EP2435943A1

EP2435943A1 - Method for browsing the internet, recording medium, access server and user station for implementing said method

Info

Publication number: EP2435943A1
Application number: EP10718587A
Authority: EP
Inventors: Daniel Fages; Mathieu Lafon; David Dupre; Albino Pili
Original assignee: Commonit
Current assignee: Commonit
Priority date: 2009-05-27
Filing date: 2010-05-06
Publication date: 2012-04-04
Also published as: FR2946168B1; FR2946168A1; US20120069401A1; WO2010136317A1

Abstract

The invention relates to a method for browsing the Internet, including: if a URL belongs to a pre-recorded list of URLs of sensitive websites which the user is not authorised to access from a first execution environment, then the connection to said website is only authorised (96, 114) via the remote control of a second Web browser running in a second execution environment on an access server, in order for said second Web browser to be used instead of the first Web browser to access the sensitive website identified by said URL; otherwise, the connection (94) to the website identified by said URL is carried out using the first Web browser.

Description

INTERNET NETWORK NAVIGATION METHOD, RECORDING MEDIUM, ACCESS SERVER AND USER STATION FOR IMPLEMENTING SAID METHOD

The invention relates to a method of navigation on the Internet. The invention also relates to an access server, a user station and an information recording medium for implementing this navigation method. The applicant knows a method of navigation on the Internet using:

an access server connected to the Internet and able to run several instances of an Internet browser in parallel in runtime environments that are independent of one another, and

a user station equipped with software for remote control of an Internet browser running on the access server, the user station being connected for this purpose to the access server by the intermediate of an information transmission network.

This process known to the applicant comprises the remote control, from the user station, of a first Internet browser executed in a first runtime environment on the access server so that the first Internet browser connects. to a website identified by its URL (Uniform Resource Locator).

The Internet is also known as the World Spider Web or the English term "World Wide Web".

An Internet browser is an application allowing a user to browse the Internet. Typically, these Internet browsers are able to communicate with internet servers of the Internet network using the HTTP (HyperText Transfer Protocol) and to display pages written in a SGML (Standard Generated Markup Language) language such as HTML (HyperText Markup Language) . For this, browsers are able to interpret HTML. Nowadays, Internet browsers are also able to execute or interpret scripts contained in HTML pages or transmitted by Internet servers in order to perform operations that can not be coded only in HTML. In the rest of this description, the term "executed" is used to designate both the execution and the interpretation of a script. Internet servers are content servers capable of sending HTML pages and, optionally, scripts to Internet browsers that query them using, in particular, the HTTP protocol.

Remote control software is software that remotely control the execution of an Internet browser as if the user was facing the screen of the machine on which the Internet browser is running. . However, thanks to this software, the user can actually be physically far removed from this machine. For this, for example, a client module is installed on the user station and a server module is installed on the access server.

[0008] A runtime environment or execution context designates an access server state defined by computing resources only allocated to the execution of a specific computer program as well as a set of variable values. environment to which only this program has access. Computer resources are, for example, processor time, RAM and virtual memory spaces, and data storage space on the hard disk. Thus, the execution environments partition computing resources so that a program running in one runtime environment can not act on resources allocated to another runtime environment. Thus, a program running in one runtime environment can not communicate with another program running in another runtime environment unless this has been explicitly provided for by the developers of these two programs.

When a remote control software is used to control the first remote Internet browser, only the images displayable on the screen by the first Internet browser are transmitted from the access server to the user station. Thus, no script executable by an Internet browser is transmitted to the user station. On the contrary, all scripts executable by an Internet browser are only executed on the application server and more specifically in the runtime environment allocated to the first Internet browser. [ooio] These scripts are the main vectors of malicious attacks against an Internet browser. For example, a first type of attack is to send, from a malicious website, scripts designed to steal confidential information stored on the user's computer. For example, confidential information can be passwords.

