Content filtering and management

[0001] The invention pertains to on-line content filtering and more particularly to methods, apparatus and software for content filtering which uses a rating system in combination with a digital certificate to thwart abuse, instil public confidence and assist in the management of the system.

[0002] Content filtering is a measure to implement a public policy for the protection of on-line users, for example Internet users. The implementation of a filtering scheme therefore carries a number of security risks. The main risks are:

[0003] that an unauthorised or unintended recipient will intercept a transmission and read or use its contents

[0004] that a provider will attempt to avoid responsibility for their content by making available content under someone else's certificate

[0005] that a provider will abusively change the available content

[0006] that a provider will deny providing particular content,

[0007] In the traditional mail system, a signature, letterhead paper, and a sealed envelope addresses these concerns. To provide these services electronically, a technique called public key cryptography is used. These cryptographic techniques are used within a Public Key Infrastructure (PKI), a PKI is a system that provides the basis for establishing and maintaining a trustworthy networking environment through the generation and distribution of keys and certificates.

[0008] To encrypt is to apply a mathematical function that transforms every character in the file into some other character. Encryption renders a file unreadable.

[0009] Cryptography enhances security by encrypting a file, data, transmission or message using a secret key in association with an algorithm. This produces a scrambled version of the message that the recipient can decrypt, using the original key, to retrieve the contents. The key used must be kept secret between the two parties.

[0010] Public key cryptography replaces the secret key with a pair of keys, one private and one public. Information encrypted using the public key can only be retrieved using the complementary private key. In addition to encryption, the public and private keys can be used to create and verify an identity for example digital certificates. These can be appended to content to uniquely identify the provider and the nature of the content.

[0011] The present invention provides and facilitates a scheme in which content is filtered according to whether or not content pages include a proprietary digital certificate. The digital certificate required to pass the filtering is issued by a body which applies certain criteria to on-line resources and which assigns to each resource, site or page a classification or promotes a system of self-classification.

[0012] Filtering is preferably accomplished at the ISP level by applying the certificate to a public key. Each classification has a common public key. The digital certificates issued by the body include the body's key and additional layers of cryptographic protection based on features such as the classification, domain, URL expiry date or a random number.

[0013] The present invention requires that on-line content be filtered so that an acceptable percentage of undesirable content fails to reach on-line users.

[0014] It is preferred that content be classified according to socially acceptable norms. Thus, a body is convened, which establishes with respect to content individual domains, sites or URLs (resources) a classification. Classifications might include PG, G, M and R similar to the classifications utilised by the motion picture industry. Other classifications may be used as well.

[0015] With regard to Internet content filtering, public key cryptography, on its own, is not enough to implement an effective filtering regime in furtherance of public policy. Also needed are (a) security policies to define the rules under which the cryptographic systems should operate, (b) hardware and software products to generate, store and manage the keys, and (c) procedures to dictate how the keys and certificates should be generated, distributed and used.

[0016] A Public Key Infrastructure (PKI) provides the core framework for components, applications, policies and practices to address the main security risks.

[0017] A Public Key Infrastructure is a combination of hardware and software products, policies and procedures. PKI is based on digital IDs known as digital certificates which act like electronic passports.

[0018] A typical PKI should consist of:

[0019] A security policy for establishing top-level security, as well as the processes and principles for the use of cryptography. It is essentially the rules by which an administering organisation will handle keys and valuable information.

[0020] Certificate Practice Statement (CPS) This is a document defining the operational procedures on how the security policy will be enforced and supported in practice, how certificates are issued, accepted and revoked, and how keys will be generated, registered and certified, where they will be stored, and how they will be made available to users.

[0021] Certificate Authority (CA) The CA system is the trust basis of a PKI as it manages public key certificates for their whole life cycle. The CA issues certificates by binding the identity of a user or system to a public key with a digital signature. The CA establishes the schedule of expiry dates for certificates and ensures certificates are revoked when necessary by publishing Certificate Revocation Lists (CRLs). When implementing a PKI, an organisation can either operate its own CA system, or use the CA service of a Commercial CA or Trusted Third Party.

[0022] Registration Authority (RA) An RA provides an optional intermediary between the user and the CA. It captures and authenticates the identity of the users and submits the certificate request to the CA.

[0023] Certificate Distribution System

[0024] PKI-enabled Applications. A PKI is a means to an end, providing the security framework by which PKI-enabled applications can be confidently deployed to achieve the end benefits, in this case the implementation of public policy by moderating the content received by users, for example on-line web servers to browsers.

