Patent Publication Number: US-11647051-B2

Title: Network policy service for dynamic media

Description:
TECHNICAL FIELD 
     This disclosure relates to computers and, more specifically, to network policy services. 
     BACKGROUND ART 
     Network policies can be used to prevent undesirable webpages from being retrieved by a computer. Such webpages can include malicious code that detrimentally modifies the behaviour of the retrieving computer or can include adult-oriented material that is unsuitable for viewing by a child that has access to the computer. Certain types of content may also be illegal in some jurisdictions. 
     In recent years, different types of content and interactions (e.g., peer-to-peer or decentralized file distribution, music and movie downloads or streaming, etc.) that are facilitated by the Web have been developed. Many known network policy systems fail to keep up with the constantly evolving nature of online content. Where known systems apply policy to different kinds of content and interactions, such policy is often simply to deny the request without offering users any alternative. 
     SUMMARY OF INVENTION 
     According to one aspect of this disclosure, a method of processing network requests includes receiving a request via a network for a target media element at a requested location, the request identifying a media repository that stores the target media element. The method further includes processing the request to determine a substitute media element that has content approximately equivalent to content of the target media element. The substitute media element is stored on a sub-network connected to the network. The method further includes generating a selection page having a substitute link to the location of the substitute media element on the sub-network, and responding to the request with the selection page. 
     According to another aspect of this disclosure, a system includes one or more computers configured to receive a request via a network for a target media element at a requested location, the request identifying a media repository that stores the target media element. The one or more computers are further configured to process the request to determine a substitute media element that has content approximately equivalent to content of the target media element. The substitute media element is stored on a sub-network connected to the network. The one or more computers are further configured to generate a selection page having a substitute link to the location of the substitute media element on the sub-network, and respond to the request with the selection page. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
       The drawings illustrate, by way of example only, embodiments of the present disclosure. 
         FIG.  1    is a network diagram of a computer system. 
         FIG.  2    is a block diagram of a server. 
         FIG.  3    is a block diagram of a client computer. 
         FIG.  4    is a flowchart of a method of providing a selection page. 
         FIG.  5    is an example of a policy database. 
         FIGS.  6 - 8    are diagrams of various selection pages. 
         FIG.  9    is a flowchart of a method of processing a selection of a media element. 
         FIG.  10    is a diagram of another selection page. 
     
    
    
     DESCRIPTION OF EMBODIMENTS 
     The techniques described herein can allow for granular policy enforcement for different types of content and interactions (e.g., peer-to-peer or decentralized file distribution, music and movie downloads or streaming, etc.). Such policy enforcement can further intelligently provide alternatives (e.g., legitimate or preferred download/streaming sites, music/movie stores, etc.) to requesting users. Types of content contemplated include media elements such as movies/films, music, podcasts, TV shows, and similar types of dynamic playback media. 
       FIG.  1    is a diagram illustrating a computer system  10  in accordance with an embodiment of this disclosure. The computer system  10  includes multiple client computers  12 ,  14 ,  16  that access a network  40  and various media repositories  42 ,  44 ,  46  via a one or more network devices  18  and a gateway server  32  of a sub-network  30 , which includes one or more content servers  34  and one or more account servers  36 . 
     The one or more network devices  18  connect the client computers  12 ,  14 ,  16  to the network  40  via the gateway server  32 . The network devices  18  may be modems that provide access to the network  40  for the computers  12 ,  14 ,  16 . The network devices  18  may further include devices such as switches, hubs, routers, network cables, wireless access points, fiber-optic lines, and the like. 
     The network  40  may include switches, hubs, routers, network cables, wireless access points, fiber-optic lines, computers, servers, and other network devices that provide for data communication between the policy service  20 , the sub-network  30 , and sources of content, such as media repositories  42 ,  44 ,  46 . The network  40  can be the Internet or a portion thereof. 
     The media repositories  42 ,  44 ,  46  are accessible to the client computers  12 ,  14 ,  16  and can include file transfer protocol (FTP) servers, media service, streaming media servers, application servers, and the like. As such, the media elements available include media files, streaming video and audio, and similar content. The media repositories  42 ,  44 ,  46  operate at one or more host names (e.g., www.example.com). Furthermore, the media repositories  42 ,  44 ,  46  may also include various client computers (such as computers  12 ,  14 ,  16 ) that supply media files or portions thereof via peer-to-peer or decentralized file distribution techniques (e.g., torrents). In such cases, media repositories  42 ,  44 ,  46  may include one or more servers that have links to initiate downloading of peer-to-peer or decentralized files and tracker computers that assist in coordinating downloads. 
