Electrical computers and digital processing systems: multicomput – Computer-to-computer session/connection establishing – Network resources access controlling
Reexamination Certificate
1999-10-26
2004-05-04
Wiley, David (Department: 2143)
Electrical computers and digital processing systems: multicomput
Computer-to-computer session/connection establishing
Network resources access controlling
C709S225000, C713S152000, C719S328000, C725S002000, C725S110000, C725S118000
Reexamination Certificate
active
06732179
ABSTRACT:
BACKGROUND
1. Field of the Invention
This invention pertains in general to high-speed data networks and in particular to a system and method for restricting access by servers on the network to resources available on user computer systems.
2. Background of the Invention
Cable television service is usually sold as a subscription to one or more “tiers” of channels. Typically, a basic cable subscription allows access to a small tier of channels and is sold for a relatively low subscription fee. The subscriber can purchase additional tiers of cable channels for additional fees.
In most cable systems, the subscriber uses a “set-top box” (STB) to access the cable channels. The STB contains a microprocessor and other hardware for tuning and descrambling channels in the tiers to which the subscriber has access. The STB may also enable other services, such as pay-per-view or digital music reception in return for additional fees.
In recent years, the STB has incorporated a cable modem that enables access to Internet- and World Wide Web- (“the web”) based resources via the cable infrastructure. A cable modem typically has at least one assigned Internet Protocol (IP) address and is managed by an Internet Service Provider (ISP). The ISP inserts and extracts Internet traffic to and from the cable infrastructure and distributes it to the cable modem having the given IP address or the Internet, as appropriate.
U.S. patent application Ser. No. 09/428,235 discloses a walled garden accessible to STB users who are customers of the ISP. Application servers within the walled garden provide services to the users, including, for example, access to electronic content, access to electronic commerce services, and any other functionality that can be provided electronically via a network. The users can subscribe to one or more of the services in the walled garden either individually or as part of a tier. U.S. patent application Ser. No. 09/428,235 discloses a way to restrict users to only those services in the walled garden to which the users are entitled to access.
The walled garden application servers may desire or need to access features of the users' STBs in order to provide certain services. For example, an application server may need to generate text or controls on a user's television display, change the channel to which the STB is tuned, print a receipt on a printer coupled to the STB, or complete a fee transaction using an electronic wallet stored in the STB.
The ISP would prefer to limit the features on the users' STBs to which the application servers have access, typically to generate revenue and enhance security. For example, the ISP may desire to charge a fee for letting an application server change the channel to which the user's STB is tuned or conduct an electronic commerce transaction using the electronic wallet. Likewise, the ISP would like to limit the abilities of the application server to ensure that a misbehaving or compromised application server cannot act maliciously toward a user's STB.
Accordingly, there is a need for away to restrict the features of a user's STB that can be accessed and utilized by an application server within the walled garden. Preferably, the solution to this need will restrict the features at a fine grain, thereby allowing an application server to access only those features which are necessary to provide the service sought by the user.
SUMMARY OF THE INVENTION
The above needs are met by a method and system that passes an access control list (ACL) to the set top box (STB), or other form of client, indicating which functions in the client can be called by a walled garden site. A client is coupled to a television set, computer system, or other device having a display. The client preferably contains a central processing unit, a memory, a television tuner, and a cable modem. The client also preferably contains a video subsystem, for generating images on the display and an input for accepting commands from the user.
The client preferably executes software supporting standard web browsing functionality. In one embodiment, the client executes the WIDOWS CE operating system. Programs executing on the operating system include a hypertext markup language (HTML) rendering engine, a JAVA virtual machine for executing JAVA programs, and other controls supporting web browsing functionality. A shell program also preferably executes on the operating system and generates a user interface on the display. The shell program controls access to sets of application program interfaces (APTs) for providing functionality at the client. For example, the APIs include functions allowing a program to change the channel, access an electronic program guide held by the client, instantiate user interface (UI) elements, and access an electronic walled held by the client.
The cable modem is preferably coupled to a coaxial cable and supports bi-directional broadband communications using the Internet protocol (IP). The coaxial cable is typically aggregated with other cables into a fiber-optic cable. The fiber-optic cable, in turn, is coupled to a cable modem termination server (CMTS) at a headend. The CMTS contains hardware for terminating the IP data channel, including IP switches, routers, and high-availability servers.
The CMTS allows the client to access a private network containing a walled garden proxy server (WGPS) via the hypertext transport protocol (HTTP). The WGPS controls access to a walled garden of network-based services. The services available in the walled garden may include, for example, access to electronic content, access to electronic commerce services, and any other functionality that can be provided electronically via a network. These services are provided by one or more walled garden servers coupled to a walled garden network. The walled garden servers may include servers directly coupled to the walled garden network, servers having direct connections to remote application databases, servers coupled to the walled garden network via a virtual private network, and servers having only a frontend on the walled garden network. Each site on a walled garden server is identified by a plot number.
A site held on a server within the walled garden may respond to a user by sending a message containing a JAVASCRIPT program to the client. The program can invoke one or more of the functions in the APIs. The WGPS traps messages from the site and determines the ACL for the site. The ACL is preferably a bit-map that specifies which STB API functions may be called by the site. The WGPS passes the ACL to the client as a header to the message from the site. In addition, the WGPS examines the header received from the site to protect against ACL masquerading or spoofing by the site.
The shell executing on the client extracts the ACL from the header when it receives the message. The shell uses the bit-map to determine which API functions can be invoked by the walled garden site. If the JAVASCRIPT program tries to invoke a function for which it lacks permission, the client halts execution of the program and sends a message back to the site indicating that the invocation failed because the site lacks permission. Otherwise, the client allows the JAVASCRIPT program invoke the function and returns the result to the site. Thus, the walled garden site can use the APIs to provide services to the user.
REFERENCES:
patent: 5335346 (1994-08-01), Fabbio
patent: 5550578 (1996-08-01), Hoarty et al.
patent: 5586260 (1996-12-01), Hu
patent: 5649099 (1997-07-01), Theimer et al.
patent: 5701464 (1997-12-01), Aucsmith
patent: 5815574 (1998-09-01), Fortinsky
patent: 5905872 (1999-05-01), DeSimone et al.
patent: 5913025 (1999-06-01), Higley et al.
patent: 5918013 (1999-06-01), Mighdoll et al.
patent: 5941947 (1999-08-01), Brown et al.
patent: 5950195 (1999-09-01), Stockwell et al.
patent: 6003776 (1999-12-01), Drupsteen
patent: 6038319 (2000-03-01), Chari
patent: 6049877 (2000-04-01), White
patent: 6101535 (2000-08-01), Hussmann et al.
patent: 6101607 (2000-08-01), Bachand et al.
patent:
Brown Ralph W.
Keller Robert
Medin Milo S.
Temkin David
At Home Corporation
Fenwick & West LLP
Wiley David
LandOfFree
Method and system for restricting access to user resources does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Method and system for restricting access to user resources, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Method and system for restricting access to user resources will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3255650