With the above navigation method, since the execution of all scripts is confined to the application server, access to the confidential information of the user stored on the user station is not possible. At worst, this attack will steal information stored on the access server but in any case, the confidentiality of the information recorded on the user station is assured. This method is very effective in fighting against this first type of attack. It also avoids using an anti-virus proxy on the flow of information from the Internet. Finally, it also solves the capacity problems that arise when the user station is a terminal with much smaller capacity than a desktop computer such as a mobile phone or a PDA (Personal Digital Assistant). Indeed, the Internet browser is not running on the user's computer. However, there is a second type of attack. This second type of attack consists of sending a script from a malicious Internet site that sends commands to other Internet sites to which the Internet browser is connected at the same time. Thus, if the user is connected at the same time to this malicious site and, for example, the website of his bank, unwanted orders by the user can be sent to the bank's website. The invention aims to provide a method of navigation on the secure Internet network vis-à-vis the second type of attack. It therefore relates to a method of navigation on the Internet in which:

- if the URL belongs to a prerecorded list of URLs of sensitive websites that are not allowed to connect from the first runtime environment, then the connection to this website is only allowed by the control to remote from a second Internet browser running in a second runtime environment on the access server so that the second Internet browser is used, instead of the first Internet browser, to connect to the sensitive website identified by this URL, and

- otherwise the connection to the website identified by this URL using the first Internet browser.

In the above method, if the URL of the website requested by the user belongs to the list of URLs of sensitive Internet sites, then access to this sensitive site is blocked from the first environment of execution. Therefore, access to this sensitive site is only allowed by the remote control of the second Internet browser running in a different runtime environment. Thus, if the user is connected to a malicious website via the first Internet browser, then an attack of the second type can not affect the sensitive website. Indeed, under no circumstances can the first Internet browser transmit commands to the second Internet browser since they are executed in different execution environments. Therefore, although the user is simultaneously connected to the malicious website and the sensitive website, the sensitive website is protected against attacks of the second type.

In the above method, the user station is also protected against attacks of the first type. The embodiments of this method may include one or more of the following features: a if the URL belongs to the prerecorded list of URLs of sensitive Internet sites, then the remote control of the first Internet browser is automatically replaced by the remote control of the second Internet browser executed in the second runtime environment on the access server so that the second Internet browser, instead of the first Internet browser, connects to the website identified by this URL; the access server automatically chooses the Internet browser that the user remotely takes control of from their user station based on the site

Internet to which the user wants to connect, among several browsers

Internet possible differentiating from each other either by their configurations or by their version numbers or by their publishers; in response to a command to print a HyperText Markup Language (HTML) page, the Internet browser running on the access server saves the HTML page to be printed to a printable file without script executable by an Internet browser, and the method includes transferring the printable file to the user station and printing locally by the user station of the printable file; B the process comprises:

in response to a command for downloading a file from a website to which the Internet browser is connected, the access server stores the downloaded file in a buffer memory of the access server,

the execution of an antivirus software by the access server to ensure that the file stored in the buffer is free of computer virus or other malicious program, and then

downloading the file stored in the buffer to the user station;

B in response to a command to download a file from a website to which the Internet browser is connected, the method comprises:

the downloading by the Internet browser executed on the access server of the file and the recording of this file in a buffer connected to the access server,

during the download, the reception by the access server of an end of remote control command of the Internet browser, and

in response to this command, the immediate stop of the remote control and the further execution of the Internet browser, by the access server, so as to download the complete file and then save it in the buffer memory; B the access server authorizes and, alternately, automatically inhibits a feature of the Internet browser according to the website to which the user wishes to connect;

B the allowed functionality and, alternatively, inhibited is the transfer of a printable file or the download of a file saved in the buffer. These embodiments of the method also have the following advantages:

the fact of automatically replacing the remote control of the first Internet browser by the second Internet browser when this is required simplifies the implementation of the method since the user has no additional operation to perform compared to the case where the same browser Internet would be used to connect to different websites;

the automatic choice by the access server of the Internet browser from which the user must take control remotely makes it possible to resolve, without user intervention, the compatibility problems between the Internet browsers and the websites to which the user want to connect;

