WO2012129596A1

WO2012129596A1 - Providing network content

Info

Publication number: WO2012129596A1
Application number: PCT/AU2012/000310
Authority: WO
Inventors: Maxwell Andrew THOMAS; Christian Suarez ABELLA
Original assignee: The Cyber Guardian Pty Ltd
Priority date: 2011-03-25
Filing date: 2012-03-23
Publication date: 2012-10-04
Also published as: AU2012234904A1

Abstract

A method of providing network content to a user, the method including, in a base station receiving a requested content indication from a user end station via a communications network, the requested content indication being indicative of requested content; determining a user identifier indicative of an identity of the user; determining user content permissions at least in part using the user identifier, the user content permissions being indicative of content the user is permitted to view and the user content permissions being at least partly user defined; determining if the user is permitted to view the requested content using the user content permissions; and, in response to a positive determination, arranging for the requested content to be provided to the end station via the communications network.

Description

PROVIDING NETWORK CONTENT Background of the Invention

[0001] The present invention relates to a method and apparatus for providing network content to a user, and in particular to a method and apparatus for providing selective access to network content.

Description of the Prior Art

[0002] The reference in this specification to any prior publication (or information derived from it), or to any matter which is known, is not, and should not be taken as an acknowledgment or admission or any form of suggestion that the prior publication (or information derived from it) or known matter forms part of the common general knowledge in the field of endeavour to which this specification relates.

[0003] One problem associated with providing network access to individuals is the ability of individuals to view inappropriate material. This is particularly problematic in the case of providing Internet access to minors as the Internet has a large volume of material that is generally deemed inappropriate for such individuals.

[0004] A number of attempts have been made to address this issue. The majority of these focus on a client side solution, typically involving installing monitoring software on a user's computing device. The monitoring software is adapted to identify specific sites that are to be blocked, thereby preventing the user from accessing these sites. However a number of problems exist with these arrangements.

[0005] For example, by having the software installed on the user machine, this allows users direct access to the software, which in turn allows users to circumvent the protection provided. This is of particular concern for many parents who are often less computer literate than their children and hence have difficulty ensuring that the software is functioning correctly and hasn't been circumvented. A further problem with this form of arrangement is that filtering is often performed on the basis of keywords, which can often block legitimate sites. This form of solution also often requires multiple installations of the software, for example when a family has multiple computers. This can be expensive, and in any event does not provide any protection to the children when they are using an alterative computer, smartphone or the like.

[0006] Other forms of solution can be server based and mostly uses a combination of word filters and black lists to restrict content access, with these being defined for large groups of users, thereby limiting their flexibility.

[0007] In addition, many existing solutions allow access to open search facilities, such as Google™, which easily allows the user to research how to counter the facilities to restrict being put in place.

[0008] Other solutions have included filtering provided by home based routers. However, these can be difficult to configure, and require the acquisition of specific hardware, thereby limiting their use.

[0009] Accordingly, an alternative solution for restricting access to network content is desired.

Summary of the Present Invention

[0010] In a first broad form the present invention seeks to provide a method of providing network content to a user, the method including, in a base station:

a) receiving a requested content indication from a user end station via a communications network, the requested content indication being indicative of requested content;

b) determining a user identifier indicative of an identity of the user;

c) determining user content permissions at least in part using the user identifier, the user content permissions being indicative of content the user is permitted to view and the user content permissions being at least partly user defined;

d) determining if the user is permitted to view the requested content using the user content permissions; and,

e) in response to a positive determination, arranging for the requested content to be provided to the end station via the communications network. [0011] Typically the user content permissions for a first user are defined by a second user.

[0012] Typically the second user is at least one of:

a) a parent or guardian of the first user; and,

b) an employee of the first user.

[0013] Typically the base station is at least one of:

a) an Internet service provider; and,

b) a service provider.

[0014] Typically the user content permissions include user defined content permissions and default content permissions.

[0015] Typically the method includes:

a) determining attributes of the user at least in part using the user identifier; and, b) determining the default content permissions in accordance with the attributes of the user,

[0016] Typically the user content permissions include at least one of:

a) a user defined white list indicative of viewable content;

b) a user defined black list indicative of non-viewable content; and,

c) a default white list indicative of viewable content; and,

d) no restrictions.

[0017] Typically the method includes, in the base station:

a) determining from user content permissions an indication of viewable content; and b) comparing the requested content indication to the indication of viewable content to determine if the user is permitted to view the requested content.

[0018] Typically the method includes, in the base station:

a) determining from user content permissions an indication of non-viewable content; and

b) comparing the requested content indication to the indication of non-viewable content to determine if the user is restricted from viewing the requested content. [0019] Typically the method includes, in the base station, determining if the user is permitted to view the requested content if the content is indicated on a white list but not on a black list.

[0020] Typically the method includes, in the base station, determining if the user is permitted to view the requested content by:

a) determining if viewing of content is restricted using a user defined black list; b) if not, determining if viewing of content is permitted using a user defined white list; and,

c) if not, determining if viewing of content is permitted using a default white list.

[0021] Typically the method includes, in the base station:

a) receiving authentication information from the end station via the communications network;

b) comparing the authentication information to authentication data indicative of authentication information associated with authorised users; and,

c) determining if the user is an authorised user in response to the results of the comparison.

[0022] Typically the method includes, in the base station:

a) determining first user content permissions associated with a first user;

b) providing an indication of the first user content permissions to a second user via a user end station;

c) determining, in accordance with input commands received from the user end station, modifications to the first user content permissions; and,

d) updating the first user content permissions in accordance with the modifications.

[0023] Typically the method includes:

a) determining a second, user identifier associated with the second user, the second user identifier being indicative of an identity of the second user;

b) determining a selected first user;

c) determining if the second user has editing permissions for the user content permissions of the selected first user; and, d) selectively modifying the first user content permissions in response to a successful determination.

[0024] Typically the method of arranging for the requested content to be supplied to the end station includes:

a) forwarding a content request to a content server, the content server being responsive to the content request to transfer the content to the end station; and, b) retrieving the content from a store.

[0025] Typically the user includes a group of users.

[0026] In a second broad form the present invention seeks to provide apparatus for providing network content to a user, the apparatus including a base station that:

a) receives a requested content indication from a user end station via a communications network, the requested content indication being indicative of requested content;

b) determines a user identifier indicative of an identity of the user;

c) determines user content permissions at least in part using the user identifier, the user content permissions being indicative of content the user is permitted to view and the user content permissions being at least partly user defined;

d) determines if the user is permitted to view the requested content using the user content permissions; and,

e) in response to a positive determination, arranges for the requested content to be provided to the end station via the communications network.

[0027] Typically the apparatus includes a processing system including a microprocessor for executing instructions stored in a store.

