Walled garden system for providing access to one or more websites that incorporate content from other websites and method thereof

1. A walled garden system for providing access from user devices to one or more websites specified on a cleared sites list, the cleared sites list having one or more hostname descriptors, the walled garden system comprising:

a firewall device having rules associated with a cleared internet protocol (IP) list including one or more cleared IP addresses corresponding to websites on the cleared sites list, wherein the cleared sites list contains a list of external websites accessible by a user and specified by either IP addresses or hostnames;

the firewall device for permitting direct transfer of only cleared hypertext transfer protocol (HTTP) requests from a user device, wherein each of the cleared HTTP requests is to a cleared destination IP address that matches one of the cleared IP addresses; and

a controller for examining non-cleared HTTP requests from the user device, wherein each of the non-cleared HTTP requests is to a non-cleared destination IP address that does not match one of the cleared IP addresses,

the controller for acting as a transparent proxy between the user device and a non-cleared destination IP address of a non-cleared HTTP request when any of a destination host header and a referrer header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list, and

the controller for blocking the non-cleared HTTP request when neither of the destination host header nor the referrer header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list;

wherein the controller is further configured to:

add, with a first expiry setting, the destination IP address of the non-cleared HTTP request to the cleared IP addresses of the firewall device when the destination host header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list; and

add, with a second expiry setting, the destination IP address of the non-cleared HTTP request to the cleared IP addresses of the firewall device when only the referrer header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list.

2. The walled garden system of claim 1 , wherein:

the cleared sites list further includes at least one referrer-enabled hostname descriptor having a configuration option enabling referrer based access; and

when the destination host header of the non-cleared HTTP request does not match a hostname descriptor of the cleared sites list, the controller is for acting as the transparent proxy between the user device and the non-cleared destination IP address of the non-cleared HTTP request only when the referrer header of the non-cleared HTTP request matches a referrer-enabled hostname descriptor of the cleared sites list.

3. The walled garden system of claim 1 , wherein:

at least one hostname descriptor on the cleared sites list includes one or more wildcards; and

the controller is further for searching for matches of the referrer header of the non-cleared HTTP request to a hostname descriptor of the cleared sites list taking into account the wildcards.

4. The walled garden system of claim 1 , wherein:

the controller is further for removing destination IP addresses from the cleared IP addresses after an expiry duration associated with each destination IP address; and

the first expiry setting specifies a first expiry duration being longer than a second expiry duration specified by the second expiry setting.

5. The walled garden system of claim 1 , wherein:

the firewall directly transfers connection requests associated with the cleared HTTP requests to an external network, and forwards connection requests associated with the non-cleared HTTP requests to the controller; and

the controller accepts the connection requests associated with the non-cleared HTTP requests in order to examine the non-cleared HTTP requests.

6. The walled garden system of claim 1 , wherein when acting as the transparent proxy between the user device and the non-cleared destination IP address when the referrer header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list, the controller is for acting as the transparent proxy for only one HTTP request-response transaction between the user device and the non-cleared destination IP address.

7. The walled garden system of claim 1 , wherein the controller is further for periodically performing a DNS lookup on exact hostname descriptors on the cleared sites list and adding one or more resulting DNS-resolved IP addresses to the cleared IP list.

8. The walled garden system of claim 7 , wherein the exact hostname descriptors on the cleared sites list are hostname descriptors that do not include wildcards.

9. A method in a walled garden system of providing access from user devices to one or more websites specified on a cleared sites list, the cleared sites list having one or more hostname descriptors, the method comprising: storing a cleared internet protocol (IP) list including one or more cleared IP addresses corresponding to websites on the cleared sites list, wherein the cleared sites list contains a list of external websites accessible by a user and specified by either IP addresses or hostnames;

permitting direct transfer of only cleared hypertext transfer protocol (HTTP) requests from a user device, wherein each of the cleared HTTP requests is to a cleared destination IP address that matches one of the cleared IP addresses;

examining non-cleared HTTP requests from the user device, wherein each of the non-cleared HTTP requests is to a non-cleared destination IP address that does not match one of the cleared IP addresses;

transparent proxying between the user device and a non-cleared destination IP address of a non-cleared HTTP request when any of a destination host header and a referrer header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list;

blocking the non-cleared HTTP request when neither of the destination host header nor the referrer header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list;

adding, with a first expiry setting, the destination IP address of the non-cleared HTTP request to the cleared IP addresses when the destination host header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list; and

adding, with a second expiry setting, the destination IP address of the non-cleared HTTP request to the cleared IP addresses when only the referrer header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list.

10. The method of claim 9 , further comprising:

when the destination host header of the non-cleared HTTP request does not match a hostname descriptor of the cleared sites list, transparent proxying between the user device and the non-cleared destination IP address of the non-cleared HTTP request only when the referrer header of the non-cleared HTTP request matches a referrer-enabled hostname descriptor of the cleared sites list;

wherein the cleared sites list further includes at least one referrer-enabled hostname descriptor having a configuration option enabling referrer based access.

11. The method of claim 9 , further comprising:

searching for matches of the referrer header of the non-cleared HTTP request to a hostname descriptor of the cleared sites list taking into account wildcards;

wherein at least one hostname descriptor on the cleared sites list includes one or more wildcards.

12. The method of claim 9 , further comprising:

removing destination IP addresses from the cleared IP addresses after an expiry duration associated with each destination IP address;

wherein the first expiry setting specifies a first expiry duration being longer than a second expiry duration specified by the second expiry setting.

13. The method of claim 9 , further comprising:

directly transferring connection requests associated with the cleared HTTP requests to an external network; and

accepting connection requests associated with the non-cleared HTTP requests in order to examine the non-cleared HTTP requests.

14. The method of claim 9 , further comprising, when transparent proxying between the user device and the non-cleared destination IP address when the referrer header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list, transparent proxying for only one HTTP request-response transaction between the user device and the non-cleared destination IP address.

15. The method of claim 9 , further comprising periodically performing a DNS lookup on exact hostname descriptors on the cleared sites list and adding one or more resulting DNS-resolved IP addresses to the cleared IP list; the exact hostname descriptors on the cleared sites list being hostname descriptors that do not include wildcards.

16. A walled garden system for providing access from user devices to one or more websites specified on a cleared sites list, the cleared sites list having one or more hostname descriptors, the walled garden system comprising:

a cleared internet protocol (IP) list including one or more cleared IP addresses corresponding to websites on the cleared sites list, wherein the cleared sites list contains a list of external websites accessible by a user and specified by either IP addresses or hostnames;

means for permitting direct transfer of only cleared hypertext transfer protocol (HTTP) requests from a user device, wherein each of the cleared HTTP requests is to a cleared destination IP address that matches one of the cleared IP addresses;

means for examining non-cleared HTTP requests from the user device, wherein each of the non-cleared HTTP requests is to a non-cleared destination IP address that does not match one of the cleared IP addresses;

means for transparent proxying between the user device and a non-cleared destination IP address of a non-cleared HTTP request when any of a destination host header and a referrer header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list;

means for blocking the non-cleared HTTP request when neither of the destination host header nor the referrer header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list;

means for adding, with a first expiry setting, the destination IP address of the non-cleared HTTP request to the cleared IP addresses when the destination host header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list; and

means for adding, with a second expiry setting, the destination IP address of the non-cleared HTTP request to the cleared IP addresses when only the referrer header of the non-cleared HTTP request matches a hostname descriptor of the cleared sites list.