     The policy service  20  can include various components such as a filter, a policy server, a message server, and a log server. For explanatory purposes, the policy service  20  will be described in terms of a filter  22  and a policy server  24 . However, it should be understood that more or fewer servers can form the policy service  20 , and that different processes and functions can be allotted to different servers in a myriad of ways. Functionality described herein with respect to several servers can be performed by fewer servers or even a single server, with any associated communications between physical servers described herein being configured instead as communications between processes. For example, the filter  22  and the policy server  24  can be implemented on different servers, the same server, or as a process on a client computer  12 ,  14 ,  16 . In this embodiment, the policy service  20  is out-of-band with network requests and responses between the computers  12 ,  14 ,  16  and the network  40 . 
     The filter  22  is configured to process requests by the client computers  12 ,  14 ,  16  for access to remote network resources hosted on media repositories  42 ,  44 ,  46 . In some embodiments, the filter  22  includes a layer  7  deep packet inspection (DPI) filter. 
     The policy service  20  is configured to apply resource access policy to restrict access to content, such that for each remote resource request made by the computers  12 ,  14 ,  16 , the filter  22  requests a policy decision from the policy server  24 . The filter  22  passes a location of the remote resource, such as a URL, hostname, domain, etc., to the policy server  24  along with any user identity information received with the request. If the filter  22  receives a denial from the policy server  24 , the filter  22  generates a selection page and redirects the requesting computer  12 ,  14 ,  16  to the selection page. The filter  22  is configured to redirect user agents of the client computers  12 ,  14 ,  16  to locations that appear as redirects from the requested host/domain. The response speed of the policy service  20  is configured to be faster than the actual response of the requested host/domain. 
     Identity information may be unique to the user, such as name or identification number, or may be a broader group-based characteristic, such as the user&#39;s age group, sex, organizational role (e.g., minor student, student at age of majority, teacher, parent, etc.), country, or legal jurisdiction (e.g., state, province, territory, city, special economic zone, etc.). The identity may include a combination of several characteristics. Identity information can be provided by the user by way of, for example, a login credential that is stored at the computer  12 ,  14 ,  16  (e.g., in a cookie). Identity information can also be determined by the policy service  20  based on the content of requests. For example, the request may include an IP address that can be mapped to a country or legal jurisdiction. 
     The policy server  24  is configured to determine whether a restrictive resource access policy applies to the requested resource. Restrictive policy may be based on the identity information of the user and the requested content, may be based on the requested content without regard to the identity information of the user (e.g., all users are subject to the same policy), or may be group-based, such as described in WO2011/004258, which is incorporated herein by reference. In some embodiments, the policy server  24  stores a policy database (see  FIG.  5   ). 
     Regarding the sub-network  30 , the gateway server  32  may be provided and administered by an organization, such as an Internet service provider, school system, government, company, or the like, that provides access to the network  40  for the client computers  12 ,  14 ,  16 . The gateway server  32  handles requests and responses to the client computers  12 ,  14 ,  16  and maps the client computers  12 ,  14 ,  16  to shared IP addresses, if required. 
     The gateway server  32  is configured to make policy requests to the out-of-band policy service  20 . In some embodiments, all requests for external resources are mirrored to the policy service  20 . As mentioned, the filter  22  is configured to redirect user agents of the client computers  12 ,  14 ,  16  to locations that appear as redirects from the requested host/domain. Accordingly, the gateway  32  provides incoming redirects from the filter  22  to the user agents of the computers  12 ,  14 ,  16  as responses from the requested host/domain. The response speed of the policy service  20  is configured to be faster than the actual response of the requested host/domain, so that the gateway  32  ignores or discards the actual response of the requested host/domain. 
     The content server  34  of the sub-network  30  may be configured to store media elements, such as video, music, and the like, as similar to the repositories  42 ,  44 ,  46 . The content server  34  may be generally accessible or may be restricted to access by the computers  12 ,  14 ,  16  associated with the gateway  32 . 