[0025] The present invention proposes a specially configured Digital Certificate that allows the verification (at the ISP, intermediate, browser level and end user level) of the proposition that a person or business has the right to use a given rating and therefore a given key. The certificate prevents impersonation, the use of phoney keys. As previously mentioned, digital Certificates are based on the use of public and private key pairs. A specially constituted Digital Certificate according to the present invention may contain, the content name, an expiration date, the name of the Certification Authority that issued the Digital Certificate, a serial number, a random number and perhaps some other information based on URL, domain, a classification promulgated by the CA or a description.

[0026] The proposed Digital Certificate may optionally be used in connection with other cryptography methods such as digital signatures, for example for maintaining user privacy. A digital signature is like a paper signature, except that it is fully electronic. An effective digital signature is more secure than a paper signature. A digital signature provides a guarantee to a recipient that the signed file came from the person who sent it, and that it was not altered since it was signed.

[0027] To create a digital signature, the information sender creates a hash, unique shortened version of the transmission or message, and then uses his private key to encrypt the hash. The encrypted hash is the digital signature. If the message is changed in any way, the hash result of the changed message would be different.

[0028] The digital signature is unique to both the message and the private key used to create it, so it cannot be forged. The digital signature is then appended to the message and both are sent to the message recipient.

[0029] The recipient reconstitutes the hash from the received message, then uses the public key of the original sender to decrypt the hash included in the received message.

[0030] If the two hash results are identical the digital signature was created using the signer's private key. This serves as assurance that the public key corresponds to the signer's private key. This also confirms that no one is pretending to be or masquerading as the signer. This also substantiates (a) the authenticity of the signer, (b) that the signer cannot claim to have not signed the message, and (c) that the message has not been changed.

[0031] In the United States, The Electronic Signatures in Global and National Commerce Act, S 761, commonly known as the e-Sign Bill, is expected to make digitally-signed electronic transactions legally binding, the same way paper documents with handwritten signatures are binding today. The US Senate passed the bill unanimously by a vote of 87-0. This trend is seen as a global one.

[0032] Security Policy

[0033] The basic tenant by which the public policy mandate is executed is that users shall be denied access to content that is not certified (reverse filtering) by the CA (reverse filtering) or that is certified by the CA but does not match specific criteria (criteria filtering). Implementation of the filtering off of uncertified resources preferably occurs at the ASP or ISP level but may be implemented at another level (e.g. the browser) or by a combination. The essence of reverse filtering is to provide a viable means of content filtering and regulation of Internet content by not imposing significant processing overhead.

[0034] The certificate is generated as follows:

[0035] 1. The inputs may include: applicant's domain name, logical address, country of origin, URL, encryption key, public key of CA, classification, official descriptor, other data.

[0036] 2. The inputs are manipulated through an algorithm to produce an identification number.

[0037] 3. The CA identifier (assigned by the root CA) and the CA's URL is appended to the identification number to form a globally unique certificate.

[0038] 4. The certificate is associated with a compliance seal. The compliance seal may be available (visual, mechanical, audible) on the browser or on the resource. Associated with the availability of the compliance seal is a link to the issuing CA (for example this link will take the user to the home page of the CA from which complaints may be lodged, the CPS may be available, etc).

[0039] In addition to generally accepted security guidelines (e.g. Guidelines issued by Defence Signals Directorate, Australia), special security arrangements should be made to secure public/private key pair for CA, resources (hardware and software) involved in the production and delivery of the compliance certificate. Strong encryption would be implied in delivering the compliance certificate from the CA to the provider. Physical and logical security of the filtering software at the ISP sites is imperative.

[0040] Certificate Practice Statement

[0041] This document (CPS) will be publicly available.

[0042] The CPS document will consist of, but is not limited to, procedures for the following:

[0043] I. PKI Infrastructure.

[0044] II. Organisational relationships.

[0045] III. Public policy and legislative matters.

[0046] IV. RA and CA standard operating internal controls and procedures.

[0047] V. Definition of classification and related criteria.

[0048] VI. Security classifications.

[0049] VII. Codes of conduct.

[0050] VIII. Fees and charges.

[0051] IX. List of acceptable bona-fides for all stakeholders.

[0052] X. Application for certificate.

[0053] XI. Self-assessment.

[0054] XII. Auditing prior to application.

[0055] XIII. Ongoing auditing.

[0056] XIV. Terms and conditions.

[0057] XV. Generation and security of digital certificate.

[0058] XVI. Generation and security of compliance seal.

[0059] XVII. Rules of use.

[0060] XVIII. Delivery of digital certificate and seal.

