System and method for restricting user access rights on the internet based on rating information stored in a relational database

• US 5,678,041 A
• Filed: 08/25/1995
• Issued: 10/14/1997
• Est. Priority Date: 06/06/1995
• Status: Expired due to Fees

• Current Assignee: The Cooper Union for the Advancement of Science and Art
• Original Assignee: AT&T, Inc.
• Inventors: Grosse, Eric, Baker, Brenda Sue
• Primary Examiner(s): Black, Thomas G.
• Assistant Examiner(s): ROBINSON, GRETA LEE
• Application Number:
  US08/519,268
• Time in Patent Office: 781 Days
• Field of Search: 395/600, 395/726, 395/739, 395/188.01, 395/187.01, 395/609, 395/610, 395/601
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A system and method for selectively controlling database access by providing a system and method that allows a network administrator or manager to restrict specific system users from accessing information from certain public or otherwise uncontrolled databases (i.e., the WWW and the Internet). The invention employs a relational database to determine access rights, and this database may be readily updated and modified by an administrator. Within this relational database specific resource identifiers (i.e., URLs) are classified as being in a particular access group. The relational database is arranged so that for each user of the system a request for a particular resource will only be passed on from the local network to a server providing a link to the public/uncontrolled database if the resource identifier is in an access group for which the user has been assigned specific permissions by an administrator. In one preferred embodiment, the invention is implemented as part of a proxy server within the user'"'"'s local network.

Claims

1. A system for selectively restricting access to one or more otherwise public information resources, comprising:

a relational database containing a first stored listing that associates each of a plurality of resource identifiers with at least one resource rating, and a second stored listing that associates each of a plurality of user identification codes with at least one user clearance rating;

a processor adapted to receive a request for network access to one or more particular network resources, said request including a resource identifier and a user identification code, said processor being further adapted to query said first and second listings within said relational database, and execute said request for network access to said one or more particular network resources as a function of the resource rating shown to be associated with said received resource identifier within said first listing, and the user clearance rating shown to be associated with said received user identification code within said second listing.

2. The invention of claim 1 wherein at least one of said one or more particular network resources includes at least one image.

3. The invention of claim 1 wherein said processor is programmed to execute said request for access if said resource rating associated with said received resource identifier within said first listing, corresponds to at least one of said user clearance ratings associated with said received user identification code within said second listing.

4. The invention of claim 1 wherein said processor is programmed to deny execution of said request for access if said resource rating associated with said received resource identifier within said first listing, corresponds to at least one of said user clearance ratings associated with said received user identification code within said second listing.

5. The invention of claim 1 wherein said processor is contained within a network proxy server.

6. The invention of claim 1 wherein each of said user identification codes identifies one or more terminals adapted for facilitating network access to one or more particular network resources.

7. The invention of claim 1 wherein each of said user identification codes identifies one or more individuals authorized to access one or more particular network resources.

8. The invention of claim 1 wherein each of said resource identifiers corresponds to one or more uniform resource locators for accessing one or more particular network resources.

9. The invention of claim 1 wherein said relational database further includes a data listing associated with one or more of said plurality of resource identifiers, wherein said data listing represents textual information related to the resource rating shown to be associated with said one or more of said plurality of resource identifiers within said first listing.

10. The invention of claim 1 wherein said relational database further includes a conditional data listing associated with one or more of said resource identifiers, wherein said conditional data listing represents information indicative of specific conditions under which requests for network access to particular network resources associated with said resource identifier can be executed, and wherein said processor is further adapted to execute said request for network access to said one or more particular network resources as a function of said conditional data listing.

11. The invention of claim 1 wherein said relational database further comprises a stored listing of at least one system manager identifier, and said processor is adapted to identify a user as a system manager on the basis of said system manager identifier listing, and thereby permit said identified system manager to modify the contents said relational database.

12. The invention of claim 11 wherein said relational database further comprises a stored listing containing at least one HTML page adapted to facilitate the modification of the contents of said relational database by said identified system manager.

22. The invention of claim 1 wherein said plurality of resource identifiers associated with at least one resource rating are arranged in a hierarchical directory data structure.

23. The invention of claim 22 wherein said plurality of resource identifiers arranged in said hierarchical directory data structure are associated with more than one resource rating.

13. A method for selectively restricting access to one or more otherwise public information resources, comprising the steps of:

receiving a request for access to one or more particular information resources, wherein said request includes a user identification code and a resource identifier;

comparing said received request for access to a relational database containing a stored listing of user identification codes and resource identifiers, wherein each of said resource identifiers is associated with at least one resource rating, and wherein each of said user identification codes is associated with at least one user clearance rating;

executing said request for access as a function of the resource rating shown to be associated with said received resource identifier within said stored listing, and the user clearance rating shown to be associated with said received user identification code within said stored listing.

14. The method of claim 13 wherein at least one of said one or more particular network resources includes at least one image.

15. The method of claim 13 wherein the execution of said request for access is performed if said stored listing shows said received user identification code to be associated with at least one user clearance corresponding to at least one resource rating shown to be associated with said one or more particular network resources.

16. The method of claim 13 wherein the execution of said request for access is denied if said stored listing shows said received user identification code to be associated with at least one user clearance corresponding to at least one resource rating shown to be associated with said one or more particular network resources.

17. The method of claim 13 wherein each of said user identification codes identifies one or more terminals adapted for facilitating network access to one or more particular network resources.

18. The method of claim 13 wherein each of said user identification codes identifies one or more individuals authorized to access one or more particular network resources.

19. The method of claim 13 wherein each of said resource identifiers corresponds to one or more uniform resource locators for accessing said one or more particular network resources.

20. The method of claim 13 further comprising the step of providing a user with access to a data listing within said relational database, wherein said data listing is associated with one or more of said plurality of resource identifiers, and wherein said data listing represents textual information related to the resource rating shown to be associated with said one or more of said plurality of resource identifiers within said stored listing.

21. The method of claim 13 wherein said relational database further comprises a stored listing of at least one system manager identifier, and said processor is adapted to identify a user as a system manager on the basis of said system manager identifier listing, and thereby permit said identified system manager to modify the contents said relational database.