- The registration of the page to be printed and its transfer to the user station makes it possible to locally print an HTML page on the user station while maintaining a high level of protection against attacks of the first and second types;

the execution of the antivirus software on the access server makes it possible to save files downloaded from a website to the user's computer, without this user's workstation being necessarily equipped with antivirus software;

- Continuation of the execution of the Internet browser on the access server makes it possible to continue downloading a file even if the user no longer remotely controls the Internet browser;

- the authorization and, alternately, the inhibition of Internet browser features according to the website to which the user wants to connect allows to restrict certain features of the Internet browser, not according to the Internet browser used, but according to of the website to which the user is connecting.

The invention also relates to an information recording medium comprising instructions for performing the above navigation method, when these instructions will be executed by an electronic computer. The invention also relates to an access server for implementing the navigation method above, this server being able to run in parallel several Internet browsers in independent execution environments from each other so that a user station can take remote control of a first Internet browser executed in a first runtime environment on the access server for this first Internet browser to connect to an identified website. by its URL. This access server is also able to:

- if the URL belongs to a prerecorded list of URLs of sensitive Internet sites that are not allowed to connect from this first runtime environment, to allow only the connection to this site

Internet by remotely controlling a second Internet browser running in a second runtime environment on the access server so that it second Internet browser is used instead of the first Internet browser to connect to the sensitive website identified by this URL, and - otherwise to connect to the website identified by this URL using the first Internet browser. Finally, the invention also relates to a user station for implementing the navigation method above, this user station being equipped with remote control software of a Internet browser executed on the access server above, when the user station is connected for this purpose to the access server via an information transmission network. The invention will be better understood on reading the description which follows, given solely by way of nonlimiting example and with reference to the drawings in which:

- Figure 1 is a schematic illustration of a navigation system on the Internet; FIG. 2 is a schematic illustration of an Internet session configuration table;

FIGS. 3 and 4 are schematic illustrations of lists of sensitive URLs used in the system of FIG. 1;

FIG. 5 is a schematic illustration of a list of configuration parameters of an Internet browser used in the system of FIG. 1; and

FIG. 6 is a flowchart of a navigation method on the Internet network using the system of FIG. 1.

[0025] FIG. 1 shows a navigation system 2 on the Internet network 4. The network 4 is formed of a multitude of Internet servers connected to each other via a set 6 of large networks. information transmission distances. This set 6 incorporates in particular many routers so as to route the information delivered by a server to any terminal connected to one of the networks of the set 6. As an illustration, only two Internet servers 8 and 10 were represented. The server 8 is a sensitive Internet server. By sensitive, in this embodiment is meant a server that must be protected against attacks of the second type. For example, the Internet server 8 is an Internet server for managing online bank accounts. In contrast, the server 10 is a "malicious" Internet server. By malicious, in this embodiment is meant a server hosting applications designed to perform attacks of the first or second type against Internet browsers. [0028] The system 2 comprises:

a server 20 for accessing the Internet network 4;

several user stations connected to the server 20 via a local area network 22; and a station 24 for configuring the server 20 via the network 22.

To simplify the illustration, only two user stations 26 and 28 have been shown. For example, stations 26 and 28 are identical and only station 26 will be described in detail. The server 20 is connected to the Internet network 4 via an information transmission link 30. It is able to run multiple Internet browsers simultaneously in separate runtime environments. For example, in FIG. 1, three distinct execution environments 32, 33 and 34 are schematically represented by dashed rectangles. Internet browsers executed in each of these environments 32 to 34 are represented by squares 36, 37 and 38 in full lines.

The server 20 also includes a server module 40 of software for remote control of Internet browsers running on the server 20. For example, the remote control of Internet browsers running on the server 20 is done using the NX protocol distributed by the Italian company NOMACHINE (www.nomachine.com).