[0061] XIX. Revocation of digital certificate and seal.

[0062] XX. Distribution and usage of revocation and attribute tables.

[0063] XXI. Frequently asked questions.

[0064] XXII. User help.

[0065] XXIII. Complaints mechanisms.

[0066] XXIV. Metrics and statistical analysis.

[0067] XXV. Distribution, installation, operation and security of applications, filtering software and hardware.

[0068] XXVI. General information.

[0069] XXVII. Enforcement mechanisms and penalties.

[0070] XXVIII. Any other applicable information.

[0071] Certificate Authority

[0072] Importantly, the CA establishes the schedule of expiry dates for certificates and ensures certificates are revoked when necessary by publishing Certificate Revocation Lists (CRLs). In some preferred embodiments of the invention certificates issued by the CA, the RA or its subordinates expire frequently so as to thwart abuse and instil public confidence. It is preferred to automatically update both the key and certificate before key expiry. Automatic key update provides strong security since it ensures that keys are only used for a specific time period. Automatic renewal of certificates may depend upon, for example, the classification, content providers track record, complaints against the provider, audit results, etc. In the scheme of the present invention, the CURL is published to the participating ISPs that use it for filtering. A CURL may be unnecessary if the lifetime of the certificate is short.

[0073] The CA maintains a management policy and determines whether the CA key is stored on specialised hardware, the particular algorithm used to encrypt the CA signing key, and how often the CA updates its list of users whose certificates have been revoked.

[0074] The CA may also administer the process of adding subordinate CAs to a hierarchy of CAs if multiple CAs are needed and where one root CA must control all other CAs.

[0075] Registration Authority

[0076] An RA intermediary can relieve the administrative burden on the CA and provide a politically neutral, commercial level of customer service and technical proficiency.

[0077] Certificate Distribution System

[0078] Certificates are distributed upon application by an interested party. The application is reviewed according to the CPS. The applicant may be assigned one or more ratings according to the categories established by the CA. If the automated or manual evaluation of the applicant's bona fides and proposed content is acceptable, they are issued with a certificate for each resource e.g. URL covered by their application to the CA. The issued certificate carries the private key and each category is associated with its own public key which is provided to participating ISPs. The issued certificate may also include additional security layers associated with the category, official description, URL, domain or a random number. It is preferred that certificates be renewed automatically and frequently and that the CA have the authority to deny the renewal if the terms of the CPS are violated.

[0079] The certificate can be delivered using the following mechanisms:

[0080] 1/. Secure e-mail.

[0081] 2/. Download from a secure website after obtaining an encryption key from the CA.

[0082] 3/. Physical delivery.

[0083] 4/. Vending machine.

[0084] 5/. Other methods.

[0085] The certificate is appended to all resources of a given classification at a given site. This therefore implies that if resources of varying classifications apply at one site, that site may obtain more than one certificate to permit access. There are a number of options for appending the certificate either at the page level or the individual resource level:

[0086] 1/. Using an automated script supplied by the CA.

[0087] 2/. Following a manual process of embedding the certificate in the code.

[0088] 3/. Using software tools.

[0089] 4/. Other methods.

[0090] PKI-Enabled Applications

[0091] For the PKI to function, the participating ISPs must be provided with software which supports the CPS. The CPS is supported by filtering content from the on-line transmission to the user which lacks a valid certificate. A transmission which lacks a certificate or is accompanied by a fake or expired certificate is excluded from the traffic from the ISP to the user. For this to occur the ISP may have to cache a complete resource including its certificate before transmission to a user occurs.

[0092] In some embodiments, the validity of the certificate is denied if the certificate is determined to not cover a particular classification. For example a browser, browser plug in, or other client application provided to users may allow a user to request that only certain categories be transmitted to them and the ISP's software compares the user's request to the incoming certificate as part of a filtering process. Alternately the ISP can implement CPS policy or directives, for example by filtering all content which is both of a particular rating rated and is from selected domains from being transmitted to other selected domains in a particular country at certain times.

[0093] In other embodiments the ISP can filter according to the published CURL where the renewal interval of the issued certificates is long enough to warrant additional measures to prevent reported or detected abuse of the CPS.

[0094] It may also be advantageous to provide a mechanism for informing users that the content they display or otherwise use is in compliance. This may be done by including a compliance seal or evidence of it in the content display, for example, as an image which is displayed in a browser display area. In the alternative, a certain area of the browser control panel or area is set aside for a representation of the compliance certificate. It is preferably the graphical image which functions as a hyperlink. In the alternative an auditory or mechanical indication may be used in place of a graphical image or button. The representation of the compliance certificate is an indicator and will vary depending on the classification and or the official descriptor or other criteria. Therefore the appearance of the graphical image may change as the URL changes as may the hyperlink which the image represents if the CA changes from one URL to another.