[0028] Typically the apparatus includes:

a) a router;

b) at least one server for implementing at least one of:

i) an authenticator application; and,

ii) a redirection application. [0029] Typically the apparatus includes at least one of:

a) a session manager module;

b) a statistic manager module; and,

c) a white list updater module.

[0030] Typically the apparatus includes a user database and a content permissions database. Brief Description of the Drawings

[0031] An example of the present invention will now be described with reference to the accompanying drawings, in which: -

[0032] Figure 1 is a flow chart of an example of a process for providing network content to a user;

[0033] Figure 2 is a schematic diagram of an example of a distributed computer architecture;

[0034] Figure 3 is a schematic diagram of an example of a processing system;

[0035] Figure 4 is a schematic diagram of an example of an end station;

[0036] Figures 5A and 5B are a flow chart of an example of a process for modifying user content permissions for a user;

[0037] Figures 6A and 6B are schematic diagrams of examples of a user interface used for modifying user content permissions for a user;

[0038] Figure 7 is a flow chart of a further example of a process for providing network content to a user;

[0039] Figure 8 is a schematic diagram of a further example computer architecture for providing network content to a user;

[0040] Figure 9A is a flow chart of an example process for proxy setting;

[0041] Figure 9B is a schematic diagram of an example of a user interface showing proxy settings;

[0042] Figure 9C is a flow chart of an example of a proxy setting tool initialisation process;

[0043] Figure 9D is a flow chart of an example of a proxy setting tool process involving obtaining a proxy IP address and port from a webpage;

[0044] Figure 9E is a flow chart of an example of a process when a user manually enables a proxy setting tool; [0045] Figure 9F is a flow chart of an example of a process when a user manually disables a proxy setting tool;

[0046] Figure 10 is a flow chart of an example process for user authentication;

[0047] Figures 11A and 11B are a flow chart of a second example process for user authentication;

[0048] Figure 12 is a flow chart of an example process for website validation;

[0049] Figure 13 is a flow chart of an example process for statistics management;

[0050] Figure 14 is a flow chart of an example process for updating a white-list;

[0051] Figure 15 is a flow chart of an example HTTP traffic flow; and,

[0052] Figure 16 is a schematic diagram of a functional arrangement of the base station connections.

Detailed Description of the Preferred Embodiments

[0053] An example of a process for providing network content to a user will now be described with reference to Figure 1. "

[0054] In this example, a content request indication is received from a user at step 100. The indication may be of any appropriate form and may be received in any suitable manner depending on the preferred implementation.

[0055] Typically the process is performed at least in part utilising a processing system, such as a network server, or the like, coupled to a user end station via a communications network, as will be described in more detail below. In this example, the content request indication is received from the user end station via the communications network. The content request can in any suitable form, but in one example corresponds to a URL (Universal Resource Locator) such as a web address or the like submitted to the processing system via a browser application or the like.

[0056] At step 1 10 an identity of the user is determined. This is typically performed by the processing system on the basis of a user identifier that is indicative of the identity of the user, such as a user name, or the like. However, this is not essential, and any mechanism for identifying a user may be used. · [0057] At step 120, user content permissions are determined for the user, using the user identity. The user content permissions are indicative of content the user is permitted to view and the user content permissions are at least partly user defined. The user content permissions can be of any appropriate form but typically include rules, such as at least a white-list of content that the user is permitted to view, and optionally other criteria or rules such as times when content may be viewed. By having at least partially user defined content permissions, the content permissions can be as limited or widespread as required, thereby ensuring that the accessible content is appropriate for the respective user.

[0058] At step 130 it is determined if the user is permitted to view the requested content using the content permissions. Thus, for example, in the event that the user content permissions include a white list indicative of viewable content, the requested content indication can simply be compared to indications of viewable content in the white list to determine if the user is permitted to view the requested content. This could therefore include for example comparing a URL or website name received from the user end station to a list of URLs or website names provided in the white list to determine if the user is permitted to view a webpage identified by the URL.

[0059] At step 140, the content is optionally provided to the user depending for example on the results of the comparison performed at step 130. Thus, if the user has permission to view the content, then the content can be served to the user via the user end station. This can be performed using the processing system, or by arranging for the content to be served by a content server, as will be described in more detail below.

[0060] Whilst the above described process can be performed in any one of a number of manners, this is typically performed at a network routing level and more particularly an ISP (Internet Server Provider) level. An ISP is generally considered to be a company or other entity that provides users with onward access to the Internet. In this regard, ISPs typically incorporate routing hardware that allows content requests received from user end stations to be routed to a content server. Content is then returned to the ISP for forwarding to the user end station, thereby allowing the user end station to display the content using a browser application or similar. As part of this process, the volume of data received from and/or delivered to the user end station may be monitored for billing purposes. [0061] In any event, by performing the above described process at an ISP level, typically either by having the ISP implement the process themselves, or by having a third party service provider implement the process on behalf of the ISP, this can be used to ensure that adherence to user content permissions are enforced. In particular, a user attempting to access the Internet will generally always do this via a particular ISP. Accordingly, by having the ISP or other service provider maintain user content permissions for selected users, this can be used to allow the ISP to ensure that content is only served to these users in accordance with the user content permissions. The term service provider will therefore be understood to include the ISP, or a third party implementing the above described process in conjunction with the ISP.

[0062] One particular important application of this is in scenarios in which multiple users at a given location are to have access to the Internet. For example, in a family home it is typical for parents to require Internet access, for personal reasons, to perform work or the like. In such instances, children are usually able to use their parent's computer to also access the Internet. However, whilst parents may want to access a wide range of websites, typically they would prefer that their children are only able to access limited websites, thereby preventing the children being exposed to inappropriate material, such as pornography or the like. They may also prefer that access is restricted to particular times of the day, thereby preventing overuse of certain websites such as social media or the like.

[0063] In this instance each user, in the form of the parents and the children, can have respective user identifiers. When the computer at the family household connects to the Internet each user can be required to provide an indication of their respective user identifier thereby allowing the ISP to identify the user that is currently attempting to access content. The ISP or service provider can then compare the requested content to user content permissions stored locally at the ISP or service provider for the identified user, thereby allowing access to content to be restricted in accordance with the content permissions. Thus, for example, in the event that the user is a child, the user content permissions will then typically only allow them to access limited websites whilst if the user is an adult the user may be provided with access to a great range or even unlimited Internet access. [0064] By allowing access to be controlled centrally at the ISP, or an associated service provider, this avoids the need for monitoring software to be installed locally on each end user computer. This in turn helps avoid the need for multiple software installations on multiple machines, thereby avoiding the need for multiple software licences, as well as avoiding the need to configure multiple machines, which can be a time consuming and onerous task for the parents. A further issue with local installations is that in many cases children are able to subvert the protection provided by such applications, for example by accessing the software installed in the machine and then changing settings. However, by having access controlled by the ISP, using the above described process implemented either by the ISP or an associated service provider, this makes it harder for children to access and alter settings.