     The account server  36  of the sub-network  30  may be configured to store account information of users of the computers  12 ,  14 ,  16 . Such information may include network access credentials, user identity information, personal information (e.g., name, address, etc.), billing information, and similar. 
       FIG.  2    shows an example computer, or server, that can be used as any of the filter  22 , policy server  24 , gateway  32 , content server  34 , account server  36 , and media repositories  42 ,  44 ,  46 . 
     The server can include a processor  60 , memory  62 , a network interface  64 , and can further include a display  66  and other user interface components  68 . The processor  60 , memory  62 , network interface  64 , and display  66  and other user interface  68  are electrically interconnected and can be physically contained within a housing or frame. The server may be a computer such as a rack-mount server, blade server, tower server, or another kind of computer, or a process or program running on such a computer. 
     The processor  60  is configured to execute instructions, which may originate from the memory  62  or the network interface  64 . The processor  60  may be known a central processing unit (CPU). The processor  60  can include one or more sub-processors or processing cores. 
     The memory  62  includes a non-transitory computer-readable medium that is configured to store programs and data. The memory  62  can include one or more short-term or long-term storage devices, such as a solid-state memory chip (e.g., DRAM, ROM, non-volatile flash memory), a hard drive, an optical storage disc, and similar. The memory  62  can include fixed components that are not physically removable from the server (e.g., fixed hard drives) as well as removable components (e.g., removable memory cards). The memory  62  allows for random access, in that programs and data may be both read and written. 
     The network interface  64  is configured to allow the server to communicate with other computers across a network. The network interface  64  can include one or more of a wired and wireless network adaptor and well as a software or firmware driver for controlling such adaptor. 
     The display  66  and other user interface components  68 , if provided, can include a display device, such as a monitor, a bank of light-emitting diodes (LEDs), or similar for monitoring operations of the server. The user interface  68  can include an input device, such as a keyboard, mouse, touch-sensitive element of a touch-screen display, or similar device. The user interface  68  can be remote to the server and provided via the network interface  64  to a client computer operated by a remote administrator. 
     Although the filter  22  and policy server  24  may have similar components, as described above, each of the filter  22  and the policy server  24  may be configured in a manner selected for its purpose as described elsewhere herein. For example, the policy server  24  may be configured for high storage capacity (e.g., much memory  62 ), while the filter  22  may be configured for high processing speeds (e.g., multiple advanced processors  60 ). 
     One or more programs  70  can be provided to each of the filter  22  and policy server  24  to carry out the processes described herein. Such programs  70  may reference data  72  in the form of databases, files, or other data structures. 
       FIG.  3    shows an example computer that can be used as any of the client computers  12 ,  14 ,  16 . The computer includes a processor  80 , memory  82 , a network interface  84 , and a display  86  and other user interface components  88 . The processor  80 , memory  82 , network interface  84 , and display  86  and user interface  88  are electrically interconnected and can be physically contained within a housing or frame. The client computers  12 ,  14 ,  16  may each be a computer such as a desktop computer, notebook computer, tablet computer, smart phone, netbook, video game or entertainment console, and the like. 
     The processor  80  is configured to execute instructions, which may originate from the memory  82  or the network interface  84 . The processor  80  may be known a CPU. The processor  80  can include one or more sub-processors or processing cores. 
     The memory  82  includes a non-transitory computer-readable medium that is configured to store programs and data. The memory  82  can include one or more short-term or long-term storage devices, such as a solid-state memory chip (e.g., DRAM, ROM, non-volatile flash memory), a hard drive, an optical storage disc, and similar. The memory  82  can include fixed components that are not physically removable from the client computer (e.g., fixed hard drives) as well as removable components (e.g., removable memory cards). The memory  82  allows for random access, in that programs and data may be both read and written. 
     The network interface  84  is configured to allow the client computer  12 ,  14 ,  16  to communicate with other computers across a network. The network interface  84  can include one or more of a wired and wireless network adaptor and well as a software or firmware driver for controlling such adaptor. 
     The display  86  and other user interface components  88  can include a display device, such as a monitor and an input device, such as a keyboard, keypad, mouse, touch-sensitive element of a touch-screen display, or similar device. Although the term “click” is used herein with respect to links (hyperlinks), this term should be taken to mean any user interface action that follows a hyperlink, such as a touch, tap-and-hold, and the like. 