[0095] The Compliance Seal is distributed under licence and the use is tied to continuing compliance.

[0096] In certain cases, the compliance certificate may be invalidated if the site is modified without application for assessment to the CA. This may be accomplished by embedding a digital signature in the digital compliance certificate. In the alternative, a digital certificate may separately accompany a resource to allow verification that the contents have not changed without the CA's authority.

[0097] In other embodiments and through a mechanism either at the ISP, or intermediatory device (e.g. corporate network filtering), or the end user device (e.g. Browser), the authenticated content may be further filtered based on the classification and other information embedded in the certificate. That is, instead of using existing filtering techniques whereby all content is filtered for keywords, or other attributes, filtering of content is conducted exclusively on a the basis of the rating, and/or other certificate information. This end user filtering may be added to firewall or router software or the browser, or be a separate application that sits in front of the browser.

[0098] For example, the browser may be configured to only allow G rated material through. If a search is done on sex all authorised sites with a G to R rating may be passed from the ISP to the end user. However, the end user filter will block all content that is not G rated.

[0099] Hence there are essentially two exclusion filtering products: An ISP, ASP, (or similar) Digital Certificate exclusion filter (DEF) and an end user classification exclusion filter (U-CEF). The two may be combined.

[0100] In the case of the U-CEF, this filter may also incorporate filter tables applicable to each classification. These filter tables may be used to auto-audit for known key attributes of un-classified content. The attributes may be compiled from a database of common complaints and as such provide some level of ongoing assurance that a certain classification is valid. In the event that a breach is detected, the CA may be notified via an e-mail or other mechanism to investigate the content.

[0101] Furthermore, the U-CEF as a stand-alone application, or as a function of a browser, may be configured to issue a cookie, or file with a search or delivery request from an end-user. In this instance the classification filtering may occur at the ISP, or indeed at the host site. For example, the host site may be provided with an application that establishes permissions on content and only allows access to content based on the classification permissions from the user request.

[0102] A provider of online content seeking a certificate applies to either the CA or RA for a certificate. This may be at the time of Domain name registration, renewal, or upon separate and perhaps unrelated electronic or in-person application. In applying for the certificate, the applicant must understand the classification of service being requested. The application includes the details required to identify the applicant and also includes a self-assessment. An element of the processing includes establishing the bona-fides of the applicant. A statement must be provided by the applicant which demonstrates compliance with the criteria associated with a classification.

[0103] In relation to the applicant statement and ongoing compliance (feedback through complaints mechanism or auditing), it is envisaged that there would be penalties and legal remedies for a breach of the code or misuse of a compliance seal. These may include:

[0104] 1/. Legislative penalty.

[0105] 2/. Banning the site by inclusion on a blacklist until the certificate expired.

[0106] 3/. Ongoing, frequent audits at the provider's expense.

[0107] 4/. Infringement of Trade-Mark.

[0108] 5/. Infringement of Copyright.

[0109] 6/. Patent infringement.

[0110] 7/. Non-renewal of certificate.

[0111] 8/. Other methods.

[0112] Self Assessment:

[0113] The application is processed and at that time the application is either audited or not and a certificate is generated. A random criteria or specific matching with nominated attributes may be adopted for determining if an audit is required before issuing of the certificate. However, a team of auditors or an automated auditing tool will be auditing sites on an ongoing basis by specific or random selection.

[0114] Audit:

[0115] Based on a classification or category within a classification, auditing of the application may be mandatory. For example, an on-line gambling site may be required to provide evidence of a licence and the site and content approved as complying with a set of government criteria. In the extreme alternative, all content of every web page or every file available at an ftp site, may be required to have its contents audited.

[0116] Definition of Modification Induced Expiry:

[0117] At the time of auditing an application is installed at the site which identifies certain files or data, takes an input or seed, runs the seed through a secure algorithm associated with that data and produces a signature of that data. Provided the seed and the data remain constant, the signature will remain constant. The data check may be initiated at the hosting site or remotely from the CA or RA. The certificate may or may not be dynamic in nature whereby a modification to the site signature may result in a modification to the digital certificate and thereby render the certificate invalid or expired. In such instances the provider will be required to apply to the CA whenever content nominated by the auditor is intended to be modified. The CPS will define exceptions in the event of emergency patches or the like. An example of a site where this might be applied is that of an online gambling site.