Abstract:
Embodiments disclosed herein provide feature-level access control functionality useful for enforcing access controls to features and subfeatures on uncontrolled, third party Web Applications such as those associated with social networking sites. Specifically, pages of uncontrolled Web applications are programmatically inspected as they are accessed by users of an enterprise computing environment. Specific features on the pages are located and access to these features is enabled or disabled on a per user basis. A modified page is generated if feature(s) on a Web page is/are to be disabled. To block certain feature(s), content may be rewritten on-the-fly. Because embodiments disclosed herein can programmatically inspect a Web page and understand what is on the page at a much finer granularity, it is possible for enterprises to gain benefits that may come from embracing social networking sites without risking the downsides of allowing enterprise users access to uncontrolled Web applications.

Description:
CROSS-REFERENCE TO RELATED APPLICATION(S) 
     This is a continuation of, and claims a benefit of priority from U.S. patent application Ser. No. 12/785,278, filed May 21, 2010, entitled “METHOD, SYSTEM AND COMPUTER PROGRAM PRODUCT FOR ENFORCING ACCESS CONTROLS TO FEATURES AND SUBFEATURES ON UNCONTROLLED WEB APPLICATION,” which is a conversion of, and claims priority from U.S. Provisional Application No. 61/303,191, filed Feb. 10, 2010, entitled “METHOD, SYSTEM AND COMPUTER PROGRAM PRODUCT FOR ENFORCING ACCESS CONTROLS TO FEATURES AND SUBFEATURES ON UNCONTROLLED WEB APPLICATION.” This application relates to U.S. patent application Ser. No. 12/562,032, filed Sep. 17, 2009, entitled “METHOD, SYSTEM, AND STORAGE MEDIUM FOR ADAPTIVE MONITORING AND FILTERING TRAFFIC TO AND FROM SOCIAL NETWORKING SITES,” which claims priority from U.S. Provisional Application No. 61/097,698, filed Sep. 17, 2008. All applications listed in this paragraph are incorporated by reference herein as if set forth in full. 
    
    
     COPYRIGHT STATEMENT 
     A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever. 
     TECHNICAL FIELD 
     This disclosure relates generally to Web applications, and more particularly, to a system, method, and computer program product comprising instructions translatable for enforcing access controls to features and subfeatures on uncontrolled Web applications. 
     BACKGROUND 
     Advances in communications technology often change how people communicate and share information. More recently, social networking sites are providing new ways for users to interact and keep others abreast of their personal and business dealings. The growth of social networking sites is staggering. New sites are emerging daily and new users are joining in droves. Today, social networking sites are being used regularly by millions of people around the globe, and it seems that social networking via websites will continue to be a part of everyday life at least in the United States. 
     The main types of social networking services provided by social networking sites are those which contain directories or categories, a means to connect with friends, and a means to recommend other individuals. For example, a social networking site may allow a user to identify an individual as a friend, a former classmate, or an uncle. The social networking site may recommend to the user another individual as a potential friend and also provide a personalized web page for the user to interact with those that the user has identified as “friends” via the social networking site. 
     Some social networking sites provide functions in the form of Web applications for members to create user profiles, send messages to other members who are their “friends,” and personalize Web pages available to friends and/or the general public. Through these Web applications, social networking sites can connect people at low cost and very high efficiency. Some entrepreneurs and businesses looking to expand their contact base have recognized these benefits and are utilizing some social networking sites as a customer relationship management tool for selling their products and services. 
     For businesses and entities alike looking to embrace social networking sites as an additional method to exchange information between employees, clients, vendors, etc., the integration of social networking sites into their internal computing environments necessarily raises several critical concerns. What activities will people be allowed to be engaged in? What information may be disclosed and to what extent? Who is the information being disclosed to? Is malicious or otherwise damaging material being accessed or allowed onto the business&#39;s computers? How can a business manage the activities of particular users or groups? 
     Currently, there are no viable solutions to these difficult questions as businesses do not have control over Web applications provided by independent entities, including social networking sites own and operated by such independent entities. Some businesses have the means to block traffic to and from social networking sites. Some businesses can only hope that their employees are only using these social networking sites in the best interest of the company. There is no guarantee that the employees may police their own access to and participation at social networking sites and there is always the concern of an employee knowingly or unknowingly posting confidential information on a social networking site. Because of these risks, many businesses simply choose to deny their employees access to uncontrolled Web applications and forgo the efficiencies and cooperative gains that may come from embracing social networking sites. 
     SUMMARY 
     Traditionally, to the extent that a business or entity allows users within its computing environment access to the Internet, it has no ways of controlling which users can use what features on a Web application that is not provided by the business or entity. This type of Web applications is referred to herein as uncontrolled Web applications as they are not controlled by the business or entity that operates the computing environment from where user requests for access are generated. 
     Uncontrolled Web applications may come in various forms. One example of an uncontrolled Web Application may be an application running on a social networking site such as Facebook. As a specific example, suppose a Wall Post application running on Facebook may allow a Facebook user to post a text message or friends of the user to post text messages for the user. Further suppose that this Facebook user is also an employee of a business or entity called Entity. To prevent this employee from posting and receiving text messages using the Wall application of Facebook while the employee is in Entity&#39;s computing environment, Entity may block network traffic to and from Facebook for the entire computing environment or Entity may block that particular user&#39;s access to Facebook. In either scenario—site-level access control based on source or site-level access control based on user, the employee would have no access to the entire social networking site, even if only a certain feature of the Wall Post application was of interest to Entity. 
     Within this disclosure, features/subfeatures refer to components/subcomponents of an uncontrolled application. Embodiments disclosed herein provide a system, method, and computer program programming comprising one or more readable storage media storing computer instructions for enforcing access controls to features, including subfeatures, on uncontrolled Web Applications associated with social networking sites. In some embodiments, the feature-level access control functionality disclosed herein can be implemented as a middleware within or outside an enterprise computing environment. Following the above example, some embodiments disclosed herein may operate to programmatically inspect a Web page associated with a social networking site that operates beyond Entity&#39;s control and remove certain features and/or subfeatures while preserving the rest of the page. More specifically, the feature-level access control functionality disclosed herein would allow Entity to restrict posting text messages on the employee&#39;s Facebook Wall while preserving other features of the Wall Post Application such as posting a photo or a link to the employee&#39;s Facebook Wall. 
     In some embodiments, pages of uncontrolled Web applications are identified as they are accessed by users of an enterprise computing environment. In some embodiments, specific features, including subfeatures, on these pages are located and access to these features is enabled or disabled according to settings predetermined on a per user basis. In some embodiments, an interface is provided to allow an administrator of the enterprise computing environment to manage access control to these features on a per user basis according to corporate policies and/or business rules. In some embodiments, if at least one feature on a page is to be disabled before the page is to be presented to an end user (e.g., a business user within an enterprise computing environment), a modified page is generated. This modified page would be substantially similar to the original page except that the particular feature of interest has been disabled. In some embodiments, to block a feature or features, specific content may be rewritten on-the-fly. The modified page is sent to the end user in response to the end user&#39;s request for the original page. The whole process can be transparent to the end user. 
     Because embodiments disclosed herein have the ability to inspect a Web page and understand what is on the page at a much finer granularity—even though the page is from an uncontrolled Web application, it is not necessary to block the entire site and it is not necessary to block the network address where the page resides. Embodiments disclosed herein may provide an enterprise with a sophisticated way to control access by its employees to social networking sites outside the enterprise&#39;s computing environment. For example, an enterprise may wish to disable a chat function offered by an uncontrolled Web application while permitting the rest of the features of the uncontrolled Web application to perform normally. In this way, it is possible for enterprises to gain benefits that may come from embracing social networking sites without risking the downsides of allowing enterprise users access to uncontrolled Web applications. 
     These, and other, aspects of the disclosure will be better appreciated and understood when considered in conjunction with the following description and the accompanying drawings. It should be understood, however, that the following description, while indicating various embodiments of the disclosure and numerous specific details thereof, is given by way of illustration and not of limitation. Many substitutions, modifications, additions and/or rearrangements may be made within the scope of the disclosure without departing from the spirit thereof, and the disclosure includes all such substitutions, modifications, additions and/or rearrangements. 
    
