Network zones

• US 20040199648A1
• Filed: 04/01/2003
• Published: 10/07/2004
• Est. Priority Date: 04/01/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Ward, Richard B., Shelest, Art
• Granted Patent: US 9,003,048 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 47/803 Application aware
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A computer assigns networks to network zones based on predefined properties for each zone and/or the properties of the networks. An application program installed on the computer provides the computer with preference information that indicates the network zone whose network policies or properties are best suited for the application program. Thereafter, when executing the application program, the computer limits network contact for the application program to the network(s) that is assigned to the network zone(s) identified as a preferred network zone(s) or identified by a preferred network property or properties by the preference information from the application program.

Claims

1. A processor-readable medium comprising processor-executable instructions configured for:

receiving from an application program, preference information that identifies a preferred network zone;

permitting a connection between the application program and a network associated with the preferred network zone; and

preventing a connection between the application program and a network not associated with the preferred network zone.

2. A processor-readable medium as recited in claim 1, comprising further processor-executable instructions configured for:

defining a plurality of network zones; and

associating the network with the preferred network zone.

3. A processor-readable medium as recited in claim 2, wherein the defining further comprises associating network properties with each network zone.

4. A processor-readable medium as recited in claim 2, wherein the associating further comprises:

connecting to the network;

determining network properties of the network; and

assigning the network to the network zone based on the network properties.

5. A processor-readable medium as recited in claim 1, comprising further processor-executable instructions configured for associating the application program with the preferred network zone.

6. A processor-readable medium as recited in claim 1, wherein the receiving further comprises initiating an installation of the application program.

7. A processor-readable medium as recited in claim 1, wherein the permitting a connection further comprises:

allowing the application program to accept a communication from the network associated with the preferred network zone; and

allowing the application program to initiate a communication to the network associated with the preferred network zone.

8. A processor-readable medium as recited in claim 1, wherein the preventing a connection further comprises:

preventing the application program from accepting a communication from the network not associated with the preferred network zone; and

preventing the application program from initiating a communication to the network not associated with the preferred network zone.

9. A processor-readable medium as recited in claim 2, wherein each network zone represents a different network.

10. A processor-readable medium as recited in claim 2, wherein each network zone represents a network selected from the group comprising:

a home network;

a corporate network; and

the Internet.

11. A processor-readable medium as recited in claim 1, wherein the preference information comprises a preferred network property used to identify the preferred network zone based on a network that possesses the preferred network property.

12. A processor-readable medium as recited in claim 1, wherein the preference information comprises properties and connection policies that define the preferred network zone as a custom zone.

13. A processor-readable medium comprising processor-executable instructions configured for:

recognizing a connection to a first network;

associating the first network with a first network zone;

permitting access to the first network for application programs that specify the first network zone as a preferred network zone; and

preventing access to the first network for application programs that specify a second network zone as a preferred network zone.

14. A processor-readable medium as recited in claim 13, wherein the associating further comprises:

determining network properties of the first network; and

assigning the first network to the first network zone based on the network properties.

15. A processor-readable medium as recited in claim 13, comprising further processor-executable instructions configured for:

recognizing a connection to a second network;

associating the second network with the second network zone;

permitting access to the second network for application programs that specify the second network zone as a preferred network zone; and

preventing access to the second network for application programs that specify the first network zone as a preferred network zone.

16. A processor-readable medium as recited in claim 15, comprising further processor-executable instructions configured for:

permitting access to the first network and the second network for application programs that specify the first network zone and the second network zone as preferred network zones.

17. A processor-readable medium as recited in claim 13, wherein the first network connection is selected from the group comprising:

a home network connection;

a corporate network connection; and

an Internet connection.

18. A processor-readable medium comprising processor-executable instructions configured for:

defining a plurality of network zones such that each network zone corresponds to a different network connection policy;

receiving a network zone preference from an application program indicating a preferred network connection policy for the application program; and

enforcing the preferred network connection policy according to the network zone preference during execution of the application program.

19. A processor-readable medium as recited in claim 18, wherein the preferred network connection policy is a custom network connection policy, the processor-readable medium comprising further processor-executable instructions configured for:

receiving instructions from the application program that define the custom network connection policy; and

enforcing the custom network connection policy according to the instructions during execution of the application program.

20. A method comprising:

receiving from an application program, a preference that specifies a preferred network zone;

permitting a connection between the application program and a network associated with the preferred network zone; and

preventing a connection between the application program and a network not associated with the preferred network zone.

21. A method as recited in claim 20, further comprising:

defining a plurality of network zones; and

associating the network with the preferred network zone.

22. A method as recited in claim 21, wherein the defining further comprises associating network properties with each network zone.

23. A method as recited in claim 21, wherein the associating further comprises:

connecting to the network;

determining network properties of the network; and

assigning the network to the network zone based on the network properties.

24. A method as recited in claim 20, further comprising associating the application program with the preferred network zone.

25. A method as recited in claim 20, wherein the receiving further comprises initiating an installation of the application program.

26. A method as recited in claim 20, wherein the permitting a connection further comprises:

allowing the application program to accept a communication from the network associated with the preferred network zone; and

allowing the application program to initiate a communication to the network associated with the preferred network zone.

