Patent ID: 8205246

Claim:
A method to be performed in a network environment in which packets are exchanged, comprising: receiving, at a local node of a network, authorization data that indicates a particular network address of a different node in the network and an authenticated user identifier (ID) of a user of the different node, wherein the user ID is associated with resource profile data that indicates application layer resources on the network that the user is allowed to access; associating the particular network address with the resource profile data for the user; and blocking a request from the particular network address for a requested application layer resource on the network based on the resource profile data associated with the particular network address, and wherein the resource profile data is stored before the request is generated such that incoming requests from the particular network address can be filtered using a user cache, wherein the resource profile data is retrieved when the user signed on with a password and the user ID, and wherein a universal resource identifier (URI) whitelist and blacklist are provisioned based on the password and the user ID, the whitelist comprising URIs of application layer resources that are allowed for the user regardless of the resource profile data, and the blacklist comprising URIs of application layer resources that are prohibited for the user regardless of the resource profile data.