Internet address filtering based on a local database

Patent metadata

Field	Value
Publication number	US-9948649-B1
Application number	US-201414586037-A
Country	US
Kind code	B1
Filing date	Dec 30, 2014
Priority date	Dec 30, 2014
Publication date	Apr 17, 2018
Grant date	Apr 17, 2018

Abstract

A device may receive a request to access a resource. The resource may be associated with resource information. The device may obtain rating information based on receiving the request. The rating information may identify a rating associated with the resource. The device may apply an access rule based on the rating information. The access rule may identify an access indicator to generate based on the rating information. The access indicator may indicate an action to perform related to the resource. The device may generate the access indicator based on applying the access rule to the rating information. The device may store, locally in one or more memories, information that indicates an association between the access indicator and the resource information.

First claim

What is claimed is:

1. A method, comprising:
receiving, by a device and from a client device via a network, a first request to access a resource,
the resource being associated with resource information;

determine, by the device, the resource information associated with the first request,
the resource information including at least one of:
a domain name,
a URL path, or
a network address;

determine, by the device, that the at least one of the domain name, the URL path, or the network address associated with the first request is not stored in a local data structure;
requesting, by the device and from a rating server, rating information, based on receiving the first request;
receiving, by the device and from the rating server, the rating information, based on requesting the rating information,
the rating information identifying a rating associated with the resource and further including at least one of:
a category identifier,
a file type identifier, or
a content type identifier;

receiving, by the device, an access rule,
the access rule identifying an access indicator to generate based on the rating information, and
the access rule being based on the resource information;

determining, by the device, whether the rating satisfies a threshold;
generating, by the device, based on the access rule, and based on whether the rating satisfies the threshold, the access indicator,
the access indicator indicating an action to perform related to the resource;

storing, by the device in the local data structure stored on the device, information that indicates an association between the access indicator and the resource;
receiving, by the device, another request to access the resource;
searching, by the device, the local data structure for the access indicator associated with the resource;
determining, by the device, the access indicator based on searching the local data structure; and
selectively performing, by the device, the action based on determining the access indicator.

2. The method of claim 1 , where the resource is a first resource;
where the resource information is first resource information;
where the access indicator is a first access indicator; and
where the method further comprises:
receiving a second request to access a second resource,
the second resource being different than the first resource, and
the second resource being associated with second resource information;

determining that a second access indicator associated with the second resource is not stored in the local data structure;
requesting rating information associated with the second resource information;
receiving the rating information associated with the second resource information;
generating the second access indicator based on the rating information associated with the second resource information; and
storing, in the local data structure, information that indicates an association between the second access indicator and the second resource information.

3. The method of claim 1 , further comprising:
performing the action indicated by the access indicator,
the action including at least one of:
an action to permit access to the resource,
an action to deny access to the resource,
an action to monitor access to the resource, or
an action to redirect access to the resource.

4. The method of claim 1 , where the resource information includes a domain name; and
where the method further comprises:
requesting, from a domain name server and based on the domain name, a network address,
the network address being associated with the resource;

receiving, from the domain name server, the network address; and
storing, in the local data structure, information that indicates an association between the access indicator and the network address.

5. The method of claim 1 , where the information associated with the resource includes information identifying at least one of:
a threshold rating,
a resource category,
a resource type,
a source network address,
a destination network address,
a source network port,
a destination network port, or
a protocol type.

6. The method of claim 1 , where the local data structure includes a local domain data structure and a local network address data structure; and
where searching the local data structure comprises:
searching at least one of the local domain data structure or the local network address data structure for the access indicator associated with the resource.

7. A device, comprising:
one or more processors to:
receive, from a client device via a network, a request to access a resource,
the resource being associated with resource information;
determine, by the device, the resource information associated with the request to access the resource the resource information including at least one of:
a domain name,
a URL path, or
a network address;

determine, by the device, that the at least one of the domain name, the URL path, or the network address associated with the request is not stored in a local data structure;
obtain, from a rating server, rating information based on receiving the request,
the rating information identifying a rating associated with the resource and further including at least one of:
a category identifier,
a file type identifier, or
a content type identifier;

apply an access rule based on the rating information,
the access rule identifying an access indicator to generate based on the rating information,
the access indicator indicating an action to perform related to the resource, and

the access rule being based on the resource information;

determine whether the rating satisfies a threshold;
generate, based on the access rule, and based on whether the rating satisfies the threshold, the access indicator;
store, in the local data structure stored on the device, information that indicates an association between the access indicator and the resource;
receive another request to access the resource;
search the local data structure for the access indicator associated with the resource;
determine the access indicator based on searching the local data structure; and
selectively perform the action based on determining the access indicator.

8. The device of claim 7 , where the one or more processors are further to:
request, from a domain name server, an internet protocol (IP) address, based on the resource information;
receive the IP address from the domain name server; and
store, in the local data structure, information that indicates an association between the IP address and the access indicator.

9. The device of claim 8 , where the one or more processors are further to:
receive, from the client device, a resource request,
the resource request being different than the request to access the resource, and
the resource request including the IP address; and

determine the access indicator based on the stored information that indicates the association between the IP address and the access indicator.

10. The device of claim 7 , where the one or more processors are further to:
determine that the resource information is not stored in the local data structure; where the one or more processors, when obtaining the rating information, are to:
request, from the rating server and based on determining that the resource information is not stored in the local data structure, the rating information; and
receive, from the rating server, the rating information.

11. The device of claim 7 , where the request to access the resource is a domain name service request; and
where the one or more processors are further to:
provide, to a domain name server, a do

Assignees

• Juniper Networks Inc

Inventors

• Zhao Ye
• Yang Jun
• Zhao Tao
• Chen Lin

Classifications

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L67/5682

  Policies or rules for updating, deleting or replacing the stored data · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title