    
     
       DESCRIPTION OF THE DRAWINGS 
       The drawings accompanying and forming part of this specification are included to depict certain aspects of the disclosure. It should be noted that the features illustrated in the drawings are not necessarily drawn to scale. A more complete understanding of the disclosure and the advantages thereof may be acquired by referring to the following description, taken in conjunction with the accompanying drawings in which like reference numbers indicate like features and wherein: 
         FIG. 1  depicts a simplified diagrammatic representation of a prior art architecture for network access control to social networking sites; 
         FIG. 2  depicts a diagrammatic representation of an exemplary computer system comprising at least one computer readable storage medium storing computer instructions implementing an embodiment disclosed herein; 
         FIG. 3  depicts a diagrammatic representation of a high level network architecture for network access control to social networking sites, implementing an embodiment disclosed herein; 
         FIG. 4  depicts a flow diagram illustrating how a proxy server may function as a gateway or intermediary between an end user and a social networking site; 
         FIG. 5  depicts a flow diagram illustrating an example of a method of processing application data from an uncontrolled Web application according to one embodiment disclosed herein; 
         FIG. 6A  depicts a simplified diagrammatic representation of a user&#39;s home page at a fictional social networking site; 
         FIG. 6B  depicts a portion of source code corresponding to the user&#39;s home page shown in  FIG. 6A ; 
         FIG. 6C  depicts a simplified diagrammatic representation of the user&#39;s home page modified to disable a particular feature of the social networking site; 
         FIG. 7  depicts a diagrammatic representation of one embodiment of a system for network access control to social networking sites; 
         FIG. 8  depicts a diagrammatic representation of a system architecture for network access control to social networking sites, implementing an embodiment disclosed herein; and 
         FIG. 9  is a screenshot of one example of a user interface through which an authorized user can perform various functions including specifying a role and social networking activities/actions allowed for this role. 
     
    
    
