text: fig1 is a simplified diagram of an exemplary system embodying the invention . a related system is the subject of the co - pending , and commonlyassigned u . s . patent application ser . no . 08 / 469 , 342 , entitled &# 34 ; system and method for database access control &# 34 ; which was filed on jun . 6 , 1995 . as shown in fig1 the system includes public network 100 , network resources101 - 105 , and user site 106 . particular users at user site 106 gain access to public network 100 via user terminals 107 , 108 and 109 . each of these user terminals is linked by local area network (&# 34 ; lan &# 34 ;) 110 to processor 111 within proxy server 112 . finally , proxy server 112 provides a connection from processor 111 to public network 100 via firewall 113 . requests from user terminals 107 - 109 for access to network resources ( 101 - 105 ) through public network 100 are submitted to processor 111 withinproxy server 112 . in this particular embodiment of the invention , the submitted requests are assumed to be in the form of urls . as is well knownin art , when urls are submitted to a proxy server , the particular requesting user terminal is identified to the proxy server by an identification header attached to the url . for the system shown in fig1 the identification code for user terminal 107 is id 107 , the identification code for user terminal 108 is id 108 , and the identification code for user terminal 109 is id 109 . in addition , within the system of fig1 urls designated as url 101 , url 102 , url 103 , url 104 and url 105 , represent requests for information from network resources 101 , 102 , 103 , 104 and 105 , respectively . upon receipt of an incoming url , processor 111 is programmed to determine the identity of the requesting user terminal from the url header . this identification information is then utilized by processor 111 to cross - reference the received url with information stored in relational database 114 . relational database 114 contains listing 115 which associates each of the user identification codes ( id 107 , id 108 and id 109 ) with a user clearance code ( user clearances 107 , user clearances 108 and user clearances 109 , respectively ). these user clearances indicate the particular rating class or classes of network resources that a given user terminal is allowed to access ( i . e . ; unlimitedaccess ; restricted use of urls identified as accessing violent subject matter ; restricted use of urls that are identified as accessing obscene subject matter ; etc ). also contained in relational database 114 is listing116 which includes a register of allowable urls ( url 101 - 105 ) that may be transmitted from a user terminal to access network resources . listing 116 associates each of these urls with a particular resource rating data ( resource rating 101 - 105 ). the resource rating associated with each ofsaid urls can be something as simple as a rating class indicator . for example , an indication that a particular url is approved for use by all users , or that use of a particular url is restricted for some reason ( i . e . ; the url accesses network resources that contain violent or obscene subject matter ). for example , assume that a system administrator or manager had subjectivelycategorized the network resources of fig1 into three classes ( non - violent -- nv , moderately violent -- mv , and violent -- v ) as follows : network resource 101 -- nv , network resource 102 -- nv , network resource 103 -- nv , network resource 104 -- mv , and network resource 105 -- v ). the url / resource rating listing 116 would then contain the following data : further assume that user terminal 107 should be allowed access to all network resources ( nv , mv and v ); that user terminal 108 should only be allowed to access nv and mv rated resources ; and that user terminal 109 should be allowed to access only nv resources . information reflective of these user terminal clearances would be stored within listing in 115 as follows : within the system of fig1 when a requesting user terminal transmits a url via lan 110 , processor 111 receives the url and the requesting user terminal identification code . processor 111 then queries listing 115 to determine the allowable resource ratings for the particular requesting user terminal , and listing 116 to determine the resource rating of the network resource that will be accessed by the particular received url . if a url requesting network resource 101 was received by processor 111 from user terminal 107 , list 115 and 116 within relational database 114 would yield information indicating that user terminal 107 was cleared to access nv , mv and v rated network resources , and that url 101 had a rating ofnv . as the rating of the requested resource was one of the ratings for which the requesting user terminal had clearance , processor 111 would forward the request for information ( url 101 ) to public network 100 via firewall 113 . assuming the requested resource was available , public network returns the requested information to user terminal 107 via firewall 113 , processor 111 and lan 110 . contrastingly , if a url having a rating that the requesting user terminal is not cleared for is received byprocessor 111 , that request for information is denied . for instance , if url 105 is received by processor 111 from user terminal 109 , relational database 114 is accessed . since the data within listings 115 and 116 show that url 105 has a rating of v , and that user terminal 109 is cleared to access only nv rated network resources , processor 111 denies the request for information , and no