[0065] Additionally, central control ensures that the access restrictions are applied to any individual accessing content from the particular household making it easier to ensure that access to content is restricted as intended.

[0066] In a further example, the ISP can be used to provide Internet access in public places, for example via Wi-Fi hot spots. In this regard, such hot spots often require billing mechanisms to ensure users of the hot spot are billed for Internet access. One mechanism for achieving this is to allow users to logon to their own ISP and have communications routed by their ISP thereby allowing the charges to be incurred. It will be appreciated that even in this instance, users can have access to content restricted using the above described process.

[0067] Another important aspect of the above described process is that the user content permissions are typically at least partially user defined. This allows second users, such as parents, guardians or the like, to control the content permissions of first users, such as children or other minors. This allows guardians to specifically configure the content permissions for a given user so that the guardian can be assured that the child is only able to access content that the guardian deems appropriate. This allows individual guardians to decide on a case by case basis what content should be viewed, thereby allowing the guardians to tailor access to content for specific children. This in turn empowers guardians to retain their right to decide what content their children should, or shouldn't be viewing. [0068] Whilst this discussion has focused on use of the process for parents or guardians and children, it will be appreciated that the arrangement could be used in a wide range of scenarios. For example, the arrangement could be used in a workplace to allow employers to restrict the content that can be viewed by their employees. In this instance^ a specific version of the process explicitly targeted at the corporate market may be used. In one example, this can be in the form of a software application installed within the corporate environment, for example integrated into existing authentication systems like Microsoft's Active Directory or other LDAP compliant software directories. In this example, the process functions as described above, with the second users being managers or other authorised individuals, and the first users being employees or the like.

[0069] As mentioned above, the process is performed at least in part using a processing system coupled to end stations via a communications network. An example of such a distributed architecture will now be described with reference to Figure 2.

[0070] In this example, a base station 201 is coupled via a communications network, such as the Internet 202, and/or a number of local area networks (LANs) 204, to a number of end stations 203, which will be described in more detail below.

[0071] In use, the base station 201 includes one or more processing systems 210 that can be used in providing access to network content, as well as to allow for storing, accessing and updating of relevant data, which is typically stored in a database 211, or another local memory. Whilst the base station 201 is a shown as a single entity, it will be appreciated that the base station 201 can be distributed over a number of geographically separate locations, for example by using processing systems 210 and or databases 211 that are provided as part of a cloud based environment.

[0072] The end stations 203 are typically used to access to network content, by having the end stations 203 communicate with the base station 201, as well as allowing users to interact with other data, such as user content permissions, stored at the base station 201.

[0073] In one example, the management process is implemented at least in part using suitable content management applications software hosted by one or more processing systems 210, with the end stations 203 being used to allow user interaction with the content management applications software, via the communications networks 202, 204, for example to configure user content permissions. Each end station 203 therefore typically executes applications software allowing communication with the management software, as well as to allow viewing of content, such as a browser application, or the like. However, this is not essential and any suitable arrangement may be used.

[0074J An example of a suitable processing system 210 is shown in Figure 3. In this example, the processing system 210 includes at least one processor 300, a memory 301, an input/output device 302, such as a keyboard and/or display, and an external interface 303, interconnected via a bus 304 as shown. In this example the external interface 303 can be utilised for connecting the processing system 210 to peripheral devices, such as the communications networks 202, 204, the databases 211, other storage devices, or the like. Although a single external interface 303 is shown, this is for the purpose of example only, and in practice, multiple interfaces using various methods (e.g. Ethernet, serial, USB, wireless, 3G or the like) may be provided.

[0075 J In use, the processor 300 executes instructions in the form of applications software stored in the memory 301 to allow content access to be provided, or to allow interaction with data stored at the base station 201, such as user content permissions. Accordingly, it will be appreciated that the processing system 300 may be formed from any suitable processing system, such as a suitably programmed computer system, PC, web server, network server, or the like. In one particular example, the base station 201 is implemented as part of a cloud architecture, and it will be appreciated from this that the processing system 210 can be a single processing system or multiple processing systems 210 interconnected by a computer network.

[0076] As shown in Figure 4, in one example, the end station 203 includes at least one processor 400, a memory 401 , an input/output device 402, such as a keyboard and/or display, and an external interface 403, interconnected via a bus 404 as shown. In this example the external interface 403 can be utilised for connecting the end station 203 to peripheral devices, such as the communications networks 202, 204, storage, devices, or the like. Although a single external interface 403 is shown, this is for the purpose of example only, and in practice multiple interfaces using various methods (e.g. Ethernet, serial, USB, wireless, 3G or the like) may be provided. It will also be appreciated that additional hardware components, may be incorporated into the end stations 203, depending on the particular implementation.

[0077] In use, the processor 400 executes instructions in the form of applications software stored in the memory 401 to allow communication with the base station 201. For example, this can be used to allow an operator to interact with content management applications software hosted by the base station 201 and/or to view content, as will be described in more detail below. Accordingly, it will be appreciated that the end stations 203 may be formed from any suitably programmed processing system, such as a suitably programmed PC, Internet terminal, lap-top, hand-held PC, tablet PC, slate PC, ipad™, mobile phone, smart phone, PDA (Personal Data Assistant), or other communications device.

[0078] In the following specific example processes, it will be assumed that actions performed by the end station 203 are performed by the processor 400 in accordance with instructions stored as applications software in the memory 401 and/or input commands received from a user via the I/O device 402. The base station 201 is a server which communicates with the end stations 203 via the communications networks 202, 204 via wired or wireless connections, depending on the particular^" network infrastructure available. Actions performed by the processing system 210 are performed by the processor 300 in accordance with instructions stored as applications software in the memory 301 and/or input commands received from a user via the I/O device 302, or commands received from the end stations 203.

[0079] In the following examples, it is assumed that the processing system 210 of the base station 201 hosts a content management application that performs a majority of the processing tasks, and which generates webpages that are displayed using browser applications on the end stations 203, to allow interaction with the content management application. It is also assumed that the processing system 210 is implemented by a service provider, and that an ISP routes any content requests from the end station 203 to the processing system using an appropriate router, which may be part of the base station 201, or may be provided at another location. This will not therefore be described in further detail. [0080] However, it will be appreciated that the above described configuration assumed for the purpose of the following examples is not essential, and numerous other configurations may be used.

[0081] An example process for updating user content permissions will now be described with reference to Figures 5A and 5B.

[0082] For the purpose, of this example it is assumed that the users of the system have been registered during a registration procedure in which details of the users are provided and used to create user data, or a profile, which is typically stored in a store such as the database 21 1, and/or in a local memory for faster retrieval. The user data will typically include authentication information, allowing the user's identity to be subsequently verified, as well as providing other relevant information, such as identifying information, including a name and address and details of user attributes, including age, gender, religion, or the like.