The server 20 also includes antivirus software 42. The server 20 is connected to a memory 44 containing the instructions and information necessary for the execution of the method of FIG. 6. In particular, the memory 44 comprises a buffer memory 46 and files 48 for configuring the various possible Internet sessions.

Each user station comprises an electronic computer 50 executing a client module 52 of the remote control software. For example, the computer 50 is that of a central unit of a desktop computer. Each user station also includes a human-machine interface 54 for:

to display the images generated by the remotely controlled Internet browser, and

- to send navigation instructions to the remotely controlled browser.

For example the interface 54 is formed of a screen 58, a keyboard 60 and a computer mouse 62. The computer 50 is also connected to a memory 64 with the necessary instructions to the computer. execution of the method of Figure 6. The memory 64 also allows, for example, to store downloaded files.

The module 52 cooperates with the module 40 via the network 22 so that the user of the station 26 can control the use of the Internet browser running on the server 20 as if this Internet browser was executed locally. by the computer 50. The remotely controlled Internet browsers are the same as those that could be directly executed on the user stations without the help of the modules 40 and 52.

[0037] FIG. 2 shows in the form of a table 70 a list of Internet sessions configured on the server 20. An Internet session is a set information used by the server 20 to configure and manage the use of an Internet browser in an execution environment dedicated to it. This table 70 is for example part of the configuration files 48. Here, the first column of this table lists identifiers S ₁ of different Internet sessions that the user of item 26 can launch. The second column of table 70 associates with each identifier S ₁ a prerecorded L list of URLs. sensitive Internet sites that must be protected against attacks of the second type. The third column contains for each session S ₁ a second list L ₁₂ of URLs of authorized websites and possibly accessible from other sessions. The fourth column contains sessions for each S ₁ C ₁ a list of Internet browser configuration settings. Of the four sessions Si to S ₄ represented here, the sessions S1 to S3 are secure sessions because they are each associated with a non-empty list L, i. Only the session S ₄ is an unsecured session. This unsecured session allows you to connect to all websites except sensitive websites. In particular, the session S ₄ allows the user to possibly connect to malicious Internet sites such as those hosted by the server 10. For this purpose, the lists L41 and L ₄₂ are non-existent and represented by the symbol Φ.

Figure 3 shows an example list Ln. In this example, the list Ln comprises at least three URLs respectively denoted URL ₃ , URL _b , URL ₀ . These URLs are URLs of sensitive Internet sites that must be protected against attacks of the second type. These URLs are only accessible from the Si session.

[0039] Figure 4 shows an example of list Li ₂ containing as three URLs illustration, URL _x, _y and URL URL _Z. The URLs in this list Li ₂ are accessible URLs during the session Si but also during other Internet sessions.

FIG. 5 represents a possible example of list Ci of configuration parameters. For example, the Ci list has the following fields:

an Ed field identifying the editor of the Internet browser to be used from among several possible Internet browsers including Internet Explorer, Firefox,

Mozilla, ...;

- a To field containing the version number of the Internet browser to use;

a field Conf defining the configuration of the Internet browser to be used, such as, for example, the additional extension modules to be executed at the same time as the Internet browser (the additional extension modules are better known by the term "plug-in"); ");

- a T field containing an authorization or, on the contrary, a prohibition to download files from the Internet;

- a TP field containing an authorization or, on the contrary, a prohibition to continue downloading a file after the end of the remote control; a P field containing an authorization or, on the contrary, a prohibition to print files downloaded from the Internet network; and

an SA field indicating whether the session Si associated with the list Ci is an anonymous session or not. An "anonymous session" is defined here as a connection to the Internet network from an Internet browser at the end of which the browsing history is deleted as well as any trace of navigation on the Internet network such as cookies or other. The operation of the system 2 will now be described in more detail with regard to the method of FIG. 6.