url is sent to public network 100 . processor 111 could also be programmed to deny all requests from userterminals for un - rated resources . this would prohibit the accessing of network resources that had not been reviewed or rated by the system administrator / manager . it will also be understood from the above description of the invention that images contained within a given resource ( i . e ., in - line images ) are subject to the same rating given to the resource . there would be no need to rate the in - line images separately . in the particular embodiment described above , relational database 114 stores a list of user terminal identification codes and the various user clearances reflective of the ratings of network resources that each user terminal should be allowed to retrieve from public network 100 . it will beunderstood that the invention could be modified so that the list of user clearances associated with a given user terminal identification code serves as a restrictive list ( i . e . ; that user is not allowed to retrieve network resources having that rating ). this restrictive listing functionality could be readily facilitated by reprogramming processor 111 . in addition , the invention could be modified so that the identification codes recognized by processor 111 and stored in relational database 114 are user specific , as opposed to user terminal specific . in other words , the system of fig1 could be modified so that a given individual using a terminal is identified to the system by a personal password or other identifying code . access or denial of the transmission of particular urls is effected by the system as a function of that person &# 39 ; s identity , regardless of the particular user terminal they may be utilizing . the above described system may also be modified so that urls are identifiedas being in a rating category within the memory structure of a relational database . fig2 provides a simplified diagram of a system similar to thatof fig1 but adapted to facilitate the classification of urls into ratinggroups . as shown , relational database 200 includes user identification codelisting 201 and url listing 202 . listing 201 designates user identificationcodes id 107 and id 108 as being in the user clearance a category , and id 109 as being in the user clearance b category . upon receipt of an incoming url , processor 111 ascertains the identity of the requesting user terminal from the url header , and then utilizes this identification information to determine the clearance category specified for that particular user within listing 201 . the particular url received by processor 111 is then cross - referenced with listing 202 to determine the associated resource rating category . if the requesting user has a clearance that corresponds to resource rating associated with the requested url , processor 111 forwards the url to public network 100 via firewall 113 . public network 100 returns the requested information to the identified user via firewall 113 , processor 111 and lan 110 . contrastingly , if a url is included in a resource rating category for which the requesting user is not cleared , processor 111 denies the requestfor information . in addition , the url rating data within the above described systems can include a text listing of the rationale upon which a given rating is based , or additional information that facilitates more complex conditionalrating schemes . as an illustration of a conditional rating for a url assumethat a the resource rating associated with a particular url has been rated v for violent , and that all the terminals within a given school have clearances of nv ( no violence ). therefore , in general , none of the school terminals would be granted use of the v rated url . however , situations could arise that require exception to this general rule . for example , a certain terminal associated with a history class could need to access a particular resource that contained violent , but relevant information on anhistoric military battle . to facilitate access to such resources , the relational database rating information for the military battle resource would be augmented to reflect the conditional rating of &# 34 ; nv for user terminals located in history classrooms ; v for all other terminals &# 34 ;. with this conditional system , history class terminals would be restricted from all other &# 34 ; violent &# 34 ; rated urls , but still be capable of accessing historically significant , yet violent , network resources . conditional access could also be granted to terminals or users a function of time ( i . e . ; access limited to certain times of day for certain users or user terminals ). as stated above , the relational databases within the systems of fig1 and fig2 contain listings of user / user terminal identification codes and urls . these listings are subjectively categorized or rated to facilitate the selective access of otherwise public network resources . this categorization / rating was assumed to have been performed by a system manager , and is effected by modifying the contents of the relational database utilized in practicing the invention . within the system shown in fig3 processor 111 can be programmed to allow resource categorization information ( listing 300 ) and / or user / user terminal clearance information ( listing 301 ) within relational database 302 to be modified only by a specific dedicated management terminal 303 . restricting ability to &# 34 ; write &# 34 ; new information into relational database 302 to management terminal 303 minimizes opportunities for database