[0083] The user data may also typically specify any relationships between different users, and in particular whether a user has editing permissions to alter the content permissions of a different user. In this regard, in this example it is also assumed that user content permissions for a first user are being modified by a second user. For the purpose of this example it will be assumed that the first user is a child and that the second user is a guardian of the child, and has editing permissions to alter the child's content permissions. It will be appreciated however that this is not essential and the process may be performed by any appropriate users, such as a manager and employee, and that reference to a guardian and child should be taken to be for the purpose of clarity of explanation.

[0084] In this example, at step 500 a guardian accesses a management application hosted by the processing system 210 using the user end station 203. As part of this access process the guardian is typically prompted to provide authentication information via a webpage displayed on the end station 203, allowing the authentication information to be transferred to the processing system 210 at step 505. At step 510, the processing system 210 authenticates the guardian, for example by comparing the authentication information to authentication information stored as part of user data. If authentication is unsuccessful, access is typically refused at step 515, and the guardian may be prompted to re-enter their authentication information by having the process return to step 505.

[0085] It will be appreciated by a person skilled in the art that this can therefore be any form of authentication process and similarly the authentication information can be any suitable form of information. Thus, in one example, the authentication information is a username and password, but this is not essential and alternatively biometric information, or the like, may be used. The authentication process is used to ensure that the guardian is a registered user, as well as to determine the identity of the guardian, typically by determining a guardian identifier, which in one example is the username.

[0086] At step 520 the processing system 210 can present of list of options to the guardian defining for example the type of actions can perform. This allows the guardian to select a define/update user content permissions option, and typically also specified a selected user, which in this example is the child, at step 520. This can be performed for example by having the guardian supply the user identifier of the child, such as the child's username, allowing the processing system 210 to access user data associated with the guardian and determine if the guardian has editing permission for the selected user, at step 525. At step 530 if editing permission is refused an indication of this is displayed to the guardian at step 535 allowing them to select alternative option or a different user at step 520.

[0087] As an alternative, this process may be reversed so that the processing system 210 uses the user data to determine other users for which the guardian has editing permissions, allowing a list to be displayed to the guardian on the end station 203, so that the guardian can simply select the child from the list.

[0088] In any event, once editing permission is granted, at step 540 the processing system 210 accesses user content permissions for the selected user, in this case the child, with these then being displayed to the guardian via the end station at step 545. Whilst the content permissions may be displayed in any way, this is typically performed using a user interface an example of which is shown in Figures 6A and 6B. [00891 Jⁿ this example, the user interface includes a manually add website field 610 together with optional time settings 630 and a manually block website field 620. At step 550 the guardian defines content permissions for the selected user by simply adding a URL into the add website or block website fields 610, 620. The URL can be specified at any level, such as a domain level, website level, or webpage level, with the content permission typically applying to any webpage below the specified level, although this is not essential, and an appropriate mechanism for specifying webpages, websites or other content, can be used.

[00901 In the case of the add website field 610 this will add the listed website to a user defined white list indicating that the user has permission to view the content provided thereon. In contrast if a website is added to the block website field 620 this will add it to a user defined black list indicative of non-viewable content, meaning that access is explicitly refused. Associated with the white list, a day and time indication can be provided allowing the guardian to indicate when the child should have access to the website displayed in the website field.

[0091] At step 555 the processing system 210 updates content permissions for the child, which are typically stored as permissions data in a store, such as the database 211 and/or in a local memory, together with an indication of the user identifier of the associated user. It will be appreciated that this process can be repeated a number of times allowing a guardian to define a large number of white list or black list websites for a selected user.

[0092] In addition to providing for manual definition of the user content permissions, a number of default content permissions can be predefined. This can be performed in any number of ways, but in one example, different sets of default content permissions in the form of default white lists of viewable content are defined and associated with different users based on user attributes, such as a user type (eg: parent or child), user age, user religion, employee seniority, or the like. In this example, when user data is created for a user, during the registration procedure, the user will typically have default content permissions associated with them, based on their attributes. These can then be tailored by the user, or more typically the user's guardian, so that the guardian still has ultimate control over the content permissions. [0093] The above described process provides a number of benefits. By specifying allowed websites/webpages in the form of a white list, this also avoids the issues associated with the difficulty in determining appropriate websites based on keywords, or the like, as well as the problem of trying to maintain an up to date black list ensure new undesirable websites are blocked. For example, searching by keywords can often block material that is legitimately to be reviewed, for example the keyword "sex" is often used to block pornographic material, but similarly can result in access to legitimate biology websites being blocked. By contrast, the use of a white list can ensure websites that are allowed to be viewed are explicitly made available.

[0094] A further benefit of the above described arrangement is that by providing appropriate content permissions, access to standard search engines and website archives can be restricted. Thus, for example, the base station 201 can host a website that provides search functionality limited to searching of websites permitted by the user's content permissions. This prevents users being able to search for techniques to circumvent restrictions, or access restricted content from archives or web search results.

[0095] Furthermore, the use of default content permissions, such as a default white list of viewable content, which is initially assigned based on user attributes, avoids the need for users to spend a significant amount of time initially creating content permissions, whilst still giving the users ultimate control. Thus, the ISP or associated service provider can maintain a substantive white list of websites that are regularly reviewed to determine if they are suitable for particular categories of users, such as children. In one example, the white list can include several million websites that have been classed as acceptable for particular users. The guardian can then modify how the default list is applied as they see fit, for example by adding sites by including these on the a user defined white list, or excluding these by including the sites on a user defined black list. It will also be appreciated that the default content , permissions can act as a guide as to the nature of sites that may be considered inappropriate for users, thereby helping guardians in making their own determination of appropriate material.

[0096] In one example, the user defined content permissions for a given user are defined in terms of changes to default content permissions. A benefit of this arrangement is that in the event that an ISP or associated service provider updates default content permissions, this change can be propagated to all relevant users. For example, if an ISP determines a particular website is no longer appropriate for a particular age range of user, the service provider can remove the website from the white list associated with users of that age.

[0097] Despite this, any user defined permissions can override the default content permissions. Thus for example, if a website is on or added to the service providers white list, but is also on the user defined black list in the content permissions for a particular user, then access to the website will be blocked. Similarly, if a website is on the user defined white list, but not the default white list, it will still be viewable. Consequently, the user defined content permissions override the default service provider defined content permissions so that the guardian retains ultimate control over what content their child is able to view.

[0098] In a further example, the process can automatically update the content permissions as user's attributes change. Thus, on a child's birthday, the process can automatically update the child's content permissions so they have access to a greater range of websites.

[0099] Additionally, by having the content permissions stored centrally, this allows guardians to access the content permissions from any end station 203. In particular, this can include end stations 203 that do not use the base station 201 as an ISP, for example by providing access to the management application via a website, or the like. This in turn allows guardians to access and update content permissions remotely, for example, from work or the like.

