Granted Patent B2

US 7,448,078 · App. 10/458,240 · Granted Nov 4, 2008

Abstract

Claims (53)

1. A method of providing a dynamically defined limited Internet access to a terminal client, the method comprising:

causing a portal server to provide a portal web site with portal information identifying a set of accessible resources, wherein the terminal client has access to said portal web site;

causing a personalized access policy server to dynamically derive a set of granted resources from the portal web site with respect to a user's grants and with respect to already accessed resources;

accessing the granted resources via a firewall located between the terminal client and the Internet; and

configuring the firewall individually, just in time for said user such that only said granted resources are permitted.

2. The method according to claim 1 , wherein grant or denial to the set of granted resources is time-dependent.

3. The method according to claim 1 , wherein grant or denial to the set of granted resources is dependent on the already accessed resources.

4. The method according to claim 1 , wherein grant or denial to the set of granted resources is dependent on content of a requested resource.

5. The method according to claim 1 , wherein grant or denial to the set of granted resources is dependent on a resource identifier.

6. The method according to claim 1 , wherein grant or denial to the set of granted resources is dependent on resource meta-information.

7. The method according to claim 1 where, wherein grant or denial to the set of granted resources is dependent on the portal information.

8. A portal system providing a dynamically defined limited Internet access to a terminal client, the portal system comprising:

a portal server providing a portal web site with portal information identifying a set of accessible resources, said terminal client having access to said portal web site;

a personalized access policy server deriving dynamically a set of granted resources with respect to a user's grants and with respect to already accessed resources; and

a firewall located between the terminal client and the Internet configured individually, just in time for said user such that only said granted resources are permitted.

9. A portal server comprising:

means for providing a portal web site with portal information identifying a set of accessible resources;

an interface to a personalized access policy server providing and retrieving granting information; and

an interface to an individually and just in time configured firewall providing granted resources.

10. A portal server according to claim 9 , wherein the portal server is realized by a web server that is enriched by the interface to or a module of the personalized access policy server, and the interface to or a module of the firewall.

11. A personalized access policy server comprising:

means for deriving dynamically granted resources with respect to a user's grants and with respect to already accessed resources;

authentication means for authentication and authorization of said user;

accounting means for recognizing the already accessed resources, and for deriving a set of dynamically granted resources to said user; and

granting means for instructing a firewall with respect to the set of dynamically granted resources.

12. A firewall providing a dynamically defined limited Internet access to a terminal client, said firewall comprising:

configuration means for configuring dynamically a current set of granted resources for the terminal client or a user; and

granting means for individually, just in time permitting access, only to said set of granted resources for said terminal client or said user.

13. A computer readable recording medium having recorded thereon a program for executing a method comprising:

deriving dynamically granted resources with respect to a user's grants and with respect to already accessed resources;

authenticating and authorizing the user;

recognizing already accessed resources;

deriving a set of the dynamically granted resources to said user; and

instructing a firewall with respect to the set of dynamically granted resources.

14. A computer readable recording medium having recorded thereon a program for executing a method of providing a dynamically defined limited Internet access to a terminal client: the method comprising;

configuring dynamically a current set of granted resources for the terminal client or a user, and

individually, just in time permitting access, only to said current set of granted resources for said terminal client or said user.

15. The method according to claim 1 , wherein said network resources are uniform resource identifiers.

16. A method of managing network resources passing through a firewall, the method comprising:

identifying a set of accessible resources;

deriving a set of granted resources based on access information and the set of accessible resources; and

dynamically configuring a firewall such that only resources in the set of granted resources are forwarded.

17. The method according to claim 16 , wherein the access information comprises a user's grants and already accessed resources.

18. The method according to claim 16 , wherein the access information is based on time.

19. The method according to claim 16 , wherein the access information is based on content of a requested resource.

20. The method according to claim 16 , wherein the access information is based on a resource identifier.

21. The method according to claim 16 , wherein the access information is based on resource meta-information.

22. The method according to claim 16 , wherein the access information is based on portal information.

23. A portal system to manage network resources passing through a firewall, the portal system comprising:

a portal website;

a portal server configured to provide the portal website with access information identifying a set of accessible resources;

an access policy server configured to dynamically derive a set of granted resources based on said access information on a user basis;

a firewall individually configurable to forward only requested resources within said set of granted resources.

Assignments (8)