# US 9,520,940 B2 · Method for preventing storage of prohibited data on an Ad Hoc moving data network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,520,940 B2 - Document ID: US9520940B2 - Status: Granted - Kind: B2 - Application number: 13/714,947 - Filed: 2012-12-14 - Published: 2014-06-19 - Granted: 2016-12-13 - Earliest claimed: 2012-12-14 - Assignees: X Development LLC - Applicants: X Development LLC - Inventors: Eric Teller - Web page: https://patentgrep.com/patent/US9520940B2 ## CPC - H04W 48/04: based on user or terminal location or mobility data, e.g. moving direction, speed - H04B 7/18504: {Aircraft used as relay or high altitude atmospheric platform} - H04B 10/118: specially adapted for satellite communication - H04L 67/288: Distributed intermediate devices, i.e. intermediate devices for interaction with other intermediate devices on the same level - H04L 67/5681: Pre-fetching or pre-delivering data based on network characteristics - H04W 4/021: Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences - H04W 8/183: {Processing at user equipment or user record carrier} - H04W 12/08: Access security - H04W 12/64: using geofenced areas - H04W 40/20: based on geographic position or location - H04W 40/24: Connectivity information management, e.g. connectivity discovery or connectivity update - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04W 84/005: {Moving wireless networks} - H04W 84/06: Airborne or Satellite Networks (space-based or airborne stations H04B7/185) - H04W 84/18: Self-organising networks, e.g. ad-hoc networks or sensor networks - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04B: TRANSMISSION - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present disclosure provides a method operable in a balloon network. The method can include determining that a balloon is at a location associated with a first legally-defined geographic area, wherein an area profile identifies a list of geographically-prohibited data that is restricted from being cached in the first legally-defined geographic area. The method can also include receiving first data. The method can also include using the list of geographically-prohibited data to determine whether or not the first data is geographically-prohibited data. If the first data is geographically-prohibited data, then the method can further include refraining from storing the first data in data storage at the first balloon. ## Claims ### Claim 1 A computer-implemented method comprising: while a first balloon is at a location within a first legally-defined geographic area, accessing a first list of geographically-prohibited data that identifies data that is restricted from being cached by the first balloon while the first balloon is at the location within the first legally-defined geographic area, wherein the first balloon is part of a balloon network including a plurality of moveable balloons that provide service to client devices in a plurality of legally-defined geographic areas; determining that the first balloon has moved from the first legally-defined geographic area to a location within a second legally-defined geographic area; in response to determining that the first balloon has moved to the location within the second legally-defined geographic area, the first balloon refraining from accessing the first list of geographically-prohibited data and instead accessing a second list of geographically-prohibited data that identifies data that is restricted from being cached by the first balloon while the first balloon is at the location within the second legally-defined geographic area, wherein the second list of geographically-prohibited data further indicates geographically-prohibited data for each of one or more additional legally-defined geographic areas; while the first balloon is at the location within the second legally-defined geographic area, the first balloon receiving data; using the second list of geographically-prohibited data to determine that the received data is geographically-prohibited data in the second legally-defined geographic area; and responsive to a determination that the received data is geographically-prohibited data in the second legally-defined geographic area, (i) identifying a second balloon of the plurality of balloons that is at a location outside of the second legally-defined geographic area, (ii) using the second list of geographically-prohibited data to determine that the received data is not geographically-prohibited at the location of the second balloon, (iii) routing the received data to the second balloon, and (iv) refraining from caching the received data in data storage at the first balloon while the first balloon is at the location within the second legally-defined geographic area. ### Claim 2 (depends on 1) The method of claim 1, wherein the second list of geographically-prohibited data that is restricted from being cached in the second legally-defined geographic area comprises a prohibited class of data. ### Claim 3 (depends on 1) The method of claim 1, wherein the second list of geographically-prohibited data that is restricted from being cached in the second legally-defined geographic area comprises a prohibited instance of data. ### Claim 4 (depends on 1) The method of claim 1, further comprising: the first balloon receiving the first list of geographically-prohibited data from a first ground-based station that is associated with the first legally-defined geographic area; and the first balloon receiving the second list of geographically-prohibited data from a second ground-based station that is associated with the second legally-defined geographic area. ### Claim 5 (depends on 1) The method of claim 1, further comprising the first balloon receiving the first and second lists of geographically-prohibited data from the second balloon. ### Claim 6 (depends on 1) The method of claim 1, wherein the first balloon implements a routing process in which data cannot be cached in the data storage at the first balloon, and wherein refraining from caching the received data in the data storage at the first balloon comprises the balloon altering the routing process such that the received data is not cached in the data storage at the first balloon as part of the routing process. ### Claim 7 (depends on 1) The method of claim 1, wherein the one or more additional legally-defined geographic areas are adjacent to the second legally-defined geographic area. ### Claim 8 A computer-implemented method comprising: determining that a first balloon has moved from outside of a first legally-defined geographic area to a location