     DETAILED DESCRIPTION 
     The disclosure and various features and advantageous details thereof are explained more fully with reference to the exemplary, and therefore non-limiting, embodiments illustrated in the accompanying drawings and detailed in the following description. Descriptions of known programming techniques, computer software, hardware, operating platforms and protocols may be omitted so as not to unnecessarily obscure the disclosure in detail. It should be understood, however, that the detailed description and the specific examples, while indicating the preferred embodiments, are given by way of illustration only and not by way of limitation. Various substitutions, modifications, additions and/or rearrangements within the spirit and/or scope of the underlying inventive concept will become apparent to those skilled in the art from this disclosure. 
     Software implementing embodiments disclosed herein may be implemented in suitable computer-executable instructions that may reside on one or more computer-readable storage media. Within this disclosure, the term “computer-readable storage media” encompasses all types of data storage media that can be read by a processor. Examples of computer-readable storage media can include random access memories, read-only memories, hard drives, data cartridges, magnetic tapes, floppy diskettes, flash memory drives, optical data storage devices, compact-disc read-only memories, and other appropriate computer memories and data storage devices. 
     As used herein, the terms “comprises,” “comprising,” “includes,” “including,” “has,” “having,” or any other variation thereof, are intended to cover a non-exclusive inclusion. For example, a process, product, article, or apparatus that comprises a list of elements is not necessarily limited only those elements but may include other elements not expressly listed or inherent to such process, product, article, or apparatus. Further, unless expressly stated to the contrary, “or” refers to an inclusive or and not to an exclusive or. For example, a condition A or B is satisfied by any one of the following: A is true (or present) and B is false (or not present), A is false (or not present) and B is true (or present), and both A and B are true (or present). 
     Additionally, any examples or illustrations given herein are not to be regarded in any way as restrictions on, limits to, or express definitions of, any term or terms with which they are utilized. Instead these examples or illustrations are to be regarded as being described with respect to one particular embodiment and as illustrative only. Those of ordinary skill in the art will appreciate that any term or terms with which these examples or illustrations are utilized encompass other embodiments as well as implementations and adaptations thereof which may or may not be given therewith or elsewhere in the specification and all such embodiments are intended to be included within the scope of that term or terms. Language designating such non-limiting examples and illustrations includes, but is not limited to: “for example,” “for instance,” “e.g.,” “in one embodiment,” and the like. 
     Those skilled in the arts will recognize that the disclosed embodiments have relevance to a wide variety of areas in addition to the specific examples described below. For example, although the examples below are described in the context of employers and employees, some embodiments disclosed herein can be adapted or otherwise implemented to work in other types of relationships, circumstances, and places such as public libraries, parent-child, school-student, or any other place or relationship where it is desirable to monitor and protect network traffic to and from social networking sites. 
       FIG. 1  depicts a simplified diagrammatic example of how traditionally an entity or organization may monitor and protect network traffic to and from social networking sites. In this example, Company A may own and operate company network  140 . Examples of company network  140  may include a local area network (LAN), an intranet—a private computer network within the organization, etc. User  130  of company network  140  may access Internet  110  via proxy  150 . Social networking sites  120  may be generally accessible by users connected to Internet  110 . As an example, social networks  120  may include, but are not limited to, Facebook®, Linkedln®, Twitter®, MySpace®, Friendster®, Multiply®, Orkut®, Cyworld®, Hi5®, and others. All trademarks, service marks, and logos used herein are properties of their respective companies. 
     In some cases, proxy  150  of company network  140  may monitor and block all network traffic to and from one or more social networking sites  120  by way of a firewall implemented on proxy  150 . As known to those skilled in the art, a firewall may be implemented as a part of a computer system or network that is designed to block unauthorized access while permitting authorized communications. A firewall may be implemented as a device or a set of devices configured to permit, deny, encrypt, decrypt, or proxy all incoming and outing network traffic between different domains based upon a set of rules and other criteria. Firewalls may be implemented in hardware, software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. Generally, all messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria. 
     Proxy  150  represents a server computer that acts as an intermediary for requests from user  130  seeking resources from other servers, including those that reside outside of network  140 . Those skilled in the art can appreciate that user  130  is a representation of a typical user in company network  140  and may include software and hardware utilized by the user to access company network  140  and Internet  110 . 
       FIG. 2  depicts an exemplary system within a computing environment where embodiments disclosed herein may be implemented. Components  202  of computing system  200  may include, but are not limited to, processing unit  204 , system memory  206 , and system bus  208 . System bus  208  may couple various system components including system memory  206  to processing unit  204 . System bus  208  may comprise any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. 
     Computing system  200  may include a variety of computer readable storage media. Computer readable storage media can be any available storage media that can be accessed by computing system  200 . By way of example, and not of limitation, computer readable storage media may comprise volatile and nonvolatile storage media and removable and non-removable storage media. Computer readable storage media storing computer instructions implementing embodiments disclosed herein may be manufactured by known methods and materials and may rely on known programming languages and techniques for storage of information thereon. Examples of computer readable storage media may include, but are not limited to, random access memory (RAM), read only memory (ROM), EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by computing system  200 . 
     In the example shown in  FIG. 2 , system memory  206  includes ROM  210  and RAM  212 . ROM  210  may store basic input/output system  214  (BIOS), containing the basic routines that help to transfer information between elements within computing system  200 , such as those used during start-up. RAM  212  may store data and/or program modules that are immediately accessible to and/or presently being operated on by processing unit  204 . By way of example, and not of limitation,  FIG. 2  shows RAM  212  storing operating system  216 , application programs  218 , other program modules  220 , and program data  222 . 
     Computing system  200  may also include other removable/non-removable, volatile/nonvolatile computer readable storage media that can be employed to store computer instructions implementing some embodiments disclosed herein. By way of example only, computing system  200  may include hard disk drive  224 , a magnetic disk drive  226 , and/or optical disk drive  230 . Hard drive (HD)  224  may read from and write to non-removable, nonvolatile magnetic media. Disk drive  226  may read from and write to removable, nonvolatile magnetic disk  228 . Optical disk drive  230  may read from and write to a removable, nonvolatile optical disk  232  such as a CD ROM or other optical medium. Other removable/non-removable, volatile/nonvolatile computer readable storage media are also possible. As illustrated in  FIG. 2 , hard drive  224  may be connected to system bus  208  via a non-removable memory interface, such as interface  234 , and magnetic disk drive  226  and optical disk drive  230  may be connected to system bus  208  via a removable memory interface, such as interface  238 . 