[0100] An example of a process for viewing content will now be described in more detail with reference to Figure 7.

[0101] In this example, at step 700 the user opens a browser application on their end station 203. At step 705 the web browser connects to the processing system 210, causing a login page to be displayed, so that the user can provide authentication information such as a user name, password or the like at step 710. This allows the processing system 210 to determine if authentication of the individual is successful at step 715. If authentication fails, then access is typically refused at step 720, with the process optionally returning to step 705, allowing alternative authentication information to be provided. It will be appreciated that any form of authentication protocol can be used and that the above described process if for the purpose of example only.

[0102] In any event, once the user has been successfully authenticated the user can type in the URL of a requested website into the browser, so that the processing system 210 can determine an indication of the requested content at step 725. The processing system 210 then accesses user content permissions at step 730, which as outlined above typically include at least a white list of web pages the user is permitted to view, and may also optionally include a black list of restricted web pages. As part of this process, if the content permissions include default content permissions, the process typically includes having the processing system 210 determine attributes of the user at least in part using the user identifier, for example by accessing the user data stored in the database 211 and then determining the default content permissions in accordance with the attributes of the user, ensuring the default content permissions selected are correct. ·

[0103] At step 735 the processing system 210 compares the URL of the requested website with the user content permissions to determine if permission is granted to view the content.

[0104] If permission to view the content is not provided, the process moves on to step 740, with the processing system 210 typically generating a webpage indicating that access to the requested URL is refused at this time. The process then typically returns to step 725 allowing the user to enter an alternative URL or the like.

[0105] In contrast if permission to view the requested content is granted, then the content, in this case the requested website, can be served to the end station 203 at step 745. This can be performed, for example by having the ISP route data packets between the end station 203 and a third party content server in the normal way.

[0106] In the above described example, the user enters a webpage URL at step 725. However, if this is not performed, then as an alternative the processing system 210 can be adapted to display a default page. In one example, the default page is generated by the processing system 210 based on the user content permissions and/or other information regarding the user, such as the user's age. The pages, which are configurable and show age appropriate content, are typically hosted by the processing system 210, and can be used to assist in steering users to appropriate content. Thus for example, a number of default pages can be developed to act as homepages for varying age brackets, with each page including content specific and appropriate for that age group. This provides users with immediate access to content which is deemed appropriate.

[0107] At this stage, a log of any activity can be generated, including for example, details of websites viewed, and requests for content that have been granted or refused. The logs can be reviewed by users having associated editing permissions, so that for example a guardian can review the log of an associated child which in turn allows guardians to view user activity remotely, for example, from work or the like.

[0108] In any event, the above described process operates to compare indications of requested content, such as URLs, with the user content permissions, thereby ensuring the user is permitted to view the requested website. By allowing the above described process to be performed at the ISP, or by the ISP itself, or an , or an associated service provider, this can be used to ensure that content permissions apply to the user no matter which end station 203 they are using to access the Internet. This allows guardians to be assured that their children are only able to access appropriate material irrespective of the end station 203 being used, whilst also providing guardians a mechanism to monitor their child's Internet activities, and update content permissions if required.

[0109] A number of further benefits can also be achieved. In particular, the ability to perform centralised monitoring of content delivery at the ISP level allows access to certain content to be blocked if required. This can be used, for example, to allow illegal content to be blocked, for example to block material relating to terrorism, copyright infringing material, or the like. Similarly, this can be used to block malware, such as viruses, or the like, allowing centralised virus protection to be supported for all users.

[0110] It will be appreciated that the above described arrangement is for the purpose of example only and that a number of variations are anticipated. A specific hardware architecture will now be described with reference to Figure 8. [0111] In this example, the apparatus includes clients 800, in the form of a number of end stations 203. The base station 201 includes at the hardware layer 810, a switch or router 811 optionally incorporating a load balancing a module 812. At the application framework layer 820, the base station 201 typically includes a number of servers 821 implementing an authenticator application 822 and a redirection application 823. The servers 821 can also implement caching to store white listed web pages, allowing these to be served more rapidly.

[0112] The application framework will also typically include an HTTP server 824 including PHP and session management modules, as well as session manager, statistic manager and white list updater modules 825, 826, 827. The architecture also typically includes a data layer 830 including a user database and content permissions database 210.1, 210.2 as shown.

[0113] The functionality provided by each of the individual modules is set out in more detail below:

[0114] Redirector Application 823

• All HTTP requests will be passed to the Redirector app which will check if requested URL is valid or not for that user or group of users.

• The Redirector will communicate with the Statistic Manager to upload statistics

regarding accessed websites and user information.

[0115] Authenticator Application 822

• An external helper application that will be used by the Redirector Application 823 during user authentication.

• This application will be used by the Redirector Application 823 every time an

unauthenticated user tries to use the system.

• The Authenticator will communicate with the Session Manager to clear previous session with the user and starts a new session.

• The user will not be able to use the Internet unless he/she enters a valid username and password.

[0116] Statistics Manager 826

• An external application that will connect to a central server to upload statistics about visited sites and user information.

[0117] White-list Updater 827 • An external application that will connect to a central server to check for updates regarding the white-list database.

[0118] Session Manager 825

• An external application that will perform session management for all users.

• If the session is not yet active the user will be directed to a web dashboard allowing options to be selected such as update content permissions. This will happen after successful user authentication by the Authenticator Application.

[0119] User Dashboard 824

• Dashboard - this will be the home page of parents and their kids. The parent's

dashboard will contain website management and management of their kids' accounts. The kids' dashboard will have a different look depending on the age group.

• User Management - this will be used by to add /edit/delete user information into the user database 211.1.

[0120] Databases 21 1

• The user database 21 1.1 will store the user information, session tables, and statistics.

This database will be setup locally.

• The content permissions database 211.2 will store all the valid URLs and will be

updated regularly via the White-list Updater application

[0121] In one example, the system implements a proxy setting to provide content requests to the redirector application. An example flow chart for configuring the proxy setting will now be described with reference to Figure 9A.

[0122] In this example, the process starts with the user initially connecting to the Internet at step 900. At step 901 an ISP router forwards an HTTP request to the router 81 1, which checks the HTTP requests IP address at step 902 and it determines if the address is equal to a proxy server address at 903. If not, the request is forwarded to a help page at step 904, allowing the help page to detect the operating system used by the client end station 203 at step 905.

[0123] If it is determined that the operating system is Windows™, at step 906, the process moves to step 907 to display Windows™ auto proxy setting instructions. At step 908, an auto proxy setting tool is downloaded to the end station 203, with this being used to set the proxy settings on the end station 203, at steps 909 and 910.