27. A method as recited in claim 20, wherein the preventing a connection further comprises:

preventing the application program from accepting a communication from the network not associated with the preferred network zone; and

preventing the application program from initiating a communication to the network not associated with the preferred network zone.

28. A method as recited in claim 21, wherein each network zone represents a different network.

29. A method as recited in claim 21, wherein each network zone represents a network selected from the group comprising:

a home network;

a corporate network; and

the Internet.

30. A method comprising:

recognizing a connection to a first network;

associating the first network with a first network zone;

permitting access to the first network for application programs that specify the first network zone as a preferred network zone; and

preventing access to the first network for application programs that specify a second network zone as a preferred network zone.

31. A method as recited in claim 30, wherein the associating further comprises:

determining network properties of the first network; and

assigning the first network to the first network zone based on the network properties.

32. A method as recited in claim 30, further comprising:

recognizing a connection to a second network;

associating the second network with the second network zone;

permitting access to the second network for application programs that specify the second network zone as a preferred network zone; and

preventing access to the second network for application programs that specify the first network zone as a preferred network zone.

33. A method as recited in claim 32, further comprising:

permitting access to the first network and the second network for application programs that specify the first network zone and the second network zone as preferred network zones.

34. A method as recited in claim 30, wherein the first network connection is selected from the group comprising:

a home network connection;

a corporate network connection; and

an Internet connection.

35. A method comprising:

defining a plurality of network zones such that each network zone corresponds to a different network connection policy;

receiving a network zone preference from an application program indicating a preferred network connection policy for the application program; and

enforcing the preferred network connection policy according to the network zone preference during execution of the application program.

36. A method as recited in claim 35, wherein the preferred network connection policy is a custom network connection policy, the method further comprising:

receiving instructions from the application program that define the custom network connection policy; and

enforcing the custom network connection policy according to the instructions during execution of the application program.

37. A computer comprising:

a processor;

a memory;

a zone module stored in the memory and executable on the processor;

a network zone supported by the zone module;

wherein the zone module is configured to receive a zone preference from an application and enforce the network zone for the application according to the zone preference.

38. A computer as recited in claim 37, wherein the network zone is a custom zone, and the zone preference includes instructions defining properties for the custom zone.

39. A computer comprising:

a zone module;

a zone preference received by the zone module; and

a preferred network zone specified by the zone preference;

wherein the zone module is configured to prevent communication between an application program and any network that is not assigned to the preferred network zone.

40. A computer as recited in claim 39, further comprising:

a plurality of network zones defined by the zone module; and

a plurality of network connections, each network connection assigned by the zone module to a distinct network zone.

41. A computer as recited in claim 40, wherein the preferred network zone is a custom zone, and the zone preference comprises instructions defining communication policies for the application program.

42. A computer comprising:

means for receiving from an application program, a preference that specifies a preferred network zone;

means for permitting a connection between the application program and a network associated with the preferred network zone; and

means for preventing a connection between the application program and a network not associated with the preferred network zone.

43. A computer as recited in claim 42, further comprising:

means for defining a plurality of network zones; and

means for associating the network with the preferred network zone.

44. A computer as recited in claim 43, wherein the means for defining further comprises means for associating network properties with each network zone.

45. A computer as recited in claim 43, wherein the means for associating further comprises:

means for connecting to the network;

means for determining network properties of the network; and

means for assigning the network to the network zone based on the network properties.

46. A computer as recited in claim 42, further comprising means for associating the application program with the preferred network zone.

47. A computer as recited in claim 42, wherein the means for receiving further comprises means for initiating an installation of the application program.

48. A computer as recited in claim 42, wherein the means for permitting a connection further comprises:

means for allowing the application program to accept a communication from the network associated with the preferred network zone; and

means for allowing the application program to initiate a communication to the network associated with the preferred network zone.

49. A computer as recited in claim 42, wherein the means for preventing a connection further comprises:

means for preventing the application program from accepting a communication from the network not associated with the preferred network zone; and

means for preventing the application program from initiating a communication to the network not associated with the preferred network zone.

50. A computer comprising:

means for recognizing a connection to a first network;

means for associating the first network with a first network zone;

means for permitting access to the first network for application programs that specify the first network zone as a preferred network zone; and

means for preventing access to the first network for application programs that specify a second network zone as a preferred network zone.

51. A computer as recited in claim 50, wherein the means for associating further comprises:

means for determining network properties of the first network; and

means for assigning the first network to the first network zone based on the network properties.

52. A computer as recited in claim 50, further comprising:

means for recognizing a connection to a second network;

means for associating the second network with the second network zone;

means for permitting access to the second network for application programs that specify the second network zone as a preferred network zone; and

means for preventing access to the second network for application programs that specify the first network zone as a preferred network zone.

53. A computer as recited in claim 52, further comprising:

means for permitting access to the first network and the second network for application programs that specify the first network zone and the second network zone as preferred network zones.

54. A computer comprising:

means for defining a plurality of network zones such that each network zone corresponds to a different network connection policy;

means for receiving a network zone preference from an application program indicating a preferred network connection policy for the application program; and

means for enforcing the preferred network connection policy according to the network zone preference during execution of the application program.

55. A computer as recited in claim 54, wherein the preferred network connection policy is a custom network connection policy, the computer further comprising:

means for receiving instructions from the application program that define the custom network connection policy; and

means for enforcing the custom network connection policy according to the instructions during execution of the application program.