Initially, during a step 80, a system administrator 2 connects to the server 20 via the station 24 and the network 22. The administrator uses this connection to define the table 70 and the different lists. L, i, L ₁₂ and C ₁ . After having defined the various Internet sessions possible through the server 20, the administrator saves these sessions in the files 48.

Once the server 20 configured, it is used to navigate the Internet 4 from station 26 safely. In particular, during a step 82, when a user wishes to connect to the Internet 4, he starts the execution of the module 52 on his user station. The module 52 then connects to the module 40 and automatically downloads the list of Internet sessions defined in the table 70. This list is presented to the user via the human-machine interface 54.

In a step 84, the module 52 acquires the identifier S ₁ of the session selected by the user of the station 26 and transmits this identifier to the module 40. In response, during a step 86 , the server 20 creates a runtime environment and starts execution in this environment of the Internet browser identified and configured as indicated in the list C ₁ associated with the identifier S ₁ acquired during step 84. Thus, a site sensitive such as a website to manage a user's bank accounts will only be accessible via an Internet browser whose configuration, defined in the list C ₁ , is appropriate for this use. This avoids compatibility problems between Internet browsers and Internet sites consulted.

In the remainder of this description, it is assumed that during step 86, the server 20 has created the execution environment 32 and launched the execution of the Internet browser 36.

In a step 88, the module 52 takes remote control of the browser 36. From this moment, the images displayed by the Internet browser 36 are transmitted by the module 40 to the module 52 via the 22. The module 52 presents them to the user via the human-machine interface 54. The files transmitted from the module 40 to the module 52 encode only one image to display on the interface 54. In particular, these files are devoid of script executable by an Internet browser. Thus, the user station 26 is protected against any attack of the first type.

If at step 84, the identifier S ₁ acquired corresponds to an unsecured Internet session such as for example the session S ₄ , then we proceed to a phase 90 of unsecured navigation on the Internet network 4. During phase 90, the user can browse all the Internet sites accessible on the Internet network 4 with the exception of those corresponding to the URLs listed in the lists L, i. For this, during a step 92, each time the user types a new URL or is redirected to a new URL, for example, to the selection of an Internet link, this new URL is compared to the URLs contained in all lists L ₁₁ . If the new URL does not belong to any L _{11 list} , then the connection to this website is allowed. Therefore, in a step 94, the Internet browser 36 connects to the website corresponding to this new URL and downloads from this website the HTML pages requested.

Otherwise, during a step 96, the connection to the website corresponding to this new URL is not allowed. Therefore, the connection to this website is not established. This prevents the user from connecting to a sensitive website during an unsecure Internet session. Thus, a simultaneous connection to a malicious website and a sensitive website from an Internet browser running in the same runtime environment is automatically rendered impossible.

If the new URL belongs to one of the lists _L12 , then the connection to the corresponding website is allowed. Then proceed to step 94. In parallel, if the user orders the printing of a page downloaded by the browser 36, then the server 20 checks, in a step 98, if the field P C ₄ list allows printing or not from the Internet. In a step 100, if printing is not allowed, then printing is blocked. Conversely, if printing is authorized, during a step 102, the page to be printed is saved in the buffer memory 46 in a format containing no script executable by an Internet browser. For example, the format used is PDF (Portable Document Format). Then, in step 102, the file saved in PDF format is downloaded to the user station 26 so that it can be printed locally by the station 26. [0053] Also in parallel, if the user controls the browser 36 to download a file, then the server 20, in a step 104, checks whether the file download is allowed or not. For this, it consults the value of the field T of the list C ₄ . If the download is not allowed, then in a step 106, the download of the file is blocked. If, on the contrary, the downloading of files is authorized, then during a step 108, the browser 36 downloads the file and saves it in the buffer memory 46. Then, during step 108, once the download completed, the software 42 is automatically executed to verify that the file stored in the memory 46 is devoid of viruses or malware. Optionally, the software 42 eliminates detected viruses or malware.