     The drives and their associated computer readable storage media, discussed above, may provide storage of computer readable instructions, data structures, program modules and other data for computing system  200 . For example, hard disk drive  224  may store operating system  268 , application programs  270 , other program modules  272  and program data  274 . Note that these components can either be the same as or different from operating system  216 , application programs  218 , other program modules  220 , and program data  222 . 
     A user may enter commands and information into computing system  200  via input devices such as tablet or electronic digitizer  240 , microphone  242 , keyboard  244 , and pointing device  246 . Pointing device  246  may comprise a mouse, a trackball, and/or a touch pad. These and other input devices may be connected to processing unit  204  via user input interface  248 . User input interface  248  may be coupled to system bus  208  or via other interface and bus structures, such as a parallel port, a game port, or a universal serial bus (USB). 
     Monitor or other type of display device  250  may be connected to system bus  208  via an interface, such as a video interface  252 . Monitor  250  may also be integrated with a touch-screen panel or the like. Note that the monitor and/or touch screen panel can be physically coupled to a housing in which computing system  200  is incorporated, such as in a tablet-type personal computer. Computing system  200  may comprise additional peripheral output devices such as speakers  256  and printer  254 , which may be connected via an output peripheral interface  258  or the like. 
     Computing system  200  may operate in a networked environment and may have logical connections to one or more remote computers, such as remote computing system  260 . Remote computing system  260  may be a personal computer, a server, a router, a network PC, a peer device or other common network node. Although only a memory storage device  262  is shown in  FIG. 2 , remote computing system  260  may include many or all of the components and features described above with reference to computing system  200 . 
     Logical connections between computing system  200  and remote computing system  260  may include local area network (LAN)  264 , connecting through network interface  276 , and wide area network (WAN)  266 , connecting via modem  278 . Additional networks may also be included. 
     Embodiments disclosed herein can be implemented to run on various platforms operating under system software such as IBM OS/2®, Linux®, UNIX®, Microsoft Windows®, Apple Mac OSX® and others in development or commercially available. The functionality disclosed herein may be embodied directly in hardware, in a software module executed by a processor or in any combination of the two. Furthermore, software operations may be executed, in part or wholly, by one or more servers or a client&#39;s system, via hardware, software module or any combination of the two. A software module (program or executable) may reside on one or more computer readable storage media described above. In  FIG. 2 , an exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may also reside in an application specific integrated circuit (ASIC). The bus may be an optical or conventional bus operating pursuant to various protocols that are known to those skilled in the art. 
     In an illustrative embodiment, computer instructions implementing some embodiments disclosed herein may comprise lines of compiled C ++ , Java, or other language code. Other architectures may be used. In the hardware configuration above, various software components may reside on any single computer or on any combination of separate computers. In some embodiments, some or all of the software components may reside on the same computer. In some embodiments, the functions of any of the systems and methods may be performed by a single computer. In some embodiments, different computers than are shown in  FIG. 2  may perform those functions. Additionally, a computer program or its software components with such code may be embodied in more than one computer readable medium in more than one computer. 
       FIG. 3  depicts a diagrammatic representation of how an entity or organization implementing an embodiment disclosed herein may monitor and protect network traffic to and from social networking sites. In this example, Company B may own and operate social networking site  320  independent of Company A which owns and operates enterprise computing environment  340 , also referred to herein as company network  340 , internal network  340  or simply network  340 . Company A may represent an entity. Examples of such an entity may include, but are not limited to, an enterprise, a business, a company, a school, a hospital, a library, a government agency, an office, a home, and so on. End user  330  may represent any individual in a public or private office, government, home, or school setting and may include software and hardware necessary for accessing network  340  and Internet  110 . End user  330  may utilize a computing device to bi-directionally connect to Internet  110  where social networking site  320  resides. Communications media that may facilitate such bi-directional connections may include an intranet, a virtual private network (“VPN”), and/or a wireless network, etc. 
     Company B may comprise hardware, software, infrastructure, and people necessary to operate and maintain social networking site  320 . Social networking site  320  may be implemented in a manner known to those skilled in the art. As a specific example, a user may log in to social networking site  320  via a browser application or via a mobile application running on the user&#39;s wired or wireless computing device. Examples of a wireless computing device may include, but are not limited to, a laptop computer, a personal digital assistant (PDA), a mobile phone, an Internet enabled mobile device, and so on. 
     In the example of  FIG. 3 , proxy  350  resides within network  340  and is bi-directionally coupled to end user  330  via a wired or wireless internal network connection. Proxy  350  may be communicatively coupled to social network  320  over Internet  110 . In some embodiments, proxy  350  may function as a gateway or intermediary between end user  330  and social networking site  320 . More specifically, proxy  350  may be responsible for receiving all incoming requests from and sending corresponding responses to end user  330 . As illustrated in  FIG. 4 , in some embodiments of flow  400 , proxy  350  may operate to receive a user request from user  330  (step  402 ), determine whether that request contains a destination pertaining to a social networking site (step  404 ), and either pass the request from user  330  that is destined to a social networking site to Socialware  310  for processing (step  408 ) or pass the request to the destination (step  406 ) if it is not destined to a social networking site. 
     As will be described further below, in some embodiments, Socialware  310  may operate to process a request from user  330  for a page from social networking site  320 , obtain the requested page (the original application data) from social networking site  320 , determine if any modification to the original application data would be necessary per Company A′s policy as applied to user  330 , prepare corresponding page  360  that includes any necessary feature-level modifications  301  to the original application data provided by social networking site  320 , and return modified page  360  to proxy  350  or user  330  as a response to the request from user  330 . In some embodiments, other than certain feature(s) being disabled or unavailable to user  330 , page  360  may be substantially the same as the original page requested from social networking site  320 . 
     Within this disclosure, features/subfeatures of an uncontrolled application refer to components/subcomponents of the uncontrolled application. In some embodiments, a feature or subfeature of an uncontrolled application may be a function that allows a user to take a certain action via the uncontrolled application. Embodiments disclosed herein provide an ability to block or restrict that action. Non-limiting examples of features may include status update, wall post, messaging, chat, photo upload, commenting, and so on. Non-limiting examples of subfeatures may include functions involved when using a feature. For example, a “like” button associated with the status update feature may be considered as a subfeature. Moreover, certain features/subfeatures may be common to two or more social networking sites. Status update may be one example feature that is common to many social networking sites. 