     Each of the client computers  12 ,  14 ,  16  is configured to run a user agent, such as a web browser  74 , suitable for the type of content being accessed. The web browser  74  may reference locally stored data  76 , which can include cookies and similar information. Other examples of suitable user agent include a voice over IP (VOIP) client, a video chat client, and a file-sharing client, among others. 
     Referring to  FIG.  4   , a method  100  for processing network requests for media elements is shown. Although, the method  100  is discussed in the context of the computer system  10  of  FIG.  1    for explanatory purposes, other computer systems may be used. 
     At  102 , a request for a target media element at a requested location is received via a network from a requesting computer, such as one of the client computers  12 ,  14 ,  16  ( FIG.  1   ). The request may be triggered by a user entering a URL into a browser address bar, selecting a bookmarked URL, clicking a link, or similar. The request includes a network location of the media (e.g., a URL specifying a file or web page, an FTP location, or similar). The request can identify the media repository that stores the target media element by way of a hostname, domain name, or IP address in the URL or other location identifier. That is, a request for a video file may be expressed as “http://www.example.com/video1.mpg”, where the media repository is “www.example.com”. 
     The request may further include identity information associated with the user at the requesting computer  12 ,  14 ,  16 , as discussed above. For example, the identity information may be provided in a cookie included with the request. 
     At  104 , it is determined whether the content request is subject to a restrictive policy. A policy database may be queried.  FIG.  5    shows an example of a policy database  120  that stores associations between requested URLs  122  of target media elements and locations of substitute media elements  126 . If a request for a target media element has a URL  122  in the policy database  120 , then the request is processed further. Otherwise, the request is unaffected by policy and it handled normally, which may ultimately result in the target media element being delivered to the requesting computer  12 ,  14 ,  16  in response to the request. 
     Next, at  108 , the request is processed further because the target media element URL  122  is in the policy database  120 . A substitute media element is determined for the target media element. In some embodiments, the substitute media element has content approximately equivalent to content of the target media element. The term “substitute” is not intended to be limiting. A substitute media element may be an original, licensed, or otherwise legal copy of a media element, whereas a target media element may be an illegal or pirated copy of the media element. 
     In one example, the substitute media element is a longer version of the target media element, and so encompasses the target media element. This may occur when the substitute media element is the full version of a movie that has been broken up into parts as different target media elements. In another example, the substitute media element contains a partial portion of the target media element. This may occur when content has been deleted from a media element, such as deletion of advertisements, credits, or opening sequences from a TV show. In still another example, the substitute media element is substantially identical to the target media element, except for advertisements or similar content. This may occur, when both the substitute media element and the target media element contain advertisements, but such advertisements are different in their content, time positions, or lengths. In yet another example, the substitute media element is identical to the target media element, which may occur when the target media element is an exact copy of the substitute media element. All of the foregoing examples, as well as other examples, can be considered as the substitute media element having content approximately equivalent to content of the target media element. 
     Associations of substitute media elements  126  with target media element URLs  122  may be created manually or automatically. In manual creation, an administrator views or listens to target and substitute media elements, assesses approximate equivalence, and adds rows to the policy database  120 , as appropriate. Automatic creation can compare filenames and/or file metadata to determine which substitute media element corresponds to a particular target media element. Another automatic association creation technique can employ known algorithms that compare media file content. 
     Substitute media elements may be stored on the sub-network  30 . For instance, an Internet service provider that operates the sub-network  30  may store substitute media elements at the content server  34  of the sub-network  30 . Substitute media elements may, alternatively or additionally, be stored at various media repositories  42 ,  44 ,  46 . For example, a particular target media element may be stored at a particular media repository  42 ,  44 ,  46  (e.g., an illegal or unlicensed media file server), and the associated substitute media element may be stored at a different media repository  42 ,  44 ,  46  (e.g., a media store). 
     After a substitute media element has been determined for the requested target media element, a selection page is generated, at  110 . The selection page contains a substitute link, which can identify the location of the substitute media element. For instance, the filter  22 , or another computer of the policy service  20 , may generate a URL containing parameters. The URL may identify a host at the policy service  20 , which is configured to execute a script using the parameters to generate the selection page. 
