Referrer-specific network management
Methods and systems for providing destination-specific network management are described. One example method includes receiving from a client within a network, a request to access a resource associated with a destination address outside the network, the received request including referrer information; determining that the destination address corresponds to an unclassified destination; determining whether the received request's referrer information corresponds to a referrer entity that is included in a set of approved referrers; and selectively blocking the network request to access the resource at the destination address based upon a result of the determining.
1. A computer-implemented method executed by one or more processors, the method comprising:
receiving from a client within a network, a request to access a resource associated with a destination address outside the network, the received request including referrer information;
determining that the destination address corresponds to an unclassified destination;
determining whether the received request's referrer information corresponds to a referrer entity that is included in a set of approved referrers; and
selectively blocking the network request to access the resource at the destination address based upon determining whether the received request's referrer information corresponds to a referrer entity that is included in a set of approved referrers.
2. The method of claim 1 , wherein the network request is a HyperText Transfer Protocol (HTTP) request and the referrer information is an HTTP referrer header.
3. The method of claim 1 , wherein the set of approved referrers includes referrer entities associated with approved categories.
4. The method of claim 3 , wherein the approved categories include a search engine category.
5. The method of claim 1 , further comprising:
determining that the referrer information represents a referrer entity that is included in a set of disapproved referrers; and
blocking the network request from proceeding to the unclassified destination upon determining that the referrer information represents a referrer entity that is included in a set of disapproved referrers.
6. The method of claim 1 , further comprising:
determining that the referrer information represents an unclassified referrer entity; and
blocking the network request from proceeding to the unclassified destination upon determining that the referrer information represents the unclassified referrer entity.
7. The method of claim 1 , further comprising:
determining that the referrer information does not represent a referrer entity; and
blocking the network request from proceeding to the unclassified destination upon determining that the referrer information does not represent a referrer entity.
8. The method of claim 1 , wherein the network request is generated by a web browser program upon activation of a link in a search results page, and the referrer information represents a search engine that provided the search results page.
9. The method of claim 1 , wherein the network request is generated by an email program upon activation of a link in an email message, and the referrer information does not represent a referrer entity.
10. The method of claim 1 , wherein the network request is generated by a web browser program upon entry of a destination address, and the referrer information does not represent a referrer entity.
11. A computer-implemented method executed by one of more processors, the method comprising:
receiving from a client within a network, a request to access a resource associated with a destination address outside the network, the received request including a field for referrer information;
determining that the field for referrer information is unpopulated;
determining whether the destination address corresponds to an unclassified destination or to a classified destination; and
blocking the network request based at least in part upon determining that the field for referrer information is unpopulated and determining that the destination address corresponds to an unclassified destination.
12. The method of claim 11 , further comprising selectively blocking the network request to access the resource at the destination address if the destination address is determined to correspond to a classified destination.
13. The method of claim 11 , further comprising:
determining whether or not the destination address is in a set of directly accessible addresses, the directly accessible addresses representing addresses that are permitted to be accessed without the field for referrer information being populated in the request; and
blocking the network request if the destination address is determined to not be in the set of directly accessible addresses.
14. The method of claim 13 , further comprising selectively permitting the network request if the destination address is determined to be in the set of directly accessible addresses.
15. The method of claim 11 , wherein the network request is a HyperText Transfer Protocol (HTTP) request and the referrer information is an HTTP referrer header.
16. The method of claim 11 , wherein the network request is generated by a web browser program upon activation of a link in a search results page, and the referrer information represents a search engine that provided the search results page.
17. The method of claim 11 , wherein the network request is generated by an email program upon activation of a link in an email message, and the referrer information does not represent a referrer entity.
18. The method of claim 11 , wherein the network request is generated by a web browser program upon entry of a destination address, and the referrer information does not represent a referrer entity.
19. A system comprising:
a processor configured to execute computer program instructions; and
a computer storage medium encoded with computer program instructions that, when executed by the processor, cause the system to perform operations comprising:
receiving from a client within a network, a request to access a resource associated with a destination address outside the network, the received request including referrer information;
determining that the destination address corresponds to an unclassified destination;
determining whether the received request's referrer information corresponds to a referrer entity that is included in a set of approved referrers; and
selectively blocking the network request to access the resource at the destination address based upon determining whether the received request's referrer information corresponds to the referrer entity that is included in the set of approved referrers.
20. The system of claim 19 , wherein the network request is a HyperText Transfer Protocol (HTTP) request and the referrer information is an HTTP referrer header.
21. The system of claim 19 , wherein the set of approved referrers includes referrer entities associated with approved categories.
22. The system of claim 21 , wherein the approved categories include a search engine category.
23. The system of claim 19 , the operations further comprising:
determining that the referrer information represents a referrer entity that is included in a set of disapproved referrers; and
blocking the network request from proceeding to the unclassified destination upon determining that the referrer information represents a referrer entity that is included in a set of disapproved referrers.
24. The system of claim 19 , the operations further comprising:
determining that the referrer information represents an unclassified referrer entity; and
blocking the network request from proceeding to the unclassified destination upon determining that the referrer information represents the unclassified referrer entity.
25. A system comprising:
a processor configured to execute computer program instructions; and
a computer storage medium encoded with computer program instructions that, when executed by the processor, cause the system to perform operations comprising:
receiving from a client within a network, a request to access a resource associated with a destination address outside the network, the received request including a field for referrer information;
determining that the field for referrer information is unpopulated;
determining whether the destination address corresponds to an unclassified destination or to a classified destination; and
blocking the network request based at least in part upon determining that the field for referrer information is unpopulated and determining that the destination address corresponds to an unclassified destination.
26. The system of claim 25 , the operations further comprising selectively blocking the network request to access the resource at the destination address if the destination address is determined to correspond to a classified destination.
27. The system of claim 25 , the operations further comprising:
determining whether or not the destination address is in a set of directly accessible addresses, the directly accessible addresses representing addresses that are permitted to be accessed without the field for referrer information being populated in the request; and
blocking the network request if the destination address is determined to not be in the set of directly accessible addresses.
28. The system of claim 27 , the operations further comprising selectively permitting the network request if the destination address is determined to be in the set of directly accessible addresses.
29. The system of claim 25 , wherein the network request is a HyperText Transfer Protocol (HTTP) request and the referrer information is an HTTP referrer header.
30. The system of claim 25 , wherein the network request is generated by a web browser program upon activation of a link in a search results page, and the referrer information represents a search engine that provided the search results page.