     In some embodiments, Socialware  310  may reside within network  340 . In some embodiments, Socialware  310  may operate outside of network  340 . In some embodiments, Socialware  310  may be implemented as a service to proxy  350  or network  340 . In some embodiments, Socialware  310  may be implemented as part of proxy  350 . Some embodiments may be implemented without proxy  350 . For example, when user  330  sends, via a browser application running on a computing device of user  330 , a request for a page from social networking site  320 , the domain name server (DNS) may redirect the user request to Socialware  310 . Socialware  310  may process the user request, obtain the requested application data from social networking site  320 , structure the unstructured application data, prepare modified page  360  if necessary according to a set of predetermined access control rules, and return an appropriate response to user  330 . 
     Referring to  FIG. 5 , flow  500  represents an example of how Socialware  310  may facilitate in enforcement of access control to features, including subfeatures, provided by uncontrolled Web applications. At step  501 , in some embodiments, unstructured application data originating from an uncontrolled Web application may be received at a computer implementing Socialware  310 . In some embodiments, the unstructured application data originating from the uncontrolled Web application may be provided to Socialware  310  by social networking site  320 . In some embodiments, the unstructured application data originating from the uncontrolled Web application may be forwarded to Socialware  310  through proxy  350 . 
     Social networking sites may run on different platforms and utilize different programming languages, including AJAX, HTML, JSON, XML. Extensible markup language (XML), asynchronous JavaScript and XML (AJAX), Hypertext Markup Language (HTML), and JavaScript Object Notation (JSON) are known to those skilled in the art and thus are not further described herein. Thus, responses from social networking sites may contain application data in various formats/languages. One example of such application data originating from an uncontrolled Web application may be that of a user&#39;s home page at a social networking site. 
     Specifically, a user may direct a browser application running on the user&#39;s computing device to the social networking site, by putting the social networking site&#39;s Universal Resource Locator (URL) address in the address bar of the browser application or pointing to a link to the social networking site. The social networking site may present a login screen to the user, asking the user to provide the user identification (ID) and password. After the user enters the required login information, the browser application may send a request containing the user ID and password to the social networking site. In response, the social networking site may return the user&#39;s home page in the form of a dynamically assembled Web page document. 
     A dynamic Web page is a hypertext document rendered to a World Wide Web user, presenting content that has been customized for that user or content that continually updates as the page is displayed to the user. One example of such a home page may be “home.php?” with Hypertext Preprocessor (PHP) code embedded into a source document in HTML. Other scripting language such as JavaScript may also be used. 
       FIG. 6A  depicts a simplified diagrammatic representation of a user John Doe&#39;s home page  601  at a fictional social networking site “www.socialnetworksite.com”.  FIG. 6B  depicts a portion of source code  611  corresponding to home page  601 . Scripting languages such as PHP and JavaScript are known to those skilled in the art and thus are not further described herein. 
     The source code corresponding to the hypertext document originating from social networking site  320  is considered by network  340  as unstructured. As mentioned above, responses from social networking sites may contain application data in various formats/languages. In addition to the inability to properly analyze application data originating from social networking sites, businesses and other entities alike typically do not have any control over social networking sites. Thus, it can be very difficult to understand the application data originating from social networking sites, find features or components of interest contained therein, and modify the same for access control purposes. 
     In some embodiments, the types of information that would be useful for controlling access to features or application components may first be defined on a source-by-source basis. Within this disclosure, a source refers to a social networking site or any external, third party network site identified by an entity that owns and operates network  340 . Within this disclosure, social networking site  320  exemplifies such an external, third party Web application. These external Web applications may run on different operating systems/platforms. Socialware  310  may have no control over these Web applications. Socialware  310  may also have no control over applications running within network  340 . 
     In some embodiments, the types of information that would be useful for controlling access to features or application components may include, but are not limited to, the following: 
     broadcasts; 
     actions; 
     profile; and 
     directed messages. 
     Within each feature type, there may be subtypes (subfeatures). For example, the subtypes of broadcasts may include wall posts, tweets, status updates, etc. The subtypes of actions may include adding a friend, making a recommendation, searching a friend, a word, a page, an event, and so on. The subtypes of profile may include name, location, hobbies, links, etc. The subtypes of directed messages may include private messages, group mail, Web based mail, etc. Each source or social networking site would have a distinct set of features or application components (including subfeatures or subcomponents), one or more of which may be of interest to Company A for the purpose of controlling accesses thereto by users of network  340 . In some embodiments, the definitions or specifications of source-specific features and subfeatures are maintained in a centralized location such as a library or a database that is accessible by Socialware  310 . 
     Referring back to  FIG. 5 , in some embodiments, Socialware  310  may operate to examine the unstructured application data originating from the uncontrolled Web application, identify each specific type of information contained in the application data, and log those pieces of information in an InfoTable (step  503 ). In some embodiments, one or more features or application components of interest may be identified in the InfoTable (step  505 ). In some embodiments, Socialware  310  may operate to modify the unstructured application data originating from the uncontrolled Web application (step  507 ) and return the modified application data (step  509 ).  FIG. 6C  depicts a simplified diagrammatic representation of modified page  630 . 
     As it can be seen from  FIGS. 6A and 6C , original page  601  and modified page  630  are substantially the same, except a particular feature of interest—wall post—has been disabled in modified page  630 . In this example, it is the type of the feature that is disabled, so not only John Doe cannot make a wall post to his wall or his friend&#39;s wall, but also his friends cannot post to his wall. Notice that the status update feature was not disabled, so original page  601  and modified page  630  both show the same status update indicating a previous post by John Doe about his friend Jane Doe&#39;s picture. 
     In some embodiments, steps  503 - 507  may be implemented utilizing filters. Within this disclosure, a filter comprises a piece of code that is designed to recognize a particular portion of an application-level dynamic protocol. Hypertext Transfer protocol (http) is an example of an application-level protocol. Unlike defined or otherwise standardized protocols such as those used in e-mail communications and instant messaging, dynamic protocols used by social networking sites may change over time, be undefined, and/or vary from site to site. Dynamic protocols are known to those skilled in the art and techniques for parsing network traffic in such protocols are also known to those skilled in the art. 
     In some embodiments, Socialware  310  may comprise various filters for parsing and access control. Below is an example of a filter for parsing an example HTML message from a social networking site known as Facebook. 
     Filter 1—Parse HTML Message 
     