     Lastly, at  112 , the request for the target media element is provided with a response that includes a location, such as a URL, of the selection page. This can be performed by the filter  22  providing a redirect to the gateway  32  as a response to the requesting computer  12 ,  14 ,  16 . When the computer  12 ,  14 ,  16  follows the redirect, a script, if used, is executed and the selection page is shown at the requesting computer  12 ,  14 ,  16 . 
     The selection page can be configured to allow the user at the computer  12 ,  14 ,  16  to select the substitute media element instead of the originally requested target media element. 
       FIG.  5    shows an example policy database  120  that associates target media elements with substitute media elements. In addition to target media element URLs  122  and locations of substitute media elements  126 , the policy database  120  can store other information, such as a category  124  for the target media element. A category  124  may be used when providing a selection page, and can be passed to a page-generating script as a parameter. 
     Associations between target media elements and substitute media elements may be made in a myriad of ways and are not particularly limited. For example, an association  132  associates a particular media file (e.g., a torrent file of a film) with an HTML page containing related content, such as a description of the media file and a link to obtain the media in a legitimate way (see  FIG.  6   ). An association  134  maps a particular media stream (e.g., a streaming video) with a host that offers an approximately equivalent media stream (see  FIG.  7   ). An association  136  associates a particular media file (e.g., a music file) with the same media file at another location (see  FIG.  8   ). An association  136  associates a plurality of specific media files using a wildcard (e.g., “*”) with an HTML page containing related content, such as a description of the artist and a link to obtain the media files in a legitimate way. The forgoing are merely examples and other examples will be apparent to those of ordinary skill. Many ways of mapping target media elements with locations offering substitute media elements are contemplated. It is advantageous that target media elements, which are unlicensed or unauthorized, can be mapped in a granular manner (e.g., by file or using wildcards) to legitimate sources of substitute media elements that contain approximately the same or identical content. One advantage is that piracy of media can be reduced. 
     A different policy database  120  may be provided for a group of one or more sub-networks  30 , particularly when such group operates in the same legal jurisdiction. For instance, when sub-networks  30  are Internet service provider networks located in a particular country, then a policy database  120  can be provided to the sub-networks  30 . This advantageously allows policy and substitute media elements to comply with the laws of the jurisdiction. For example, a video may be under strict copyright in one country, yet may be under looser control in another country. In other examples, each Internet service provider operated sub-network  30  has its own policy database  120 . 
       FIG.  6    shows an example of a selection page  150 , as displayed in the web browser  74  of a requesting computer  12 ,  14 ,  16 . The selection page  150  may be dynamically generated (e.g., by a script or other program, such as PHP, Ruby on Rails, Microsoft ASP, and the like) and provided to the web browser  74  as an HTML/CSS document. 
     The selection page  150  can include one or more policy message display elements  152  that include a human-intelligible message indicating to the user of the requesting computer  12 ,  14 ,  16  that their original content request (e.g., clicked/typed URL) was found to be subject to a restrictive policy. The content of the policy message display element  152  can indicate a negative characteristic of the target media element and can be based on the category  124  ( FIG.  5   ) of the requested media element. In the example shown, the target media element is a torrent file and the content of the policy message display element  152  expresses potential dangers associated with such. 
     The selection page  150  can include a target link  154  to the requested location of the target media element. Hence, the user of the requesting computer  12 ,  14 ,  16  can click through to the originally requested target media element, if he or she chooses. 
     The selection page  150  includes a substitute media element presentation area  156  that provides information about the substitute media element and further includes a link  158  to the substitute media element. The substitute media element does not have the negative characteristic of the target media element. Hence, the user can select the substitute link  158  to obtain the substitute media element, that is, a media element approximately equivalent to the target media element but lacking the negative characteristic. In this example, negative characteristics include the potential dangers of torrent files and a high likelihood that the target media element is pirated. 
     The substitute media element presentation area  156  may be an iframe or similar element whose content is set to content located outside the policy service, such as a webpage of the sub-network  30 . The content of the substitute media element presentation area  156  can be so set by, for example, setting a source property of an iframe. For instance, when the sub-network  30  is operated by an ISP, the content of the substitute media element presentation area  156  may be the ISP&#39;s webpage for the movie that was originally intended to be obtained via a torrent file. Such a webpage may require login credentials and may trigger a debit of a user&#39;s account at the account server  36  of the sub-network  30  if the user selects to play the movie via the substitute link  158 . 