[0124] In the event that the operating system is not Windows™ it is determined if it is a Mac™ operating system, at step 911. If so, Mac™ auto proxy setting instructions are displayed at step 912, before an auto proxy setting tool is downloaded at step 908 with this being used to set the proxy settings on the end station 203, at steps 909 and 910. It will be appreciated that similar techniques could also be used for other hardware/software arrangements, such as different operating systems, and that reference to Windows™ and Mac™ is for the purpose of example only.

[0125] In the event that the IP address is equal to the proxy server address at step 903 the process allows the HTTP request at step 913.

[0126] Examples of the user interface during configuration of the proxy settings are shown in Figure 9B, in which the Firefox browser is configured to connect to the proxy server, whilst the Safari browser is configured connect directly to the Internet. In this instance, the above described process prevents the Safari browser being used, thereby ensuring that all access is via the above described process.

[0127] An example of the initialisation an auto proxy setting tool will now be described with reference to Figure 9C.

[0128] In this example at step 920 the user runs the auto proxy setting tool which may occur for example at step 909 above. At step 921 the auto proxy setting tool checks if a global proxy settings option is set. If it is determined that this is set at step 922 the process moves to step 923 with the proxy status being set to enabled and a turn-on auto proxy setting checkbox being checked. Otherwise the proxy status is set to disabled and the turn-off auto proxy setting checkbox is checked at step 924.

[0129] An example of the process for using the auto proxy setting to obtain an IP address and port from a webpage will now be described with reference to Figure 9D. [0130] In this example at step 930 the auto proxy setting tool connects to the internet and retrieves a webpage. At step 931, the auto proxy setting tool analyses the retrieved webpage and determines if the proxy IP address and port information can be found on the webpage. If so, at step 933 the proxy setting tool sets the proxy IP address to the proxy IP address information found in the retrieved webpage and similarly sets the port to the port information found in the retrieved webpage at step 933 and 934 respectively. Otherwise the proxy setting tool sets the proxy IP address and port information to null or empty, at step 935.

[0131] An example of the process when a user selects a turn-on auto proxy settings option will now be described with reference to Figure 9E.

[0132] In this example, at step 940 the user clicks on the turn-on auto proxy setting selection box of the auto proxy setting tool. At step 941 the auto proxy setting tool connects to the internet and retrieves a webpage and determines if the proxy IP address and port information can be found in the retrieved webpage. If so, at step 943 the proxy setting tool checks if an internet web browser is running and once a determination is made at step 944, if a browser is running, displays a warning message that the proxy setting will be set and internet web browser will be restarted if the user clicks "yes" at step 945. If the user clicks "yes" at step 946, the process moves to step 947 and sets the proxy settings to information found in the retrieved webpage. At step 948 the global proxy settings are then set to the information found in the webpage before the proxy status is set to enabled at step 949. Otherwise if the user clicks no, or if proxy IP address and port information is not found in the retrieved webpage the proxy status is set to disabled and the turn-off button stays checked at step 950.

[0133] An example of the process when the user turns off the auto proxy setting tool will now be described with reference to Figure 9F.

[0134] In this example, the user clicks the turn-off auto proxy setting tools button at step 960 using the tool to set global proxy settings to not using proxy at step 961. The browser proxy settings are updated accordingly at step 962 with the proxy status set to disabled and the turn- off button status being checked at step 963. [0135] An example process for performing user authentication will now be described with reference to Figure 10.

[0136] In this example, at step 1000 the user connects to the Internet for example by opening their browser application using the client end station 203. At step 1005 the router 811 forwards traffic to the servers 821, which launch an instance of the authenticator application 822, at step 1010. The authenticator application assesses whether the user name and password supplied by the user is valid by comparison to user data in the user database 211.1, at step 1015, and if not the process returns to step 1010 allowing authentication to be repeated. Otherwise the previous session is cleared at step 1020, and authentication ends.

[0137] Thus, when the user connects to the server 821 can check if a session is alive. If the session is not alive, the user will be redirected to a Login Page which will ask for a username and password in order to validate the user. The user will not be able to go to any website until his/her credentials are authenticated. The Login Page will connect to the user database 211.1 to verify the username and password entered by the user. Once the user is validated, a session will be created and stored in a session table. The life of the session will restricted to a default value with possible configuration override.

[0138] Accordingly, user authentication is typically performed by a web-based (PHP) authenticator, with the redirector application checking if the user is validated by getting the username (session) from the page that validated the user. If the user is not yet validated, they will be redirected to the login page.

[0139] To ensure parents passwords can't be easily acquired by children due to certain browser functionality a second level of authentication can be provided. In one example, this is achieved by requiring that the user provide a second level of authentication information, such as a personal identification number (PIN) or other suitable identifier, as will now be described in more detail with reference to Figure 11.

[0140] In this example, at step 1100 opens the web browser application on the end station 203. The web browser connects to the processing system 210 at step 1105, which in turn causes a login prompt to be displayed. It will be appreciated that this can be achieved using any appropriate mechanism, such as displaying a login page, or alternatively through the use of a suitable configured pop-up.

[0141] At step 1110 the user provides authentication information, such as a username and password, biometric information, or the like, with the authentication information being transferred to the processing system 210, at step 1 115 for validation. If it is determined that the authentication information is invalid at step 1 120, the processing system 210 causes the browser application to display an authentication failure message at step 1 125, for example confirming the username and/or password is incorrect, before the process returns to step 1105 allowing the login prompt to be redisplayed so the authentication information can be reentered.

[0142] In the event that the authentication information is correct, the processing system 210 determines if there is a current valid session established for the user at step 1130. If not, a session is established at step 1135.

[0143] Once there is a valid session, the process moves onto step 1140, with the processing system 210 determining further required information. The nature of the further required information will depend on the preferred implementation. In one example, the further required information can include a PIN, although alternatively answers to predetermined questions may be used. It will be appreciated that the nature of the further information may be defined during the initial registration process described in more detail above.

[0144] At step 1145 the processing system 210 causes the browser application to prompt the user for the further required information, for example by displaying an appropriate page, popup, or the like. Thus, for example, the browser may display a page including a predetermined question defined in the user data, allowing the user to answer the question and thereby supply the further required information at step 1150. At step 1 155, the processing system 210 determines if the response is valid, and if not causes the browser to display an authentication failure message at step 1160, allowing the process to return to step 1145 so correct information can be provided. [0145] Assuming that authentication is successful, then the processing system 210 retrieves a requested web page using the previously described processes to ensure the requested page can be legitimately displayed.

[0146] An example of a website validation process will now be described with reference to Figure 12.

[0147] In this example, at step 1200 the redirector application 832 receives an HTTP request. At step 1205 the redirector application 832 obtains a user type from the user database to 211.1. The redirector application 832 determines if the user is a parent, at step 1210. If the user is a parent it is determined if protection mode is enabled at step 1215. If a protection mode is not enabled for the parent, the parent is able to view any website and accordingly, access is provided to the website requested in the HTTP request at step 1220.