       
         
               
               
             
               
               
             
               
               
             
           
               
                   
                   
               
             
             
               
                   
                 void parse(String payload) { 
               
             
          
           
               
                   
                 HTMLDoc doc = HTMLDoc.parse( payload ); 
               
               
                   
                 HTMLElement element = doc.findByClass( “message” ); 
               
               
                   
                 String message = element.text( ); 
               
               
                   
                 return message; 
               
             
          
           
               
                   
                 } 
               
               
                   
                   
               
             
          
         
       
     
     Socialware  310  may further comprise various filters for content control and for understanding how, when, and what application external to network  340  is changing, and/or what type of change is involved. It could be a functional change, a layout change, a message format change, etc. For example, some embodiments may implement one or more of the following non-limiting types of filters:
         1) Access control filters. These filters manipulate the code of a Web application to enable and disable access to certain features depending on who the accessing user is.   2) Data archiving filters. These filters record information as it is transmitted across the wire. This may be information that is posted to social networks, or retrieved from social networks.   3) Data security filters. These filters monitor information as it is published to social networks. If data is deemed private or sensitive (by a Data Leakage Protection system or otherwise), the user will be sent a notification that they are not allowed to post that information.   4) Secure messaging filters. These filters trap information before it is able to post to a social network and store it internally. The message is replaced or otherwise substituted with a placeholder that is sent to the social network. If a user is sent the message with the placeholder, Socialware  310  will remove the placeholder and display the original message. In some embodiments, Socialware  310  is implemented as a middleware. In some embodiments, Socialware  310  is implemented in an appliance.   5) Notification Filters. These filters notify the user of certain information. For example, a company watermark may be placed onto a social network, informing a user of the company usage policy.       

     Below are non-limiting examples of various types of Socialware filters written for the example social networking site Facebook.
         1) Access control filter, to disable Facebook chat:       

     
       
         
               
               
             
               
               
             
               
               
             
               
               
             
               
               
             
           
               
                   
                   
               
             
             
               
                   
                 void process(String page, User user) { 
               
             
          
           
               
                   
                 HTMLDoc doc = HTMLDoc.parse( page ); 
               
               
                   
                 if (user.canAccessFacebookChat( ) == false) { 
               
             
          
           
               
                   
                 doc.findById( “chat” ).delete( ); 
               
             
          
           
               
                   
                 } 
               
             
          
           
               
                   
                 } 
               
               
                   
                   
               
             
          
         
       
         
         
           
             2) Data archiving filter, to record Facebook chat: 
           
         
       
    
     
       
         
               
               
             
               
               
             
               
               
             
           
               
                   
                   
               
             
             
               
                   
                 void process(String page, User user) { 
               
             
          
           
               
                   
                 HTTPPost post = HTTPPost.parse( page ); 
               
               
                   
                 String fromUsername = post.getParam( “fromUser” ); 
               
               
                   
                 String toUsername = post.getParam( “toUser” ); 
               
               
                   
                 String message = post.getParam( “message” ); 
               
               
                   
                 DataStore.record( fromUser, toUser, message ); 
               
             
          
           
               
                   
                 } 
               
               
                   
                   
               
             
          
         
       
         
         
           
             3) Data security filter, to block credit card numbers from posting to Facebook walls: 
           
         
       
    
     
       
         
               
               
             
               
               
             
               
               
             
               
               
             
               
               
             
               
               
             
               
               
             
           
               
                   
                   
               
             
             
               
                   
                 void process(String page, User user) { 
               
             
          
           
               
                   
                 HTTPPost post = HTTPPost.parse( page ); 
               
               
                   
                 String wallPost = post.getParam( “wall_post” ); 
               
               
                   
                 if ( ContainsCreditCardNumber( wallPost ) == true ) { 
               
             
          
           
               
                   
                 ReturnErrorToUser( ); 
               
             
          
           
               
                   
                 } else { 
               
             
          
           
               
                   
                 AllowMessageToPost( ); 
               
             
          
           
               
                   
                 } 
               
             
          
           
               
                   
                 } 
               
               
                   
                   
               
             
          
         
       
         
         
           
             4) Secure messaging filter, to replace Facebook wall post messages with a placeholder: 
           
         
       
    
     
       
         
               
             
               
               
             
               
             
               
               
             
               
             
           
               
                   
               
             
             
               
                 // When posting a facebook wall post 
               
               
                 void process( String page, User user ) { 
               
             
          
           
               
                   
                 HTTPPost post = HTTPPost.parse( page ); 
               
               
                   
                 String message = post.getParam( “wall_post” ); 
               
               
                   
                 String placeholder = GetPlaceholder( message ); 
               
               
                   
                 post.setParam( “wall_post” ); 
               
               
                   