     The selection page  150  can further include other elements, such as a menu bar  160  that provides links to other media elements, advertisements, and similar. 
       FIG.  7    shows an example of a selection page  170 , as displayed in the web browser  74  of a requesting computer  12 ,  14 ,  16 . The selection page  170  may be dynamically generated and provided to the web browser  74  as an HTML/CSS document. 
     The selection page  170  can include one or more policy message display elements  172  that include a human-intelligible message indicating to the user of the requesting computer  12 ,  14 ,  16  that their original content request (e.g., clicked/typed URL) was found to be subject to a restrictive policy. The content of the policy message display element  172  can indicate a negative characteristic of the target media element and can be based on the category  124  ( FIG.  5   ) of the requested media element. In the example shown, the target media element is a streaming video and the negative characteristic is a reduced audio or visual playback quality (e.g., lower resolution, lower frame rate, lower audio sampling rate, etc.). 
     The selection page  170  includes a target media element presentation area  174  that provides the target media element  176  that was originally requested. The target media element presentation area  174  can also include other elements  178 , such as additional videos for playback from the same source as the target media element. The target media element presentation area  174  may be the hosting page of the target media element  176  provided in an iframe or similar element. 
     The selection page  170  further includes a link  180  to the location of the substitute media element, which can be hosted at the content server  34  of the sub-network  30 , for example. The substitute media element lacks the negative characteristic. For instance, the substitute media element can have increased quality with respect to the target media element. Hence, the user is offered a superior approximately equivalent version of the requested media element at a different source. The substitute media element may have different advertisements or other commercial considerations with respect to the target media element. Thus, the operator of the sub-network  30  may earn revenue from offering the higher quality substitute media element. 
     In some embodiments, when the sub-network  30  is operated by an ISP and the media repository  42 ,  44 ,  46  is outside the control of the ISP. The sub-network  30  may be configured to deliver media elements hosted at the content server  34  at a speed or quality greater than that for approximately equivalent media elements hosted at the media repository  42 ,  44 ,  46 . 
       FIG.  8    shows an example of a selection page  190 , as displayed in the web browser  74  of a requesting computer  12 ,  14 ,  16 . The selection page  190  may be dynamically generated and provided to the web browser  74  as an HTML/CSS document. 
     The selection page  190  can include one or more policy message display elements  192  that include a human-intelligible message indicating to the user of the requesting computer  12 ,  14 ,  16  that their original content request (e.g., clicked/typed URL) was found to be subject to a restrictive policy. The content of the policy message display element  192  can indicate a negative characteristic of the target media element and can be based on the category  124  ( FIG.  5   ) of the requested media element. In the example shown, the target media element is a music file (e.g., an mp3 file) the content of the policy message display element  192  expresses that the music is unlicensed. 
     The selection page  190  can include a target link  194  to the requested location of the target media element. Hence, the user of the requesting computer  12 ,  14 ,  16  can click through to the originally requested target media element, if he or she chooses. 
     The selection page  190  includes a substitute media element presentation area  196  that provides information about the substitute media element and further includes a link  198  to the substitute media element. Information about the substitute media element may include a message from the artist who created the media element, so as to encourage the user to choose to purchase the media element and support the artist. The substitute media element does not have the negative characteristic (e.g., from an unlicensed source) of the target media element, and thus the user can select the substitute link  198  to obtain a media element approximately equivalent to the target media element but lacking the negative characteristic. In this example, the substitute media element is provided by a licensed source, such as the content server  34  of the sub-network  30 . 
     The substitute media element presentation area  196  may be an iframe or similar element whose content is set to content located outside the policy service, such as a webpage of the sub-network  30 . The content of the substitute media element presentation area  196  can be so set by, for example, setting a source property of an iframe. For instance, when the sub-network  30  is operated by an ISP, the content of the substitute media element presentation area  196  may be the ISP&#39;s webpage for the album or artist of the song that was originally intended to be obtained via downloading an unlicensed mp3 file. Such a webpage may require login credentials and may trigger a debit of a user&#39;s account at the account server  36  of the sub-network  30  if the user selects to download or play the song via the substitute link  198 . 
