Firewall for controlling data transfers between networks based on embedded tags in content description language

• US 6,742,040 B1
• Filed: 02/04/2000
• Issued: 05/25/2004
• Est. Priority Date: 12/27/1996
• Status: Expired due to Term

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Toga, James E.
• Primary Examiner(s): Wiley, David
• Assistant Examiner(s): DELGADO, MICHAEL A
• Application Number:
  US09/497,886
• Time in Patent Office: 1,572 Days
• Field of Search: 714/37, 707/104.1, 707/9, 709/227, 709/203, 709/224, 709/229, 709/225
• US Class Current: 709/229
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A method of controlling data transfer between a first and a second computer network comprises parsing content description language received from the first computer network to determine tag information with the content description language. A completion decision is made based on the tag information. For one embodiment, the completion decision may include any of the following: full data transfer between the two network, partial data transfer between the two network, a deferred data transfer at a later time, or a cached data transfer. Restrictions based upon a user'"'"'s age, a user'"'"'s access right, cost, system resources, and time of day may also be employed to limit the transfer of data based upon the tag information.

Claims

1. A method of controlling transfer of data between a first network of computers and a second network of computers, the method comprising:

parsing content description language received from the first network of computers;

determining tag information within the parsed content description language, said tag information including information available to the second network of computers; and

making a completion decision by the second network of computers as to whether to allow the transfer of data based on the tag information available to the second network of computers.

2. The method of claim 1 wherein the completion decision determines whether the transfer is allowed to occur.

3. The method of claim 1 wherein the completion decision determines whether only a partial transfer is allowed to occur.

4. The method of claim 3 wherein text but not pictures are allowed to be transferred.

5. The method of claim 1 wherein the completion decision is based upon a resource constraint of the second network of computers.

6. The method of claim 1 wherein the content description language is HTML.

7. The method of claim 1 wherein the tag information includes a pricetag for the transfer of data, and wherein the completion decision is based upon the pricetag for the transfer of data.

16. The method of claim 1 wherein the completion decision allows a transfer to be deferred until a later time.

17. The method of claim 1 wherein the completion decision allows a transfer to be cached.

18. The method of claim 17 wherein the caching is based on tag information.

8. A method of controlling transfer of data between a first network of computers and a second network of computers, the method comprising:

parsing content description language data received from the first network of computers to determine tag information indicating a pricetag for subsequent transfers of said content description language data to the second network of computers; and

allowing the subsequent transfers of the content description language data to the second network of computers if the pricetag is below a predetermined spending limit.

9. The method of claim 8 wherein a user connected to the second network of computers requests the subsequent transfers of content description language data and the predetermined spending limit is associated with the user.

19. The method of claim 8 further comprising:

subtracting the pricetag from a budget amount attributed to a user that requested the subsequent transfers of the content description language data.

10. A method of controlling transfer of data between a first network of computers and a second network of computers, the method comprising:

parsing content description language data received from the first network of computers to determine tag information indicating a size of subsequent transfers of said content description language data to the second network of computers; and

disallowing the subsequent transfers of the content description language data to the second network of computers if the size of the subsequent transfers of content description language data interferes with resource constraints of the second network of computers.

11. The method of claim 10 wherein disallowing the subsequent transfers of the content description language data is also based upon time of day restrictions.

12. The method of claim 10 wherein the tag information indicates that the subsequent transfers of content description language data are entertainment-based.

13. A method of controlling transfer of data between a first network of computers and a second network of computers, the method comprising:

parsing content description language data received from the first network of computers to determine tag information about subsequent transfers of said content description language data to the second network of computers; and

disallowing the subsequent transfers of the content description language data to the second network of computers based upon a time of day restriction specified by the tag information.

14. The method of claim 13 wherein the tag information about subsequent transfers indicates that the subsequent transfers of content description language data are entertainment-based.

15. A method of controlling transfer of data between a first network of computers and a second network of computers, the method comprising:

parsing content description language data received from the first network of computers to determine tag information about subsequent transfers of said content description language data to the second network of computers; and

disallowing the subsequent transfers of the content description language data to the second network of computers based upon age restrictions of a requestor of the content description language data from the second network of computers, wherein the age restrictions are specified by the tag information.

20. A method, comprising:

examining content description language tags embedded within data from a first computer network and criteria from a second computer network, wherein the examination occurs on a proxy server;

comparing the content description language tags embedded within the data and the criteria, wherein the comparison occurs on the proxy server;

controlling whether the transfer of data from the first computer network to the second computer network is allowed based on a completion decision resulting from the comparison of the content description language tags embedded within the data and the criteria, wherein the completion decision occurs on the proxy server.

21. The method of claim 20 wherein examining data from the first computer network further comprises examining data from a cache.

22. The method of claim 20 wherein examining criteria from the second computer network further comprises examining criteria from a cache.

23. The method of claim 20 wherein comparing the data and the criteria further comprises examining data and criteria from a cache.

24. The method of claim 20 wherein examining data from the first computer network further comprises examining data from a database.

25. The method of claim 24 wherein examining data from a database further comprises examining data from a cached database.

26. The method of claim 20 wherein examining criteria from the second computer network further comprises examining criteria from a database.

27. The method of claim 26 wherein examining criteria from a database further comprises examining criteria from a cached database.

28. The method of claim 20 wherein examining data from the first computer network further comprises examining a content description language tag.

29. The method of claim 20 wherein examining criteria from the second computer network further comprises examining an acceptance content description language tag.

30. The method of claim 20 wherein comparing the data and the criteria further comprises comparing a content descriptor and an acceptance content description language tag.

31. The method of claim 20 wherein comparing the data and the criteria further comprises comparing a content descriptor and an acceptance content description language tag.

32. The method of claim 20 wherein the completion decision further comprises a content descriptor being within a set of an acceptance content description language tag.

33. An apparatus, comprising:

means for examining content description language tags embedded within data from a first computer network and criteria from a second computer network, wherein the examination occurs on a proxy server;

means for comparing the content description language tags embedded within the data and the criteria, wherein the comparison occurs on the proxy server;

means for controlling whether the transfer of data from the first computer network to the second computer network is allowed based on a completion decision resulting from the comparison of the content description language tags embedded within the data and the criteria, wherein the completion decision occurs on the proxy server.

34. The apparatus of claim 33, wherein the means for examining data further comprises means for parsing data to obtain tag information.

35. The apparatus of claim 34, wherein the means for means for comparing the data and the criteria further comprises means for comparing the tag information and the criteria.

36. The apparatus of claim 33, wherein the means for examining criteria further comprises means for retrieving criteria from the second computer network database.

37. The apparatus of claim 33, wherein the means for comparing the data and the criteria further comprises means for comparing data from a cache and criteria from a cache.

38. An apparatus for controlling data transfers between a first computer network and a second computer network, the apparatus comprising:

a proxy connected to the first computer network and the second computer network;

criteria coupled to the proxy; and

a parsing engine coupled to the second computer network and the proxy, such that the criteria and the parsing engine control the data transfers through the proxy by comparing the criteria to the data'"'"'s content description language tags.

39. The apparatus according to claim 38, wherein the coupling of the criteria to the proxy is a database.

40. The apparatus according to claim 38, wherein the coupling of the criteria to the proxy is a cache.

41. The apparatus according to claim 38, wherein the coupling of the parsing engine to the proxy is a database.

42. The apparatus according to claim 41, wherein the database is a cache.

43. The apparatus according to claim 41, wherein said database is the result of the second computer network coupling to said parsing engine.

44. The apparatus according to claim 38, wherein the proxy comprises a computer.