                 // update the page with the new placeholder instead of message 
               
               
                   
                 page = post.toString( ); 
               
             
          
           
               
                 } 
               
               
                 // When viewing a wall message 
               
               
                 void process( String page, User user ) { 
               
             
          
           
               
                   
                 String placeholder = GetPlaceholder( page ); 
               
               
                   
                 String message = GetMessage( placeholder ); 
               
               
                   
                 // replace the placeholder with the original message 
               
               
                   
                 page.replace( placeholder, message); 
               
             
          
           
               
                 } 
               
               
                   
               
             
          
         
       
         
         
           
             5) Notification Filters, add a watermark to Facebook 
           
         
       
    
     
       
         
               
               
             
               
               
             
               
               
             
           
               
                   
                   
               
             
             
               
                   
                 void process( String page, User user ) { 
               
             
          
           
               
                   
                 HTMLDoc doc = HTMLDoc.parse( page ); 
               
               
                   
                 // Insert new HTML code for the watermark 
               
               
                   
                 doc.addElement ( GenerateFacebookWatermark( ) ); 
               
               
                   
                 page = doc.toString( ); 
               
             
          
           
               
                   
                 } 
               
               
                   
                   
               
             
          
         
       
     
     One skilled in the art will appreciate that other types of filters are also possible and that these filters would be source-specific and may vary from implementation to implementation. 
       FIG. 7  depicts a diagrammatic representation of one embodiment of system  700  for network access control to social networking sites. System  700  may comprise Socialware  310  and database  730 . Socialware  310  may comprise a plurality of source-specific filters  314  as described above. In some embodiments, proxy  350  and Socialware  310  may be part of middleware  710 . In some embodiments, middleware  710  may monitor traffic to and from user  330  in network  340 . Request  701  from user  330  may be received by proxy  350  and forwarded to Socialware  310  if request  701  is destined for a social networking site such as social networking site  320 . Response  702  from Socialware  310  may contain modified page  630  as described above with reference to  FIGS. 5-6C . Socialware  310  may save the information from processing the application data originating from social networking site  320  in InfoTable  720  which is then stored in database  730 . 
     Referring to  FIGS. 6A-C , as a specific example, filters  314  may comprise an access control filter for blocking wall posts by John Doe and to his wall on the social networking site “www.socialnetworksite.com”. This source-specific access control filter may parse source code  611  to search for a portion of source code  611  pertaining to the “wall post” feature as follows: 
     
       
         
               
               
             
               
               
             
               
               
             
           
               
                   
                   
               
             
             
               
                   
                 &lt;div id = “wall post”&gt; 
               
             
          
           
               
                   
                 &lt;input id = “content”&gt; 
               
             
          
           
               
                   
                 &lt;/div&gt; 
               
               
                   
                   
               
             
          
         
       
     
     When such a feature is found, the access control filter may add or modify as follows: 
     
       
         
               
               
             
               
               
             
           
               
                   
                   
               
             
             
               
                   
                 &lt;img src = “blocked”&gt; 
               
             
          
           
               
                   
                 &lt;input id = “content”, enable = false&gt; 
               
               
                   
                   
               
             
          
         
       
     
     As an even more specific example, suppose source code  611  contains the following piece of code: 
     
       
         
               
               
             
               
               
             
               
               
             
           
               
                   
                   
               
             
             
               
                   
                 &lt;div class = “wall post”&gt; 
               
             
          
           
               
                   
                 &lt;h1&gt;Hey, write something to my wall!&lt;/h1&gt; 
               
             
          
           
               
                   
                 &lt;/div&gt; 
               
               
                   
                   
               
             
          
         
       