The module 52 allows the user of the station 26 to view the list of files downloaded and saved in the buffer memory 46. In response to the selection by the user of one of the files in this list, this one is downloaded from the buffer 46 to the memory 64 of the station 26. Thus, the station 26 does not need to be equipped itself with antivirus software to securely download files from the Internet network .

If during step 84, the session identifier acquired corresponds to a secure Internet session, then at the end of step 88, a navigation phase 110 is performed in a secure execution environment. . This phase 110 is identical to the phase 90 with the exception that the steps 92, 94 and 96 are replaced by steps 112, 114 and 116.

In step 112, each time the user types a new URL or is redirected to a new URL, the new URL is compared to the lists L, i and L _l2 associated with the Internet session. secured S ₁ selected. If the new URL belongs to one of these L, i or L _l2 lists, then the connection to this website from this runtime environment is allowed. Therefore, in step 114, the Internet browser 36 connects to the sensitive website and downloads the data to be displayed from this site. If the new URL does not belong to the list L, i or list _L12 , then the connection to the corresponding website is not allowed. This new URL is blocked and the web browser does not connect to this website. Thus, it is automatically impossible to access a malicious Internet site such as those hosted by the server 10 in the same runtime environment that used to access sensitive Internet sites such as those hosted by the server. attacks of the second type are prevented.

After the phases 90 or 110, the user can launch in parallel a new Internet session and returns for this to step 84. [0060] It may also decide to end a session. When an end of session command is received, during a step 120, the modules 40 and 52 immediately terminate the remote control of the Internet browser executed during this session. Therefore, the images of the website are no longer displayed on the screen 58. Next, the server 20 immediately closes the connection to the website accessed during this Internet session unless a download is in progress and the TP field allows the continue downloading the file after the end of the remote control. In the latter case, the execution of the Internet browser continues until the entire file is downloaded to the buffer 46. Thus, although the user has the impression that he is disconnected from the website, the download continues. The server 20 also checks whether it is an anonymous session by consulting the SA field associated with this Internet session. If so, the Internet server will erase the browsing history and any information downloaded from the Internet for reuse on the next login to the same site. Finally, after the download of the complete file, or immediately if the TP field does not allow the download to continue, the execution of the Internet browser is stopped and the execution environment in which this Internet browser was executed. is destroyed. By destroying the runtime environment, any viruses or other malicious software downloads are also destroyed. The method described here requires the user to partition secure Internet sessions insecure Internet sessions. This partitioning is done using Internet browsers running in different execution environments. Therefore, even if simultaneously the user connects to a malicious website and in parallel to a sensitive website, the malicious website can not affect the operation of the sensitive website since the Internet browsers used to connect to these two sites are run in runtime environments that are independent of each other.

Many other embodiments are possible. For example, the Internet access server may be composed of several machines connected to each other to provide the same services as the access server 20. The client module 52 may be recorded on a recording medium removable removable connector to the user station 26. For example, the removable recording medium is a USB (Universal Serial Bus). Alternatively, the user stations are connected to the server 20 by a long distance network and typically by a public network large distance information transmission. For example, in the latter case, the server 20 may be hosted by an ISP.

For remote control taking, other protocols than the NX protocol can be used. For example, Microsoft® Remote Desktop Protocol (RDP) or Citrix © Independent Computing Architecture (ICA) can be used in place of the NX protocol.

Alternatively, rather than blocking a URL to which it is not possible to connect using the Internet browser executed in the current runtime environment, the server 20 automatically launches the execution of a another Internet browser in another runtime environment from which the connection to that URL is possible and the remote control of the second Internet browser automatically replaces the remote control of the first Internet browser. When multiple Internet sessions are simultaneously executed, they are displayed in separate windows on the screen 58 or on the contrary in one and the same window. In the latter case, the different Internet sessions executed simultaneously are displayed, for example, in different tabs of the same window.