[0148] Otherwise, if the user is not a parent, or protection mode , is enabled, the process moves on to step 1225, to determine the website name identified in the HTTP request. The website name is then compared to the user defined black list for the user at step 1230. If the website is not on the black list, the website name will be compared to the user defined white list at step 1235. If the website is not on the black list and is on the white list this indicates that access to the website should be provided and this is therefore allowed at step 1220.

[0149] If the website is not on a parents white list an additional step of checking whether this is on the default white list can be performed at step 1240. If so, and if this is permitted by user access content permissions then the process can move on to step 1220 allowing the website to be served to the user. Otherwise, it is determined at step 1245 if the user is a parent. If it is, the user can select to continue to the website at step 1250, allowing website to be viewed at step 1220. Otherwise access to the website is blocked at step 1255.

[0150] Accordingly, the above described process uses website validation for both parents with Protection-Mode enabled and for kids.

[0151] If Protection-Mode is disabled for a parent then all websites will be allowed. On the other hand, if Protection-Mode is enabled the website will be validated first against his/her blacklist. If it is in the parent's blacklist he will be asked if he/she wants to continue visiting the website or not. If the website is not in the parent's blacklist but is in the parent's whitelist then access to that website is allowed. If the website is not in parent's blacklist and whitelist but is in service provider's whitelist then access to that website is allowed. If the website is not in the parent's blacklist and whitelist and not in service provider's whitelist, the parent will be asked if he/she wants to continue visiting the website or not.

[0152] Children have no Protection-Mode feature. All websites that he/she wants to access will be validated against the parent's blacklist, whitelist, and service provider's whitelist respectively. First, if the website is in the parent's blacklist, access will not be allowed. If the website is not in the parent's blacklist but is in the parent's whitelist, access will be allowed. If the website is not the parent's whitelist and blacklist but in service provider's whitelist, access will be allowed. Finally, if the website is not in the parent's whitelist and blacklist and not in service provider's whitelist, access will not be allowed.

[0153] If a website is not allowed, the child can request it but it is subject to approval by his/her parent. If approved the website will be added in the parent's whitelist.

[0154] Accordingly, it will be appreciated that the above described process first determines whether the user is a parent and if so whether any protection mode is to be enabled. If it is determined that the user is not a parent or protection mode is enabled, the process initially compares the website to a black list, thereby operating to explicitly exclude any restricted identified websites. Otherwise if the website is not explicitly excluded in a black list, a further check is performed against a white list of permitted websites that the user is able to view. In this process, the user defined content permissions are given priority over default content permissions generated by the ISP or associated service provider.

[0155] Whilst the parent white and black list are used for assessing whether children can view content. However, this is not essential, and as described above, parents and children can have different user defined and default content permissions.

[0156] The statistics module 827 can operate to collect statistics regarding operation of the system. This will now be described with reference to Figure 13. [0157] In this example, the statistics manager module 827 initially checks for any new statistic at step 1300. In the event that new statistics are detected, at step 1305 the new statistics are processed with the statistics manager module 827, for example to extract relevant information, or the like. The statistics manager module 827 then connects to the server 821 at step 1310, performing a check at step 1315 to ensure the server 821 is functioning correctly, before uploading the statistics data to the server 821 at step 1320. The statistics data is stored in the user database 21 1.1. It is then determined if the upload is successful at step 1135, and if so the data is locally deleted at step 1330.

[0158] It will be appreciated that this allows statistics regarding browsing sessions to be recorded and subsequently reviewed on a user by user basis, for example to allow further potential black or white list entries to be identified.

[0159] A flow chart showing an example process for updating a white list using the white list updater module 827 will now be described with reference to Figure 14.

[0160] In this example, at step 1400 the white list updater module 827 connects to the server 821 and determines if a current session is still active at step 1405. If not, reconnection may be required at step 1400. If the server connection is functioning correctly at step 1410, a check is performed to determine if a white list update is available. At step 1415 a check is performed to determine if the current white list is equal to a previous white list and if not a white list update is performed at step 1420, thereby updating the content permissions database 211.2, with the white list being updated locally at step 1425.

[0161] Figure 15 is an example of the HTTP traffic flow in the above described configuration.

[0162] In this instance it can be seen that users of multiple end stations 203 provided in a home 1500 can use a single home router 1501 to connect to an ISP router 1520. The ISP router 1520 is in turn in communication with the router 811, which utilises the servers 821 to provide onward connectivity to web servers 1510 which host web content. Thus, in this instance, the ISP router 1520 forwards indications of content requests to the router 811, allowing the above described process to be performed. [0163] Thus, functionally the network architecture is as shown in Figure 16, with the base station 201 connected to the Internet 202, with users computers being connected to the base station 201 via a LAN or WAN 204. This allows all traffic to be routed via the base station 201, thereby ensuring that all network content transferred to and from the Internet 202 can be monitored, with content being blocked as required..

[0164] It will be appreciated that above described process therefore provides a mechanism for allowing second users, such as parents and guardians, to restrict access to network, and in particular Internet, content for first users, such as children. The system typically operates at an ISP or similar level, so that users are required to be identified prior to accessing content. This can be used to ensure that access to content is restricted regardless of the end station used to attempt to access the content. The process can use a combination of white and black lists to ensure that multiple levels of protection are provided, and can also restrict access on the basis of other criteria such as time and date. In a further example, content permissions defined by both a parent and ISP can be used, to thereby define a greater level of protection, whilst still giving parents ultimate control over the content viewed by children.

[0165] Whilst the above described process has focussed on the ability to access webpages, the process can be configured to apply to any content. For example, the process could be used to restrict or limit access to media download services, such as iTunes™, for example by permitting a limited number of downloads in a given time period. Restriction to file sharing services, such as BitTorrent can also be used to prevent content permissions being circumventing by downloading of content directly. Restriction to social media or online gaming services, such as Facebook or World of Warcraft can also be used to prevent content permissions being circumvented by downloading data. It will therefore be appreciated that content can include webpages, websites, audio content, video content, image content, files, or the like.

[0166] In addition to this, the above described process has the ability to control access for programs that require online Internet access. For example, the process can be used to block all network traffic coming from any type of program, game, or otherwise, by default. Rule sets can be setup to allow access to the network, and subsequently the Internet, for various programs as required by the user, or by the user's guardian. The rule sets can be applied indefinitely, for a limited time or for certain times during the day. The resultant effect of this is that it allows the guardian to control when and for how long users can play games. Blocking of data from games can be achieved in any suitable manner depending on the preferred implementation, but typically involves selectively blocking traffic directed via specific ports, which are usually configured for use by games and the like.

[0167] It will therefore be appreciated that the term content can include any form of network traffic and is not limited to web pages or other similar content. Furthermore, the term users can include programs used by a user, such as games or the like.

[0168] The above described process can also be used as a basis for a controlled social media environment. In particular, not only can access to general social media be restricted, but an alternative social media environment can be provided only to registered users of the system.