     
     The access control filter recognizes “wall post” as a feature of interest as defined in the centralized library or database. If user  330  is not allowed to access the “wall post” feature, the access control filter may operate to disable it by deleting, replacing, or modifying the portion of source code  611  pertaining to the “wall post” feature and/or the content of the wall post. In the example of  FIG. 6C , the original message is deleted and replaced with a message “NOTICE: Posting to this wall is currently disabled” by Socialware  310 . 
     In some embodiments, the source-specific access control filters may be utilized in conjunction with other types of filters described above. Company A may have a set of policy rules pertaining to its users and third party social networking sites. Depending upon these policy rules, different sets of filters may be applied to different users with respect to different social networking sites to control access to different features and/or subfeatures on those social networking sites. For example, at run time, a chain of filters from filters  314  comprising Filter 1, Filter 2, Filter 3, and Filter 4 may be utilized by Socialware  310  to process request  701 . Filter 1 may operate to parse a response from social networking site  320  in a similar manner as described above with respect to the example social networking site. Filter 2 may operate to structure and block the chat function or feature and its data as well as to record any chat data contained in the response from social networking site  320 . Filter 3 may operate to structure and block the wall post feature or function of social networking site  320 . Filter 4 may operate to place a control bar or function within the page. The results from these filters are then used to prepare modified page  630 . In the example of  FIG. 7 , modified page  630  is then sent to proxy  350  in the form of response  702 . Information associated with this particular operation, including what features to look for, how to get those features, and what formats to use, is placed in InfoTable  720  and stored in database  730 . 
     Some embodiments of Socialware  310  and/or middleware  710  described above may be implemented on one or more machines own and operated by an entity independent of and external to network  340 . In some embodiments, Socialware  310  and/or middleware  710  described above may be implemented in a distributed computing architecture, with some of the functions of Socialware  310  and/or middleware  710  described above being implemented in network  340  and some outside of network  340 . 
       FIG. 8  depicts a diagrammatic representation of a distributed computing architecture for network access control to social networking sites, implementing an embodiment disclosed herein. Following the above example, Data Center  850  may be owned and operated by a company independent of Company A (and hence network  340 ) and Company B (and hence social network  304 ). For example, in one embodiment, Data Center  850  may be owned and operated by Company  800 . Data Center  850  may comprise one or more machines, each having at least one computer readable storage medium. The at least one computer readable storage medium may store computer instructions implementing testing functionality  830 . The at least one computer readable storage medium may also store Socialware filters  810 . 
     In some embodiments, middleware  710  or Socialware  310  may be communicatively coupled to Data Center  850  over a public network such as Internet  110 . In some embodiments, Socialware  310  may comprise Socialware filters  314 . In some embodiments, Socialware filters  314  may be stored on one or more computer readable storage media within network  340 . 
     In some embodiments, Socialware filters  314  that are used by Socialware  310  in network  340  may be continuously updated by Data Center  850 , perhaps over a network such as Internet  110 . Maintenance of Socialware filters  314  may comprise testing Socialware filters  810  utilizing testing functionality  830  at Data Center  850 . Socialware filters  314  may comprise all or a portion of Socialware filters  810 . 
     In some embodiments, testing functionality  830  may comprise a test driver written to cause a real-time test signal to be passed through a particular filter. If the filter does not produce the correct result, it is broken. When a filter is broken, Data Center  850  and/or an application thereof will be notified. A user at Data Center  850  reviews the filter, analyzes the signal, and determines what caused the filter to break down, and modify the filter accordingly. Socialware  310  is updated in real-time or near real-time with the updated filter. For additional details on adaptive monitoring and filtering traffic to and from social networking sites, readers are directed to U.S. patent application Ser. No. 12/562,032, filed Sep. 17, 2009, entitled “METHOD, SYSTEM, AND STORAGE MEDIUM FOR ADAPTIVE MONITORING AND FILTERING TRAFFIC TO AND FROM SOCIAL NETWORKING SITES.” 
     In some embodiments, some or all Socialware filters  314  may be defined by Company A and maintained/updated by Data Center  850 . Company A may comprise rules on how to apply Socialware filters  314 . These rules link transmissions to filters. For example, a rule may operate to examine the URL a user is accessing, and determine if that URL corresponds to a particular filter. If so, that filter will be placed on the transmission. Rules may be stored on a network server or a storage medium accessible by the server. 
     In some embodiments, middleware  710  may comprise at least one non-transitory computer readable storage medium storing Socialware filters  314  and software and/or hardware components for communicating with enterprise applications, social networking site applications, and Data Center  850 . In some embodiments, middleware  710  may further comprise one or more processors for translating instructions stored on the computer readable storage medium. In some embodiments, those instructions may include providing a set of services to a server such as proxy  350  that handles all incoming and outgoing traffic for network  340 . As shown in  FIG. 8 , in some embodiments, proxy server  350  may be part of middleware  710 . In some embodiments, proxy server  350  may be connected to a plurality of users, including user  330 , in network  340 . 
     In some embodiments, Socialware  310  may use user/group defined roles and permissions to allow and restrict end user activity for social networks. In some embodiments, Socialware  310  may comprise a user interface having a plurality of functions through which an authorized user such as an administrator can specify organizational roles and each role&#39;s access to specific social networking activities/features.  FIG. 9  is a screenshot of one example of user interface  900  through which an authorized user can perform various functions including specifying a role and social networking activities/actions for one or more social networking sites that are allowed for this role. 
     In some cases, more than one user can be assigned to a role. For example, an administrator may define a group to act in a particular role and assign individual users or workstations to the group. Since each role is associated with a set of social networking activities/actions, a user&#39;s access thereto can be effectively controlled or otherwise affected by his belonging to the group. As illustrated in  FIG. 9 , in some embodiments, control of access to social networking activities/features can be applied in this manner across multiple social networking sites. 
     In some embodiments, users and/or workstations may be added or removed from an existing group. Furthermore, allowed and/or restricted activities/actions can be modified for existing groups. In some embodiments, Socialware  310  may store administrative settings in database  720 . Examples of administrative settings may include information on a role and allowed/restricted social networking activities/actions associated therewith. 
     In some embodiments, when end user  330  attempts to access social networking site  320 , middleware  710  and/or proxy  350  may intercept the traffic from end user  330  and requests Socialware  310  to verify that end user  330  is authorized to access social networking site  320 . In some embodiments, when a HTTP post or request is received, Socialware  310  may identify what user/workstation initiated the post or request and identify the permitted/restricted actions or activities. Utilizing filters  314 , Socialware  310  may identify the specific activity contained in the post or request. If the activity is allowed, Socialware  310  may permit the activity to take place by not blocking the activity; however, if the activity is not allowed, then Socialware  310  may operate to block the activity by modifying the original application data to delete or otherwise disable the non-permitted activity. In some embodiments, the initiating user/workstation may be shown a message explaining that the activity has been blocked because the user/workstation does not have the proper permissions to execute the desired action. In some embodiments, Socialware  310  may first identify the feature or function enabling the specific activity contained in the post or request. In some embodiments, Socialware  310  may first identify the user/workstation who initiated the post or request. 
     Although shown and described throughout this disclosure with specific reference to an enterprise, this disclosure is intended to encompass other networking and business environments including, but not limited to: small businesses, individual users, homes, public networks, etc. It should be understood that the description is by way of example only and is not to be construed in a limiting sense. It is to be further understood, therefore, that numerous changes in the details of the embodiments disclosed herein and additional embodiments will be apparent to, and may be made by, persons of ordinary skill in the art having reference to this description. For example, in addition to the above described embodiments, those skilled in the art will appreciate that this disclosure has application in a wide array of arts in addition to social networking and this disclosure is intended to include the same. Accordingly, the scope of the present disclosure should be determined by the following claims and their legal equivalents.