within the first legally-defined geographic area, wherein the first balloon is part of a balloon network including a plurality of moveable balloons that provide service to client devices in a plurality of legally-defined geographic areas; in response to determining that the first balloon has moved to the location within the first legally-defined geographic area, the first balloon accessing: (i) a first list of geographically-prohibited data that identifies data that is restricted from being cached in a second legally-defined geographic area, and (ii) a second list of geographically-prohibited data that identifies data that is restricted from being cached in a third legally-defined geographic area; while the first balloon is at the location within the first legally-defined geographic area, the first balloon receiving data; using the first list of geographically-prohibited data and the second list of geographically-prohibited data as a basis for making a determination that the received data is geographically-prohibited data in the second legally-defined geographic area but not geographically-prohibited data in the third legally-defined geographic area; and based on the determination that the received data is geographically-prohibited data in the second legally-defined geographic area but not geographically-prohibited data in the third legally-defined geographic area, (i) identifying a second balloon of the plurality of balloons that is at a location within the third legally-defined geographic area, and (ii) routing the received data towards the second balloon. ### Claim 9 (depends on 8) The method of claim 8, wherein the second legally-defined geographic area and third legally-defined geographic area are adjacent to the first legally-defined geographic area. ### Claim 10 (depends on 8) The method of claim 8, wherein the first and second lists of geographically-prohibited data that is restricted from being cached in the second and third legally-defined geographic area comprises a prohibited class of data. ### Claim 11 (depends on 8) The method of claim 8, wherein the first and second lists of geographically-prohibited data that is restricted from being cached in the second and third legally-defined geographic area comprises a prohibited instance of data. ### Claim 12 (depends on 8) The method of claim 8, further comprising the first balloon receiving the first and second lists of geographically-prohibited data from a ground-based station that is associated with the first legally-defined geographic area. ### Claim 13 (depends on 8) The method of claim 8, further comprising the first balloon receiving the first and second lists of geographically-prohibited data from the second balloon. ### Claim 14 A non-transitory computer readable medium storing instructions that, when executed by one or more processors in a computing device, cause that computing device to perform functions, the functions comprising: while a first balloon is at a location within a first legally-defined geographic area, accessing a first list of geographically-prohibited data that identifies data that is restricted from being cached by the first balloon while the first balloon is at the location within the first legally-defined geographic area, wherein the first balloon is part of a balloon network including a plurality of moveable balloons that provide service to client devices in a plurality of legally-defined geographic areas; determining that the first balloon has moved from the first legally-defined geographic area to a location within a second legally-defined geographic area; in response to determining that the first balloon has moved to the location within the second legally-defined geographic area, the first balloon refraining from accessing the first list of geographically-prohibited data and instead accessing a second list of geographically-prohibited data that identifies data that is restricted from being cached by the first balloon while the first balloon is at the location within the second legally-defined geographic area, wherein the second list of geographically-prohibited data further indicates geographically-prohibited data for each of one or more additional legally-defined geographic areas; while the first balloon is at the location within the second legally-defined geographic area, the first balloon receiving data; using the second list of geographically-prohibited data to determine that the received data is geographically-prohibited data in the second legally-defined geographic area; and responsive to a determination that the received data is geographically-prohibited data in the second legally-defined geographic area, (i) identifying a second balloon of the plurality of balloons that is at a location outside of the second legally-defined geographic area, (ii) using the second list of geographically-prohibited data to determine that the received data is not geographically-prohibited at the location of the second balloon, (iii) routing the received data to the second balloon, and (iv) refraining from caching the received data in data storage at the first balloon while the first balloon is at the location within the second legally-defined geographic area. ### Claim 15 (depends on 14) The non-transitory computer readable medium of claim 14, the functions further comprising: the first balloon receiving the first list of geographically-prohibited data from a first ground-based station that is associated with the first legally-defined geographic area; and the first balloon receiving the second list of geographically-prohibited data from a second ground-based station that is associated with the second legally-defined geographic area. ### Claim 16 (depends on 14) The non-transitory computer readable medium of claim 14, the functions further comprising the first balloon receiving the first and second lists of geographically-prohibited data from the second balloon. ### Claim 17 A balloon comprising: a location determination system configured to determine a location of the balloon; a communication interface configured to receive data; and a control system configured to: while the balloon is at a location within a first legally-defined geographic area, access a first list of geographically-prohibited data that identifies data that is restricted from being cached by the first balloon while the first balloon is at the location within the first legally-defined geographic area, wherein the first balloon is part of a balloon network including a plurality of moveable balloons that provide service to client devices in a plurality of legally-defined geographic