Claims

1. Method of navigation on the Internet network using:

a user station equipped with software for remote control of an Internet browser running on the access server, the user station being connected for this purpose to the access server by the intermediate of an information transmission network, said method comprising remote control (88), from the user station, of a first Internet browser executed in a first runtime environment on the access server for this first Internet browser to connect to a website identified by its URL (Uniform Resource Locator), characterized in that:

- if the URL belongs to a prerecorded list of URLs of sensitive Internet sites that are not allowed to connect from the first runtime environment, then the connection to this website is only allowed (96, 114 ) by remotely controlling a second Internet browser running in a second runtime environment on the access server so that the second Internet browser is used, in place of the first Internet browser, to connect to the responsive website identified by this URL, and

- otherwise the connection (94) to the website identified by this URL using the first Internet browser.

2. Method according to claim 1, wherein if the URL belongs to the prerecorded list of URLs of sensitive Internet sites, then the remote control of the first Internet browser is automatically replaced by the remote control of the second Internet browser executed in the second runtime environment on the access server for this second Internet browser, instead of the first Internet browser, to connect to the website identified by this URL.

3. A method according to any one of the preceding claims, wherein the access server automatically chooses (86) the Internet browser whose user remotely controls from his user station according to the website to which the user wishes to connect, among several possible Internet browsers differing from each other either by their configurations or by their version numbers or by their editors.

The method of any one of the preceding claims, wherein:

in response to a print command of a HyperText Markup Language (HTML) page, the Internet browser running on the access server stores (102) the HTML page to be printed in a printable file devoid of script executable by a browser Internet and then

the method comprises transferring (102) the printable file to the user station and printing locally by the user station of the printable file.

5. Method according to any one of the preceding claims, wherein the method comprises: in response to a command to download a file from a website to which the Internet browser is connected, the access server records (108) the file downloaded to a buffer of the access server,

the execution (108) of antivirus software by the access server to ensure that the file stored in the buffer is free of computer virus or other malicious program, and then

- Downloading the file saved in the buffer to the user station.

The method of any one of the preceding claims, wherein in response to a command to download a file from an Internet site to which the Internet browser is connected, the method includes:

the download (108) by the Internet browser executed on the access server of the file and the recording of this file in a buffer connected to the access server,

during the download, the reception (120) by the access server of an end of remote control command of the Internet browser, and

in response to this command, the immediate stop (120) of the remote control and the continuation of the execution of the Internet browser, by the access server, so as to download the complete file and then save it in the memory buffer.

7. A method according to any one of the preceding claims, wherein the access server authorizes and, alternately, automatically inhibits (98, 104) a feature of the Internet browser according to the website to which the user wishes to connect.

The method of claim 7, wherein the allowed and alternately inhibited functionality is the transfer of a printable file or the downloading of a file stored in the buffer.

9. An information recording medium, characterized in that it comprises instructions for the execution of a method according to any one of the preceding claims, when these instructions are executed by an electronic computer.

Access server (20) for the implementation of a navigation method according to any one of claims 1 to 8, this server being able to run in parallel several Internet browsers (36 to 38) in execution environments (32 to 34) independent of each other so that a user station can take remote control of a first Internet browser executed in a first runtime environment on the server of access for this first Internet browser to connect to a website identified by its URL, characterized in that the access server is capable of:

- if the URL belongs to a prerecorded list of URLs of sensitive Internet sites that are not allowed to connect from this first runtime environment, to allow only the connection to this website by the control to a second Internet browser running in a second runtime environment on the access server for this second Internet browser to be used instead of the first Internet browser to connect to the sensitive website identified by this URL, and

- otherwise to connect to the website identified by this URL using the first Internet browser.

11. User station (26, 28) for implementing a method of navigation on the Internet network according to any one of claims 1 to 8, the user station being equipped with software ( 52) for remotely taking control of an Internet browser running on an access server according to claim 10, when the user station is connected for this purpose to the access server via a network. information transmission.