     The selection page  190  can further include other elements, such as a navigation bar  200  that allows navigation to other music hosted by the sub-network  30 . 
       FIG.  9    shows a method  220  of processing a selection of a media element. For sake of explanation, the method  220  is described in the context of the system  10 , the method of  FIG.  4   , and the selection pages discussed herein. 
     At  102 , a request is made for a target media element. Then, at  112 , a selection page is provided to the requesting computer  12 ,  14 ,  16 . The description of method  100  can be referenced for further detail of these steps and of other steps that may be performed. 
     At  222 , if a link for the target media element is selected at the selection page, then, at  224 , the target media element is provided to the requesting computer  12 ,  14 ,  16 . Examples of such links are links  154 ,  176 ,  194  in  FIGS.  6 - 8   . Links to target media elements need not be provided, particularly if the target media contains content illegal in the jurisdiction of the requesting computer  12 ,  14 ,  16 . 
     If a link for the substitute media element is selected at the selection page (e.g., links  158 ,  180 ,  198  of  FIGS.  6 - 8   ), then a credential for the sub-network  30  is verified, at  226 . A credential associated with the requesting computer  12 ,  14 ,  16  may be provided to the policy service  20  or the gateway  32  as part of the request and policy enforcement process. Such a credential may be in the form of a cookie. The credential may indicate an account of the sub-network  30  that is associated with the requesting computer  12 ,  14 ,  16  and further may indicate that the requesting computer  12 ,  14 ,  16  has an active session with such account. 
     Alternatively or additionally, at  226 , a prompt may be issued to the requesting computer  12 ,  14 ,  16  to provide authentication against a credential (e.g., enter a username and password). Such a prompt may be provided to the selection page via an iframe that frames a webpage hosted at the sub-network  30 . 
     If the credential cannot be authenticated, then a general page is provided to the requesting computer  12 ,  14 ,  16 , at  228 . The general page can be hosted at the sub-network  30  and can include a form for the user to obtain or confirm their authentication information. For example, the general page can be a registration page or lost-password page. 
     If the credential is successfully authenticated then the associated account is charged, at  230 . Thus, after receiving a selection of the substitute media element by the requesting computer  12 ,  14 ,  16 , the account associated with the requesting computer is charged for the media element and the media element is delivered to the requesting computer  12 ,  14 ,  16 , at  232 . This advantageously allows the sub-network  30  to provide a media store at which media elements including the substitute media element are for sale. 
       FIG.  10    shows another example of a selection page  240 . The selection page  240  is similar to the selection page  190  and only differences will be discussed in detail. 
     The selection page  240  includes a policy message display element  192  and a target link  194 . The selection page  240  further includes a plurality of substitute media element presentation areas  242 - 248 , which are each associated with a different source of substitute media elements that have content approximately equivalent to the target media element. Each substitute media element presentation area  242 - 248  can provide a link to the respective substitute media element. Thus, the user can be provided with several choices when deciding to download the media element from a legitimate source. 
     In view of the above, it should be apparent that users can be provided with various options to obtain media elements (e.g., music, videos, movies, etc.) from same and legitimate sources. It is advantageous that users are given the choice of whether to continue with what may be a harmful or illegal media download/stream or whether to obtain substantially equivalent, identical, or superior content from a legitimate source. Furthermore, it is beneficial to legitimate sellers of media that users are provided with links to legitimate media at the very time that they are in the process of obtaining such media via other means. That is, a user has already decided that he or she wishes to view or listen to a particular media element when the user is provided with the choice to obtain the media element from a legitimate source. This can have the dual benefit of increasing revenues to artists and media companies, while educating and reducing risk to consumers. 
     Users can be incentivised to choose a legitimate source when provided with a selection page by the human-intelligible content on the selection page. Benefits and drawbacks can be indicated. In addition, media quality can be increased or decreased, and it is contemplated that users will often choose higher quality media even if a small amount of money is charged. Another example of an incentive is that the policy service may log network requests, and users can be reminded that potentially illegal media downloads/streams are being logged. 
     A further advantage of the techniques described herein is that Internet service providers may be able to divert traffic that might otherwise be over-the-top (OTT) content to paying channels. 
     While the foregoing provides certain non-limiting example embodiments, it should be understood that combinations, subsets, and variations of the foregoing are contemplated. The monopoly sought is defined by the claims.