according to an embodiment of the invention;

FIG. 5 is a schematic diagram of a client webpage browsing control system according to another embodiment of the present invention; FIG.

FIG. 6 is a flowchart of a method for controlling web browsing of a client according to an embodiment of the invention.

200. . . Client

205. . . application

210. . . Communication slot interface

215. . . Network interface card

230. . . External network

250. . . Web page control module

255. . . Hook unit

260. . . LSP unit

265. . . Analysis unit

Claims (18)

A client web browsing control system for installing a hooking program on a communication slot interface of a client computer to control web browsing, comprising: a webpage control module; wherein the webpage control module includes a hooking unit, the hooking unit is coupled to a communication interface of the client computer to control web browsing of the client computer; a layered service provider (LSP), the layered service providing unit And the analysis unit is coupled to the layered service providing unit; wherein the webpage control module and each of the units are organized in a hierarchical manner to enable the webpage The control module is installed on the communication interface of the client computer and controls the transmission of the data packet. When the communication slot interface receives the data packet, the connection unit notifies and loads the layered service providing unit. To intercept the data packet, the analysis unit will analyze the header of the data packet to identify the purpose of the data packet, and if the purpose is to be controlled, block the data. Packet, and vice versa, then transmits the data packet to the network interface card. The client webpage browsing control system of claim 1, wherein the webpage control module further comprises a recording unit coupled to the analyzing unit for recording web activity of each of the data packets. The client webpage browsing control system of claim 2, wherein the webpage control module further comprises a report unit coupled to the recording unit for collecting the network activity of each of the data packets into a report. And transferred to the client computer. The client web browsing control system of claim 1, wherein the client computer comprises a desk machine or a notebook computer. The client web browsing control system of claim 1, wherein the application is a web browser, including IE, Firefox or Mozilla. The client web browsing control system of claim 1, wherein the network interface card comprises an Ethernet interface card, a wireless network interface card or a mobile network interface. card. The client web browsing control system of claim 6, wherein the Ethernet interface card further comprises a 10 Mbps, 100 Mbps, 1 Gbps or 10 Gbps Ethernet interface card. The client web browsing control system of claim 6, wherein the wireless network interface card further comprises an 802.11a, 802.11b, 802.11g or 802.11n wireless network interface card. The client web browsing control system of claim 6, wherein the mobile network interface card further comprises a GPRS, EDGE, UMTS, HSDPA or HSUPA mobile network interface card. A computer implementation method for controlling webpage browsing on a communication slot interface of a client computer, the computer implementation method comprising the steps of: installing a hook program on a communication slot interface of a client; When the slot interface receives a data packet from an application to be transmitted to a network interface, the hook program notifies and loads a layered service provider (LSP) program; the layer service provider intercepts the data packet Using an analysis unit to analyze the header of the data packet to identify the purpose of the data packet; and determining whether the purpose requires regulation, and if the purpose is to be controlled, blocking the data packet; otherwise, transmitting the data packet To the network interface. The client webpage browsing control method of claim 10 further includes the step of recording the network activity of each of the data packets by using a recording unit. The client webpage browsing control method of claim 11, further comprising using the report unit to encapsulate the network activity of each of the data packets. The step of integrating a report and transmitting it to the client. The client webpage browsing control method of claim 10, wherein the client is a desktop or a notebook computer. The client webpage browsing control method of claim 10, wherein the application is a web browser, including IE, Firefox or Mozilla. The client web browsing control method as claimed in claim 10, wherein the network interface comprises an Ethernet interface, a wireless network interface or a mobile network interface. The client webpage browsing control method of claim 15, wherein the Ethernet interface further comprises a 10 Mbps, 100 Mbps, 1 Gbps or 10 Gbps Ethernet interface. The client webpage browsing control method of claim 15, wherein the wireless network interface further comprises an 802.11a, 802.11b, 802.11g or 802.11n wireless network interface. The client web browsing control method of claim 15, wherein the mobile network interface further comprises a GPRS, EDGE, UMTS, HSDPA or HSUPA mobile network interface.