System and method for data and request filtering
Data and data requests of users of applications are filtered using a client-resident agent. A user profile may contain data pertaining to restrictions on content the user is permitted to view or types of requests the user is permitted to make. within one or more applications. Data in the user profile may be used to grant or deny access to applications, filter particular content from the user's view, or filter particular data requests made by the user.
1. A system for monitoring access via a client computer to data provided by a network-based application, the system comprising:
an identification database comprising user profiles each corresponding to a user, each of the user profiles including at least one re-authentication trigger event that (i) is associated with the user, and (ii) is stored in the user profile of the user, wherein at least two of the user profiles include re-authentication trigger events of different types each selected from (a) a function initiated by the user or an administrator, (b) a broken communication link, (c) a screen or web page requested by a user, (d) inactivity of the user, (e) passage of a period of time, or (f) a signal from an identification server sent on a periodic or random basis, whereby the identification database comprises, for at least two different users, user profiles for the different users differing from each other by inclusion of different re-authentication trigger events;
a communications module on the client computer for communicating with a computer network for facilitating authentication and log-in, by a user, to an identification server to initiate a session with an application, and for receiving thereover, from the identification database, the at least one re-authentication trigger event associated with the user;
a storage device on the client computer for storing the at least one re-authentication trigger event; and
an active agent operable on the client computer for (i) monitoring ongoing activities of the user during the session, (ii) determining that the user's access privileges have not been revoked, (iii) determining that a re-authentication trigger event associated with the user has occurred as the user performs the ongoing activities, and (iv) interrupting user activity in response to determining that the re-authentication trigger event has occurred and thereupon presenting the user with a login screen for re-authentication to the identification server.
2. The system of claim 1 , wherein the at least one re-authentication trigger event is sent to the client computer from the identification database when the user logs into the identification server.
3. The system of claim 1 , wherein the active agent is further operable to, upon determining that the re-authentication trigger event has occurred, block a request, grey out data, report activity to an administrator, lock the user out of an application, or toggle a flag variable to satisfy a condition.
4. The system of claim 1 , wherein at least one of the user profiles includes a plurality of different types of re-authentication trigger events each selected from (a) a function initiated by the user or an administrator, (b) a broken communication link, (c) a screen or web page requested by a user, (d) inactivity of the user, (e) passage of a period of time, or (f) a signal from an identification server sent on a periodic or random basis.
5. The system of claim 1 , wherein the active agent is configured to determine that at least one said re-authentication trigger event has occurred only if the active agent determines that the user's access privileges have not been revoked.
6. The system of claim 1 , wherein the at least one re-authentication trigger event stored within at least one of the user profiles has a type corresponding to a function initiated by the user or an administrator.
7. The system of claim 1 , wherein the at least one re-authentication trigger event stored within at least one of the user profiles has a type corresponding to a broken communication link.
8. The system of claim 1 , wherein the at least one re-authentication trigger event stored within at least one of the user profiles has a type corresponding to a screen or web page requested by the user.
9. The system of claim 1 , wherein the at least one re-authentication trigger event stored within at least one of the user profiles has a type corresponding to inactivity of the user.
10. The system of claim 1 , wherein the at least one re-authentication trigger event stored within at least one of the user profiles has a type corresponding to passage of a period of time.
11. The system of claim 1 , wherein the at least one re-authentication trigger event stored within at least one of the user profiles has a type corresponding to a signal from the identification server sent on a periodic or random basis.
12. The system of claim 1 , wherein (i) each of the user profiles includes authentication data associated with the corresponding user, the authentication data being different from the at least one re-authentication trigger event, (ii) the active agent is operable to, after presenting the user with the login screen for re-authentication to the identification server, cause re-authentication of the user without updating the authentication data included in the user profile of the user.
13. The system of claim 12 , wherein the authentication data comprises at least one of a password, a user identification number, or biometric data associated with the user.
14. A system for monitoring access via a client computer to data provided by a network-based application, the system comprising:
an identification database comprising user profiles each corresponding to a user, each of the user profiles including at least one re-authentication trigger event associated with the user and stored in the user profile;
a communications module on the client computer for communicating with a computer network for facilitating authentication and log-in, by a user, to an identification server to initiate a session with an application, and for receiving thereover, from the identification database, the at least one re-authentication trigger event associated with the user;
a storage device on the client computer for storing the at least one re-authentication trigger event; and
an active agent operable on the client computer for (i) monitoring ongoing activities of the user during the session, (ii) determining that the user's access privileges have not been revoked, (iii) determining that one or more re-authentication trigger events associated with the user have occurred as the user performs the ongoing activities, and (iv) interrupting user activity in response to determining that the one or more re-authentication trigger events have occurred and thereupon presenting the user with a login screen for re-authentication to the identification server,
wherein:
the at least one re-authentication trigger event associated with at least one user comprises a plurality of different re-authentication trigger events each being of a different type of re-authentication trigger event, and
the active agent only interrupts activity of the at least one user and presents the at least one user with the login screen for re-authentication when the active agent determines that a plurality of the different re-authentication trigger events, each being of a different type of re-authentication trigger event, have occurred.
15. The system of claim 14 , wherein the active agent only interrupts activity of the at least one user and presents the at least one user with the login screen for re-authentication when the active agent determines that all of the different re-authentication trigger events have occurred.
16. The system of claim 14 , wherein the plurality of different re-authentication trigger events associated with the at least one user each has a different type selected from (a) a function initiated by the user or an administrator, (b) a broken communication link, (c) a screen or web page requested by a user, (d) inactivity of the user, (e) passage of a period of time, or (f) a signal from an identification server sent on a periodic or random basis.
17. The system of claim 14 , wherein one of the plurality of different re-authentication trigger events associated with the at least one user has a type corresponding to a function initiated by the user or an administrator.
18. The system of claim 14 , wherein one of the plurality of different re-authentication trigger events associated with the at least one user has a type corresponding to a broken communication link.
19. The system of claim 14 , wherein one of the plurality of different re-authentication trigger events associated with the at least one user has a type corresponding to a screen or web page requested by the at least one user.
20. The system of claim 14 , wherein one of the plurality of different re-authentication trigger events associated with the at least one user has a type corresponding to inactivity of the at least one user.
21. The system of claim 14 , wherein one of the plurality of different re-authentication trigger events associated with the at least one user has a type corresponding to passage of a period of time.
22. The system of claim 14 , wherein one of the plurality of different re-authentication trigger events associated with the at least one user has a type corresponding to a signal from an identification server sent on a periodic or random basis.
23. The system of claim 14 , wherein (i) each of the user profiles includes authentication data associated with the corresponding user, the authentication data being different from the at least one re-authentication trigger event, (ii) the active agent is operable to, after presenting the user with the login screen for re-authentication to the identification server, cause re-authentication of the user without updating the authentication data included in the user profile of the user.
24. The system of claim 23 , wherein the authentication data comprises at least one of a password, a user identification number, or biometric data associated with the user.