tampering . alternately , the system can also be configured to permit database modification to be performed from any one of user terminals 107 , 108 or 109 . to protect against corruption of the contents of relational database 302 , authorization for altering the contents of relational database 302 from a user terminal is controlled via use of a manager identifier . for example , if a system manager wished to modify relational database 302 from user terminal 108 , he or she would enter a password identifying themselves as an authorized system manager . the password is received by processor 111 and compared with the contents of manager id memory listing 304 . if the received manager id password corresponds to one stored in listing 304 , then user terminal 108 is identified as a manager terminal ( as indicated by id 108 being stored within listing 304 ). modifications to the contentsof relational database 302 may then be effected from that user terminal . when all modifications have been completed , the manager logs off and user terminal 108 returns to standard user terminal status ( i . e ., id 108 iscleared from listing 304 ). with the ever increasing proliferation of information systems in home , school and work environments , it is often the case that the responsibilityof managing information access falls upon one or more individuals that are less than expert with respect to computer or information systems . any of the above described systems can be implemented in a manner that allows a non - expert manager to easily control the systems . for example , within the system of fig3 processor 111 can be programmed to provide users recognized as system managers with an html &# 34 ; rating header &# 34 ; prior to the lead page of each retrieved network resource . if a manager retrieved the at & amp ; t 800 directory network resource via public network 100 , the returned information would be labeled by processor 111 to reflect a non - violent rating ( see fig4 note the &# 34 ; nv &# 34 ; designation that precedes the retrieved resource -- the at & amp ; t 800 directory ). the manager may review the reasoning behind the rating by clicking on the portion of the html rating page labeled &# 34 ; click here &# 34 ;. this results in the retrieval from resource categorization information listing 300 of the rationale upon which the nv rating was based ( see the page shown in fig5 ). if the manager wished to disagree with the assigned rating upon retrieving the at & amp ; t 800 directory resource , he or she would click on &# 34 ; if you disagree , click here &# 34 ;. this retrieves rating and rationale information from resource categorization information listing 300 , and provides the manager with a page that facilitates editing of the rating ( see fig6 ). this page provides the manager with the current rating of the resource (&# 34 ; nv &# 34 ;), the main reason itwas rated as such (&# 34 ; zero violent content &# 34 ;), and an area for entering a moredetailed reason (&# 34 ; the resource consists of telephone listings . . . &# 34 ;). upon completing , or modifying this html page , the system manager would select &# 34 ; send message &# 34 ; and thereby transmit the page to relational database302 for storage within listing 300 . it will be understood that the particular system and method described aboveis only illustrative of the principles of the present invention , and that various modifications could be made by those skilled in the art without departing from the scope and spirit of the present invention , which is limited only by the claims that follow . for example , any one of the above described embodiments could be modified to accept requests from users / userterminals that are in a format other than a url . the relational database would merely have to be modified to store sets of information indicative of the particular type of request format being employed , and associated with a particular user class . yet another modification would involve the adaptation to a multi - manager environment . in such an environment , networkresource ratings could be arrived at as a result of voting among a number of system managers . for example , a number of managers could submit or alter a resource &# 39 ; s rating , but the ultimate rating stored in the relation database would be an averaging of the submitted ratings , or whatever the majority of the managers chose as the rating of the particular resource . the relational database utilized in systems facilitating the invention could also be configured so that information indicative of allowable resource access is arranged to conform to resources that are configured ina tree structure format ( such as a hierarchical directory arrangement ). such a relational database would include a listing of directory and / or subdirectory identifiers that could be labeled with a particular resource rating . the system could be configured so that resources located within a directory or subdirectory so labeled , would assume the rating of the overall directory / subdirectory . alternatively , the system could employ a prioritized directory / subdirectory rating system . in such a system , a directory would be assigned an overall rating such as &# 34 ; nv &# 34 ;. particular items or subdirectories within this nv rated directory could then be labeled with specific ratings outside of &# 34 ; nv &# 34 ;, such as &# 34 ; v &# 34 ;. when a user accessed the nv rated directory , all items within it would be assumed to have an nv rating , except those items or subdirectories labeled with some other , more specific and different rating .