Patent ID: 7792994

Claim:
A method for blocking user access to an external resource, comprising: monitoring, at a filter associated with a host in a protected network, a first request from and a corresponding response to the host to learn and store an association between a first identifier associated with an external resource under a first communication protocol and a second identifier associated with the external resource under a second communication protocol, wherein the first request is to a server external to the protected network; dynamically creating or updating a cache using the stored first and second identifiers in the filter; receiving, at the filter, a second request, sent under the second communication protocol, to access the external resource, wherein the external resource is identified in the second request by the second identifier; using the stored first and second identifiers in the cache to determine that the second request is associated with the first identifier; and using the first identifier to determine whether access to the external resource in response to the second request is prohibited by checking the first identifier against a blocking list including a list of blocked external resources; wherein the first identifier comprises an identifier entered by a user; wherein the external resource includes content requested by the user; and wherein monitoring a first request from and a corresponding response to a host includes: receiving the first request; determining the first identifier from the first request; storing the first identifier; receiving the corresponding response; associating, at the filter, the corresponding response with the first request; determining the second identifier and an associated time to live (TTL) value from the corresponding response; and storing the second identifier and associated time to live value in a manner that associates the second identifier and associated time to live value with the first identifier: wherein the second identifier is stored in a manner that associates the second identifier with the first identifier for a length of time defined by the time to live value associated with the second identifier.