areas; determine that the location of the balloon has moved from the first legally-defined geographic area to a location within a second legally-defined geographic area; in response to determining that the balloon has moved to the location within the second legally-defined geographic area, refrain from accessing the first list of geographically-prohibited data and instead access a second list of geographically-prohibited data that identifies data that is restricted from being cached by the balloon while the balloon is at the location within the second legally-defined geographic area, wherein the second list of geographically-prohibited data further indicates geographically-prohibited data for each of one or more additional legally-defined geographic areas; in response to receiving data via the communication interface while the balloon is at the location within the second legally-defined geographic area, use the second list of geographically-prohibited data to determine that the received data is geographically-prohibited data in the second legally-defined geographic area; and responsive to a determination that the received data is geographically-prohibited data in the second legally-defined geographic area, (i) identify a second balloon of the plurality of balloons that is at a location outside of the second legally-defined geographic area, (ii) use the second list of geographically-prohibited data to determine that the received data is not geographically-prohibited at the location of the second balloon, (iii) route the received data to the second balloon, and (iv) refrain from caching the received data in data storage at the first balloon while the first balloon is at the location within the second legally-defined geographic area. ### Claim 18 (depends on 17) The balloon of claim 17, wherein the balloon is a first balloon, and wherein the second list of geographically-prohibited data further indicates geographically-restricted data that must not be removed from the second legally-defined geographic area, wherein the control system is further configured to: determine that the first balloon contains at least some of the geographically-restricted data; detect when the first balloon is likely to move out of the second legally-defined geographic area; and when the first balloon is likely to move out of the second legally-defined geographic area, responsively remove the geographically-restricted data from the memory of the first balloon. ### Claim 19 (depends on 18) The balloon of claim 18, wherein the second list of geographically-prohibited data further indicates geographically-restricted data that must be saved in at least one location in the second legally-defined geographic area, wherein the control system is further configured to: determine if a second balloon located in the second legally-defined geographic area contains the geographically-restricted data; responsive to the determination that the second balloon does not include the geographically-restricted data, transfer the geographically-restricted data from the first balloon to a device that is located in the second legally-defined geographic area, before removing the geographically-restricted data from the memory of the first balloon. ### Claim 20 A balloon comprising: a location determination system configured to determine a location of the balloon; a communication interface configured to receive data; and a control system configured to: determine that the location of the balloon has moved from outside of a first legally-defined geographic area to a location within the first legally-defined geographic area, wherein the balloon is part of a balloon network including a plurality of moveable balloons that provide service to client devices in a plurality of legally-defined geographic areas; in response to determining that the balloon has moved to the location within the first legally-defined geographic area, access: (i) a first list of geographically-prohibited data that identifies data that is restricted from being cached in a second legally-defined geographic area, and (ii) a second list of geographically-prohibited data that identifies data that is restricted from being cached in a third legally-defined geographic area; in response to receiving data via the communication interface while the balloon is at the location within the first legally-defined geographic area, use the first list of geographically-prohibited data and the second list of geographically-prohibited data as a basis for making a determination as to whether or not the received data is geographically-prohibited data in the second legally-defined geographic area but not geographically-prohibited data in the third legally-defined geographic area; and based on the determination that the received data is geographically-prohibited data in the second legally-defined geographic area but not geographically-prohibited data in the third legally-defined geographic area, (i) identify a second balloon of the plurality of balloons that is at a location within the third legally-defined geographic area, and (ii) route the received data towards the second balloon. ### Claim 21 (depends on 20) The balloon of claim 20, wherein the balloon is a first balloon, and wherein the second list of geographically-prohibited data further indicates geographically-restricted data that must not be removed from the first legally-defined geographic area, wherein the control system is further configured to: determine that the first balloon contains at least some of the geographically-restricted data; detect when the first balloon is likely to move out of the first legally-defined geographic area; and when the first balloon is likely to move out of the first legally-defined geographic area, responsively remove the geographically-restricted data from the memory of the first balloon. ### Claim 22 (depends on 21) The balloon of claim 21, wherein the second list of geographically-prohibited data further indicates geographically-restricted data that must be saved in at least one location in the first legally-defined geographic area, wherein the control system is further configured to: determine if a second balloon located in the first legally-defined geographic area contains the geographically-restricted data; responsive to the determination that the second balloon does not include the geographically-restricted data, transfer the geographically-restricted data from the first balloon to a device that is located in the first legally-defined geographic area, before removing the geographically-restricted data from the memory of the first balloon.