[0169] In this regard, each user is identified in order to allow them access to the system, for example by having them undergo a credit check to sign up to the ISP. This validation of the user's identity means that the service provider can uniquely identify all users of the system, thereby preventing users concealing their identity to performing inappropriate actions, such as an adult masquerading as another child to befriend children with whom they have no legitimate relationship. In the event that such activity is identified, the user can then be excluded from the social media environment.

[0170] It will be appreciated that in terms of user identity verification, this may only need to be performed for some users, with other users being Vouched for by that user. So for example, when a parent has their identity validated, they may be able to further validate other users, such as their children and immediate relatives.

[0171] The social media environment could also be configured to limit to users based on particular attributes, such as age or the like. Thus, a social media page could have segmented secure areas where only our validated users can interact, and again only within their respective age range, or the like. We could further break these users segments down by age brackets. [01721 Additionally and/or alternatively, the content permissions can be used to further limit interaction between users. For example, the content permissions for a user may specify other users with which the user may interact. This allows a parent or guardian to restrict interaction of their children, for example limiting their child to interacting with known friends or relatives. Such limitations on interaction can apply not only to social media environments, but also to other communications such as instant messenger, email or the like. In this instance, it will be appreciated that when a user attempts to send or receive a message, this can be compared to the content permissions to determine whether this should be blocked or permitted.

[0173 J A further benefit is that the above described arrangement can be used to perform filtering of web content or remote systems that are perceived to be a threat to a consumer's network or computers. The above described process can therefore be used to implement antivirus protection, or the like. Thus, in this example, the base station 201 effectively sits between the user's end stations 203 and the Internet 202, or other network, such as a commercial network or a complete country wide network. The base station 201 can then block network content from going to destinations that have not been verified as safe. This forms the basis for online protection from virus threat.

[0174] This traffic is not only blocked for web traffic but can also be blocked for any type of content, for example, file downloads or email born threats. The process can also cater for the blocking of phishing or scamming websites further enhancing its protection capability. This protection is available because the above described process can control all the network ports available in much the same way as a firewall operates and also has the ability to inspect potential threats between the source and the destination i.e. the consumer's personal computer.

[0175] This functionality, when bundled with a product that will protect the desktop from threats that can be passed via external media like a USB Drive or Compact Disc, allows the base station 201 to offer a complete virus protect solution.

[0176] It will also be appreciated that the protection can work in both directions. Accordingly, not only can this be used to prevent user's downloading viruses from a network, but can also be used to allow the system to be used to prevent viruses or other malware being uploaded onto a network, or transferred via the network to, other users.

[0177] The above examples have focussed on restricting content access for individual users. However, it will be appreciated that the above described techniques can also be applied to groups of users, and the term user should therefore encompass an individual or group of individuals.

[0178] Persons skilled in the art will appreciate that numerous variations and modifications will become apparent. All such variations and modifications which become apparent to persons skilled in the art, should be considered to fall within the spirit and scope that the invention broadly appearing before described.

Claims

THE CLAIMS DEFINING THE INVENTION ARE AS FOLLOWS:

1) A method of providing network content to a user, the method including, in a base station: a) receiving a requested content indication from a user end station via a communications network, the requested content indication being indicative of requested content;

b) determining a user identifier indicative of an identity of the user;

e) in response to a positive determination, arranging for the requested content to be provided to the end station via the communications network.

2) A method according to claim 1, wherein the user content permissions for a first user are defined by a second user.

3) A method according to claim 2, wherein the second user is at least one of:

a) a parent or guardian of the first user; and,

b) an employee of the first user.

4) A method according to any one of the claims 1 to 3, wherein the base station is at least one of:

a) an Internet service provider; and,

b) a service provider.

5) A method according to any one of the claims 1 to 4, wherein the user content permissions include user defined content permissions and default content permissions.

6) A method according to claim 5, wherein the method includes:

a) determining attributes of the user at least in part using the user identifier; and, b) determining the default content permissions in accordance with the attributes of the user.

7) A method according to any one of the claims 1 to 6, wherein the user content permissions include at least one of:

a) a user defined white list indicative of viewable content;

b) a user defined black list indicative of non-viewable content; and, c) a default white list indicative of viewable content; and,

d) no restrictions.

8) A method according to any one of the claims 1 to 7, wherein the method includes, in the base station:

. a) determining from user content permissions an indication of viewable content; and b) comparing the requested content indication to the indication of viewable content to determine if the user is permitted to view the requested content.

9) A method according to any one of the claims 1 to 8, wherein the method includes, in the base station:

a) determining from user content permissions an indication of non-viewable content; and b) comparing the requested content indication to the indication of non-viewable content to determine if the user is restricted from viewing the requested content.

10) A method according to any one of the claims 1 to 9, wherein the method includes, in the base station, determining if the user is permitted to view the requested content if the content is indicated on a white list but not on a black list.

11) A method according to any one of the claims 1 to 9, wherein the method includes, in the base station, determining if the user is permitted to view the requested content by:

a) determining if viewing of content is restricted using a user defined black list;

b) if not, determining if viewing of content is permitted using a user defined white list; and,

12) A method according to any one of the claims 1 to 11, wherein the method includes, in the base station:

13) A method according to any one of the claims 1 to 12, wherein the method includes, in the base station: a) determining first user content permissions associated with a first user;

14) A method according to claim 13, wherein the method includes:

a) determining a second user identifier associated with the second user, the second user identifier being indicative of an identity of the second user;

b) determining a selected first user;

c) determining if the second user has editing permissions for the user . content permissions of the selected first user; and,

d) selectively modifying the first user content permissions in response to a successful determination.

15) A method according to any one of the claims 1 to 14, wherein the method of arranging for the requested content to be supplied to the end station includes:

a) forwarding a content request to a content server, the content server being responsive to the content request to transfer the content to the end station; and,

b) retrieving the content from a store. "

16) A method according to any one of the claims 1 to 15, wherein the user includes a group of users.

17) Apparatus for providing network content to a user, the apparatus including a base station that:

b) determines a user identifier indicative of an identity of the user;

d) determines if the user is permitted to view the requested content using the user content permissions; and, e) in response to a positive determination, arranges for the requested content to be provided to the end station via the communications network.

18) Apparatus according to claim 17, wherein the apparatus includes a processing system including a microprocessor for executing instructions stored in a store.

19) Apparatus according to claim 17 or claim 18, wherein the apparatus includes:

a) a router;

b) at least one server for implementing at least one of:

i) an authenticator application; and,

ii) a redirection application.

20) Apparatus according to claim 19, wherein the apparatus includes at least one of:

a) a session manager module;

b) a statistic manager module; and,

c) a white list updater module.

21) Apparatus according to claim 19 or claim 20, wherein the apparatus includes a user database and a content permissions database.